sergey vasin
Forefront TMG записывает логи в Local Log Queue (LLQ) – Forefront TMG (ISA Server) Product Team Blog
Одна из причин, по которой TMG может записывать логи в LLQ, вместо базы данных – это наличие неполных баз в локальном экземпляре SQL Server.
Другими словами, у вас могут быть базы данных, зарегистрированные на локальном сервере SQL, но с отсутствующими .mdf и .ldf-файлами. Это может произойти, если файлы были удалены вручную, диск, содержащий эти файлы боле недоступен, либо по другим причинам.
Важно сказать, что подобное может произойти, вне зависимости от того, настроена ли запись логов в локальную или удаленную базу. Происходит это потому, что TMG в любом случае проверяет целостность локальной базы, даже если логи записываются в удаленную.
При возникновении проблемы вы можете обнаружить следующее:
Чтобы определить, действительно ли вы столкнулись с описываемой проблемой, нужно проверить логи локального экземпляра SQL Server, которые по умолчанию находятся в “C:\Program Files\Microsoft SQL Server\MSSQL10.MSFW\MSSQL\Log”.
Сами же базы данных по умолчанию находятся в “C:\Program Files\Microsoft Forefront Threat Management Gateway\Logs\”.
Откройте файл ERRORLOG, находящийся в папке логов и проверьте его на наличие следующих сообщений:
2012-09-05 10:44:52.01 spid54 Starting up database ‘ISALOG_20120831_FWS_000’.
2012-09-05 10:44:52.02 spid54 Error: 17204, Severity: 16, State: 1.
2012-09-05 10:44:52.02 spid54 FCB::Open failed: Could not open file C:\Program Files\Microsoft Forefront Threat Management Gateway\Logs\ISALOG_20120831_FWS_000.mdf for file number 1. OS error: 2(failed to retrieve text for this error. Reason: 15100).
2012-09-05 10:44:52.15 spid54 Error: 17207, Severity: 16, State: 1.
2012-09-05 10:44:52.15 spid54 FileMgr::StartLogFiles: Operating system error 2(failed to retrieve text for this error. Reason: 15105) occurred while creating or opening file ‘C:\Program Files\Microsoft Forefront Threat Management Gateway\Logs\ISALOG_20120831_FWS_000.ldf’. Diagnose and correct the operating system error, and retry the operation.
Следующее, что нам нужно выяснить, это что же случилось с пропавшими файлами.
Если вы перенесли логи на другой том и этот том сейчас недоступен, попробуйте вернуть его в рабочее состояние.
Если же вернуть пропавшие файлы не представляется возможным, то нужно будет удалить записи об этих базах из локальной базы master. Вы можете определить имена неполных баз, запустив следующую команду из командной строки с административными полномочиями:
OSQL -E -S .\MSFW -Q “select name from sysdatabases where name like ‘%isalog%’”
Сравните имена баз, указанных в выводе этой команды с файлами баз данных в папке хранения лог-файлов. Определив имена отсутствующих баз, вам нужно будет подготовить файл, содержащий команды для удаления каждой отсутствующей базы. Он должен выглядеть следующим образом:
drop database ISALOG_20120831_FWS_000
go
drop database ISALOG_20120831_WEB_000
go
drop database ISALOG_20120901_FWS_000
go
drop database ISALOG_20120901_WEB_000
go
Сохраните этот файл под именем, например C:\DropDB.sql.
Далее, из командной строки с административными полномочиями выполните следующую команду:
OSQL -E -S .\MSFW -i c:\DropDB.sql
Перезапустите сервис “Microsoft Forefront TMG Firewall” и откройте окно “Log Status”. Значение “Disconnected” должно измениться на “Queue in use”. Кроме того, нажимая на Refresh вы должны увидеть, что значение “Log Queue (KB)” уменьшается.
В зависимости от того, сколько времени просуществовала проблема, а также от количества данных, сохраненных на сервере, этот процесс может занять от нескольких минут до нескольких дней.
После его завершения вы снова увидите статус “Ready”.
