One of the most powerful troubleshooting tools at the disposal of ISA Administrators is the logging mechanism, which gives live or archived views of the logs on an ISA Server, and allows for quick and easy searching and indexing of ISA Server log information, including every packet of data that hits the ISA server.
Many of the advanced features of ISA Logging are available only when MSDE or SQL databases are used for the storage of the logs.
Examining ISA Logs
The ISA logs are accessible via the Logging tab in the Details pane of the Monitoring node, as shown in Figure 19.7. They enable administrators to watch, in real time, what is happening to the ISA server, whether it is denying connections, and what rule is being applied for each Allow or Deny statement.
Figure 19.7. Examining ISA Logging
The logs include pertinent information on each packet of data, including the following key characteristics:
Searching through the logs for specific criteria identified in these columns, such as all packets sent by a specific IP address, or all URLs that match http://mail.companyabc.com, simplifies advanced troubleshooting and monitoring.
Customizing Logging Filters
What is displayed in the Details pane of the Logging tab is a reflection of only those logs that match certain criteria in the log filter. It is highly useful to use the filter to weed out the extraneous log entries that just distract from the specific monitoring task. For example, on many networks, an abundance of NetBIOS broadcast traffic makes it difficult to read the logs. For this reason, a specific filter can be created to show only traffic that is not NetBIOS traffic. To set up this particular type of rule, do the following:
It cannot be stressed enough that this logging mechanism is quite literally the best tool for troubleshooting ISA access. For example, it can be used to tell whether traffic from clients is even hitting the ISA Server, and if it is, what is happening to it (denied, accepted, and so on).