Logging ISA Traffic

One of the most powerful troubleshooting tools at the disposal of SharePoint and ISA administrators is the Logging mechanism, which gives live or archived views of the logs on an ISA Server, and allows for quick and easy searching and indexing of ISA Server log information, including every packet of data that hits the ISA Server.

NOTE

Many advanced features of ISA logging are available only when using MSDE or SQL databases for the storage of the logs.

Examining ISA Logs

The ISA logs are accessible via the Logging tab in the details pane of the Monitoring node, as shown in Figure 16.13. They offer administrators the ability to watch, in real-time, what is happening to the ISA Server, whether it is denying connections, and what rule is being applied for each Allow or Deny statement.

Figure 16.13. Examining ISA logging.

The logs include pertinent information on each packet of data, including the following key characteristics:

• Log Time The exact time the packet was processed.

• Destination IP The destination IP address of the packet.

• Destination Port The destination TCP/IP port, such as Port 80 for HTTP traffic.

• Protocol The specific protocol that the packet utilized, such as HTTP, LDAP, RPC, or others.

• Action What type of action the ISA Server took on the traffic, such as initiating the connection or denying it.

• Rule Which particular firewall policy rule applied to the traffic.

• Client IP The IP address of the client that sent the packet.

• Client Username The username of the requesting client. Note that this is populated only if using the Firewall client.

• Source Network The source network that the packet came from.

• Destination Network The network where the destination of the packet is located.

• HTTP Method If HTTP traffic, this column displays the type of HTTP method utilized, such as GET or POST.

• URL If HTTP is used, this column displays the exact URL requested.

By searching through the logs for specific criteria in these columns, such as all packets sent by a specific IP address, or all URLs that match http://sharepoint.companyabc.com, advanced troubleshooting and monitoring are simplified.

Customizing Logging Filters

What is displayed in the details pane of the Logging tab is a reflection of only those logs that match certain criteria in the log filter. It is highly useful to use the filter to weed out the extraneous log entries that distract from the specific monitoring task. For example, on many networks, an abundance of NetBIOS broadcast traffic makes it difficult to read the logs. For this reason, a specific filter can be created to show only traffic that is not NetBIOS traffic. To set up this particular type of rule, do the following:

1.	From the ISA Admin Console, click on the Monitoring node from the Console tree and select the Logging tab in the details pane.
2.	From the Tasks tab in the Tasks pane, click the Edit Filter link.
3.	Under the Edit Filter dialog box, change the Filter By, Condition, and Value fields to display Protocol Not Equal NetBios Datagram, and click Add to List.
4.	Repeat for the NetBios Name Service and the NetBios Session values, so that the dialog box looks like the one displayed in Figure 16.14. Figure 16.14. Creating a custom logging filter.
5.	Click Start Query.

NOTE

It cannot be stressed enough that this logging mechanism is literally the best tool for trouble shooting ISA access. For example, it can be used to tell whether traffic from clients is even hitting the ISA Server, and if it is, what is happening to it (denied, accepted, and so on).