Автор:
Gianni Bragante
Support Engineer — Microsoft CSS Forefront Security Edge Team
Рецензент:
Lars Bentzen
Escalation Engineer — Microsoft CSS Forefront Security Edge Team
Before You Begin – See Fastvue TMG Reporter
We have another product dedicated to making reporting on Microsoft Forefront TMG simple and easy. Fastvue TMG Reporter includes live dashboards, alerts, and historical reporting, all preconfigured to show everything you need to know about employee Internet usage, bandwidth and how your network is operating.
Why WebSpy Vantage?
If you need full flexibility over the content of your reports, WebSpy Vantage provides a comprehensive report templating and data aliasing engine that is not available in Fastvue TMG Reporter. WebSpy Vantage also has more flexibility when it comes to distributing reports securely to the right people in your organization.
If you need full control over the report content and/or have specific requirements around report access permissions, then please see the guide below on configuring Microsoft Forefront TMG logging and reporting with WebSpy Vantage.
1. Accessing Forefront TMG’s Log Files
The first step in reporting on your Forefront TMG server is to access the Forefront TMG log files. Forefront TMG has three different logging options. WebSpy Vantage can import all of these formats, but some work may be required to access them from your WebSpy Vantage machine:
By default, Forefront TMG creates log files in it’s own local SQL Express instance. The instance name is MSFW. New databases are created each day, and there is a log table for Firewall and another for Web Proxy data. You can import this log database using the ‘Database Connection’ option in WebSpy Vantage, however, you need to first enable network access and permissions to the databases.
Although not recommended, you can avoid opening the SQL Express logs to network access by installing Vantage on your Forefront TMG Server, and running reports in off-peak times. See our article on how to do this here.
Logging to a remote SQL Server enables you to centralize all your Forefront TMG log files, and has some other great advantages for enterprises. You can import these logs using the ‘Database Connection’ option in WebSpy Vantage and you can select whether to connect with Windows Authentication or SQL Authentication.
If using Windows Authentication, make sure the User Account running WebSpy Vantage has db_reader permission on the SQL databases and tables.
Logging to File (Text log) is by far the easiest method of accessing your log files with WebSpy Vantage. We recommend you use the W3C format due to the standards compliant log structure, however, the native .iis format is supported as well. Simply share the folder that your log files are stored in, and use the ‘Local Networked Files or Folders’ option when importing the logs in WebSpy Vantage.
To find the log format Forefront TMG is currently using:
- Open the Forefront TMG Management Console.
- Select Logs and Reports in the left-hand side.
- Click Configure Web Proxy Logging in the left-hand side. The logging options above are selected in this dialog.
- If you’re logging to Text or Remote SQL, click the Advanced button to see where those log are being created.
The default ‘ISA Logs Folder’ is C:\Program Files\Microsoft Forefront Threat Management Gateway 2010\Logs
About Firewall Logs: You will also notice an option to Configure Firewall Logging in step 3 above. Logging is configured in exactly the same way as the Web Proxy logs and the Firewall logs are fully supported in WebSpy Vantage. However, if you are mainly interested in analyzing web browsing behavior, simply import and analyze the Web Proxy log files into WebSpy Vantage.
Importing Microsoft Forefront TMG SQL Express logs into WebSpy Vantage
Automating the process of importing and reporting on Microsoft Forefront TMG log files as a Daily Task
2. Importing Microsoft Forefront TMG Logs into WebSpy Vantage
WebSpy Vantage imports text log files from over 200 common network devices, into its own database format called a Storage. You can then use this Storage for analysis and reporting, you can regardless of whether the original log file has been moved, archived or deleted.
To import your Microsoft Forefront TMG logs into WebSpy Vantage, go to the Storages tab and click Import logs. The options to select vary slightly depending on your log file type:
- Storage Name: Enter anything you like such as ‘TMG Web Proxy Logs’
- Input Type Page: Select Database connection
- Loader Selection: Select Microsoft FTMG
- Input Selection: Click Add and select/enter the following:
- MS SQL
- Server: Enter the Forefront TMG’s server name followed by \MSFW. For example 10.0.0.10\MSFW. If Vantage is installed on your TMG Server, you can enter .\MSFW (‘.’ means localhost)
- Port: 1433
- Database Filter: Enter a database filter of *WEB* to only import the web proxy databases, or leave it set to * to import everything including the Firewall databases.
