Reports

One of the most common requests made to firewall administrators is to deliver reports: reports of Web usage by employees, of traffic through the firewall, and so on. ISA Server can provide an almost unlimited amount of information about ISA Server activity if you interrogate its logs. In this section we examine how to set up and access preconfigured ISA Server reports.

Report Types

There are five categories of reports, each of which provides in-depth information on various aspects of ISA Server. Table 6-5 defines the five unique report categories mentioned under the Customized Reports section of the task pane.

Table 6-5: Built-In Report Categories and Descriptions

Report Category	Description
Summary Content	Includes statistics on ISA Server usage including protocols, top users, top Web sites, cache performance, traffic, and daily traffic
Web Usage Content	Includes statistics on top Web users, Web sites, HTTP responses, object types, Web browsers, operating systems, and protocols
Application Usage Content	Includes statistics from top application users, top applications, operating system, and top destinations
Traffic and Utilization Content	Includes statistics on traffic, connections, daily traffic, protocols, cache performance, processing time, and errors
Security Content	Includes statistics on authorization failures and dropped packets

Generating a Report

You can generate reports in ISA Server by following these steps:

1. Open the ISA Server Management console.

2. In the console tree, click the Monitoring node.

3. In the details pane, click the Reports tab.

4. In the task pane, under Reports Tasks, click Generate A New Report.

5. On the Welcome To The New Report Wizard page, type a name for the new report, and click Next.

6. On the Report Content page, select the content to include in the report. The following options are checked by default:

   • Summary

   • Web Usage

   • Application Usage

   • Traffic And Utilization

   • Security

   To continue click Next.

7. On the Report Period page, from the Start Date drop-down calendar, select a start date. From the Finish Date drop-down calendar, select a finish date, and then click Next.

8. On the Report Publishing page, you have the option to publish the report in HTML format to a location on your network. This option is not required to continue with the wizard. To configure, select the Publish Reports To A Directory check box as shown in Figure 6-7. In the Published Reports Directory text box, type the UNC path (\\servername\sharename) to where you would like the report stored. If the user account you are using doesn't have write access to the network share, select the Publish Using This Account check box, click Set Account, and type the user name and password of an account that does. Click OK, and then click Next.

9. On the Send E-Mail Notification page, you have the option to send an e-mail to a recipient after a report has been created. This option is also not required to continue with the wizard. To configure, select the Send E-Mail Notification For Completed Reports check box as shown in Figure 6-8. In the SMTP Server text box, type the name of an internal or external SMTP server. In the From, To, and CC text boxes, type the applicable e-mail addresses. In the Message text box, you can specify an optional message for the recipient of the e-mail. Click Test to verify that sending the e-mail works, and then click Next.

   Note 

   If you select the option to publish a report, you can choose to include the link to that location in an e-mail.

10. On the Completing The New Report Wizard page, review the summary of information, and then click Finish.

Figure 6-7: You can publish reports to a network share for increased visibility and ease of access.

Figure 6-8: E-mail notifications can be sent to notify you when reports have been generated.

Creating a Report Job

Report jobs are beneficial when you have reports that you would like to have generated on a recurring schedule. For reports to be automatically created with report jobs, the Microsoft ISA Server Job Scheduler service must be running. To configure a report job, follow these steps:

1. Open the ISA Server Management console.

2. In the console tree, click the Monitoring node.

3. In the details pane, click the Reports tab.

4. In the task pane, under Reports Tasks, click Create And Configure Report Jobs.

5. In the Report Jobs Properties dialog box, click Add.

6. On the Welcome To The New Report Job Wizard page, type the name to assign to the report job, and then click Next.

7. On the Report Content page, select the content to include in the report. The following options are selected by default:

   • Summary

   • Web Usage

   • Application Usage

   • Traffic And Utilization

   • Security

   To continue, click Next.

8. On the Report Job Schedule page, you can specify the frequency by selecting the report job to run daily, weekly, or monthly as shown in Figure 6-9. Click Next to continue.

   Note 

   Report Jobs are generated at 1:00 AM by default. By contrast, Log Summaries (described later) generate at 12:30 AM by default.

9. On the Report Publishing page, you have the option to publish the report in HTML format to a location on your network. This option is not required to continue with the wizard. To configure this option, select the Publish Reports To A Directory check box. In the Published Reports Directory text box, type the UNC path (\\servername\sharename) to where you would like the report stored. If the user account you are using doesn't have write access to the network share, select the Publish Using This Account check box, click Set Account, and type the user name and password of an account that does. Click OK, and then click Next.