- Table Filter: Leave this set to * to import all tables in the Databases.
- Storage Name: Enter anything you like such as ‘TMG Web Proxy Logs’
- Input Type Page: Select Database connection
- Loader Selection: Select Microsoft FTMG
- Input Selection: Click Add and select/enter the following:
- MS SQL
- Server: Enter the name or IP address of your SQL Server. For example 10.0.0.10.
- Port: 1433
- Database Filter: Enter the database name, or a suitable database search string (such as *LogDB*) to select the databases that contains the TMG log tables.
- Table Filter: Enter the table name or a suitable search string (such as *WebProxy*), where your TMG logs are being written to. Leave it as * to import all tables in the database.
Click OK and you should see a list of the databases and tables appear in the Import Wizard. Click OK again on the Import Wizard to start importing.
- Storage Name: Enter anything you like such as ‘TMG Web Proxy Logs’
- Input Type Page: Select Local Networked Files or Folders
- Loader Selection: Select Microsoft FTMG
- Input Selection: Click Add | Folder and select/enter the following:
- Folder: Browse to the folder containing your Forefront TMG log files. Make sure you specify a UNC path such as \\servername\logs rather than a mapped network drive (Vantage cannot import from mapped drives when logged off)
- File Mask: Leave this set to * to import all logs, or enter a suitable search string such as *WEB* to only import web proxy logs, or *FWS* to only import Firewall logs.
- Timezone Offset: Forefront TMG logs in GMT time. Make sure you specify a timezone offset so that your reports show activity in your local timezone rather than in GMT.
- Leave all other options as default
Click OK and you should see a list of TMG log files appear in the Import Wizard. Click OKagain on the Import Wizard to start importing.
Entering Directory Server details
Selecting LDAP Root DN and Search Query.
Using LDAP attributes for username aliasing and Web Module login names.
Grouping users by LDAP attributes and/or OUs.
LDAP import merging options.
A successfully imported Organization tree.
3. Import Your Organization
Microsoft Forefront TMG logs authenticated usernames in the format domain\username. WebSpy Vantage can import information from Active Directory to alias these authenticated users into real names (first name last name), departments, offices and OUs.
To do this, go to the Organization tab and click Import Organization.
On the Directory Server page, select your directory type and server, along with a username (in domain\username format) and password to authenticate with your directory server, and click Test. Click Next after you have successfully connected to your directory server.
Select a Root Distinguished Name to search for users within (for example, ‘dc=mydomain, dc=com’) from the dropdown list. If your users are contained within a specific OU, select the ‘…‘ button to select the OU in your directory.
The LDAP search query defaults to a query that returns ‘user accounts’. It’s important to note that WebSpy Vantage’s licensing is based on ‘number of users’, so if necessary, use the Quick Queries drop-down to change the LDAP search query and import a more specific set of user accounts, such as enabled users with an email address. WebSpy Vantage will import all users up to the license limit, which is unlimited during your trial. Click Next.
The User Details page defines how Vantage maps user objects in your Directory to authenticated usernames in your log files, as well as configuring user login names for the Web Module, the email address to send report notifications to, and the attribute to use to find a user’s manager.
If you are using Active Directory, you choose Use Active Directory Defaults. WebSpy Vantage will attempt to detect the name of your domain, and prefix this to all account names so that your authenticated usernames logged by Microsoft Forefront TMG are correctly aliased to a user object in Active Directory.
If your domain prefix on user accounts is different to your computer network’s domain name, click Custom, then check the Prefix checkbox and enter the required domain prefix.
The Grouping page enables you to configure how you would like users grouped, such as by Departments, Offices, OUs etc. User Objects in Active Directory have a number of attributes, including department, office, description, company, and you can also place user objects in OU containers, and configure attributes on those containers. WebSpy Vantage can hook into any of these attributes to group your users for the purpose of reporting.
By default, there are two groups specified: Offices (using the ‘physicalDeliveryOfficeName’ attribute in Active Directory) and Departments (using the ‘department’ attribute in Active Directory).
If a user does not have one of these values populated in Active Directory, then they will be imported into the ‘Unknown’ department and office respectively. Alternatively, you can uncheck the Import Ungrouped Users option at the bottom of the Grouping page.