10. On the Send E-Mail Notification page, you have the option to send an e-mail to a recipient after a report has been created. This option is also not required to continue with the wizard. To configure this option, select the Send E-Mail Notification For Completed Reports check box. In the SMTP Server text box, type the name of an internal or external SMTP server. In the From, To, and CC text boxes, type the applicable e-mail addresses. In the Message text box, you can specify an optional message for the recipient of the e-mail. Click Test to verify that sending of the e-mail works, and then click Next.

11. On the Completing The New Report Job Wizard page, review the summary of information, and then click Finish.

Figure 6-9: You can determine the frequency with which the report job will run.

Publishing a Report

Publishing a report is a useful feature for storing reports on a frequently used network share for yourself or others to view.

To publish a report, complete the following steps:

1. Open the ISA Server Management console.

2. In the console tree, click the Monitoring node.

3. In the details pane, click the Reports tab, and then select the applicable report to publish.

4. In the task pane, under Reports Tasks, click Publish Selected Report.

5. In the Browse For Folder window, locate and select the folder where you want the report to be published, and click OK.

Viewing a Report

You will regularly want to view the reports that you have created on the ISA server. There are multiple ways to view a report, as shown in the following steps:

1. Open the ISA Server Management console.

2. In the console tree, click the Monitoring node.

3. In the details pane, click the Reports tab, and then select the applicable report to view.

4. In the task pane, under Reports Tasks, click View Selected Report to open the Report.htm file in your browser.

5. Close the browser when you are finished viewing the report.

Note 

Many of the tasks in ISA Server 2004 can be completed by right-clicking the object you are working with; for example, you can right-click the applicable report in the details pane, and select View. Also, if you published a report, you can browse to the folder and open the Report.htm file directly.

Customizing a Report

The report content in ISA Server 2004 can be customized based on your preferences. To customize report content, follow these steps:

1. Open the ISA Server Management console.

2. In the console tree, click the Monitoring node.

3. In the details pane, click the Reports tab.

4. In the task pane, under Customize Reports, you will find five links to choose from:

   • Customize Summary Content Allows you to change the way in which you select and sort data for the Summary reports, showing a view of data (like Top Protocols, Top Users, Top Sites, and Cache Hit Ratio) at a high level—for example, if you're more interested in the number of users that contact your site than in the total amount of data requested, you will choose to sort Top Sites by Users rather than Total Bytes.

   • Customize Web Usage Content Allows you to select and configure the sort order for information specific to Web Usage (like Top Protocols, Top Sites, Top Users, Object Types, Browsers, and Operating Systems)—for example, you can choose to expand the number of Web Browsers captured from the default of five to ten, and sort by the Operating System.

   • Customize Application Usage Content Allows you to select and configure the sort order for Application Usage Content showing the applications (like Outlook, etc.) that are used by the largest number of users or by the total number of requests. This report allows you to also sort information based on the Top Protocols, Top Users, Client Applications, Destinations, and Operating Systems.

   • Customize Traffic And Utilization Content Allows you to see the types of protocols (like HTTP, POP3, etc.), the amount of traffic cache content and the like—you can customize the number of Top Protocols, and the Cache Hit Ratio's sort order.

   • Customize Security Content Opens the Security Content Properties dialog box that allows you to configure the number of clients for dropped packets and the number of users for authorization failures.

5. Click Apply to save the changes, and then click OK.

Configuring Log Summaries

Log summaries are derived from the Microsoft Firewall Service and Web Proxy logs to provide consolidated information from multiple logs for a particular ISA Server computer. Summaries are maintained in a database in the ISASummaries folder under the ISA Server installation directory (by default C:\Program Files\Microsoft ISA Server\). To change the time these summaries are saved, the number of summaries retained, or where they're stored, complete the following steps:

1. Open the ISA Server Management console.

2. In the console tree, click the Monitoring node.

3. In the details pane, click the Reports tab.

4. In the task pane, under Related Tasks, click Configure Log Summary.

5. In the Log Summary Properties dialog box shown in Figure 6-10, you can modify several options:

   • Enable or disable daily and monthly summaries

   • Change the Log Summary generation time which is by default at 12:30 AM (as opposed to Report generation, which takes place by default at 1:00 AM)

   • Change the location of saved summaries

   • Change the number of saved summaries

6. Once you have made your modifications, if any, click OK.

Figure 6-10: Log summaries are essential to gathering reporting data.