You can edit or delete these groups as necessary.
When adding or editing a group:
- First, enter the name of the Group into the Name field. This is up to you and should represent what the group is, such as ‘Departments’, ‘Locations’, ‘Business Centers’ etc. (Note, there are a few default Report Templates that use ‘Departments’ so use the word ‘Departments’ in one of your grouping levels utilize these reports).
- Enter the exact name of the attribute into the Attribute field. For example, enter ‘physicalDeliveryOfficeName’ to import the Office attribute from Active Directory. To import the name of an OU, use the attribute ‘OU’.
By default, Active Directory Users and Computers hides the real attribute names. You can change this by selecting View | Advanced Features to show the Attribute Editor with real attribute names when editing a User or OU.
Tip: Later, you’ll need to configure Web Module access permissions for people and/or groups. To create a default set of permissions that apply to your entire organization, create a top-level group using an attribute that everyone is a member of. For example, call the group ‘Domain’ and use the attribute ‘dc’.
Once you have specified all the Groups you would like to use in your reporting process, click Next.
The Merging page enables you to use the Import Organization wizard multiple times, and merge the results into your existing Organization structure. For example, first import your Organization from one domain (or one Root DN on your domain), with the Overwrite existing organization tree option set to create an initial Organization tree, then run the Import Organization wizard again to import your Organization from another domain (or a different Root DN on your domain) and merge the results into your existing Organization tree.
The Merge options enable to you to keep or remove users that can no longer be found in the directory, as well as keep or update existing user’s details. Use the ‘keep users / keep details’ options if importing from a different domain or root DN.
Note: When merging, only users that have previously been added from your LDAP/LDIF directory will be affected. Users that have been manually added will not be affected.
Click OK to complete the Import Organization wizard and begin the import. Once the import is complete you will see you the Organization tree displayed. You can use the View drop-down list at the top of the Organization tree to display your groups, or your manager/subordinate hierarchy.
Forefront где хранятся логи
2012-09-05 10:44:52.01 spid54 Starting up database ‘ISALOG_20120831_FWS_000’.
2012-09-05 10:44:52.02 spid54 Error: 17204, Severity: 16, State: 1.
2012-09-05 10:44:52.02 spid54 FCB::Open failed: Could not open file C:\Program Files\Microsoft Forefront Threat Management Gateway\Logs\ISALOG_20120831_FWS_000.mdf for file number 1. OS error: 2(failed to retrieve text for this error. Reason: 15100).
2012-09-05 10:44:52.15 spid54 Error: 17207, Severity: 16, State: 1.
2012-09-05 10:44:52.15 spid54 FileMgr::StartLogFiles: Operating system error 2(failed to retrieve text for this error. Reason: 15105) occurred while creating or opening file ‘C:\Program Files\Microsoft Forefront Threat Management Gateway\Logs\ISALOG_20120831_FWS_000.ldf’. Diagnose and correct the operating system error, and retry the operation.OSQL -E -S .\MSFW -Q “select name from sysdatabases where name like ‘%isalog%’”
drop database ISALOG_20120831_FWS_000
go
drop database ISALOG_20120831_WEB_000
go
drop database ISALOG_20120901_FWS_000
go
drop database ISALOG_20120901_WEB_000
goOSQL -E -S .\MSFW -i c:\DropDB.sql
Gianni Bragante
Support Engineer — Microsoft CSS Forefront Security Edge TeamLars Bentzen
Escalation Engineer — Microsoft CSS Forefront Security Edge TeamBefore You Begin – See Fastvue TMG Reporter
We have another product dedicated to making reporting on Microsoft Forefront TMG simple and easy. Fastvue TMG Reporter includes live dashboards, alerts, and historical reporting, all preconfigured to show everything you need to know about employee Internet usage, bandwidth and how your network is operating.
Why WebSpy Vantage?
If you need full flexibility over the content of your reports, WebSpy Vantage provides a comprehensive report templating and data aliasing engine that is not available in Fastvue TMG Reporter. WebSpy Vantage also has more flexibility when it comes to distributing reports securely to the right people in your organization.
If you need full control over the report content and/or have specific requirements around report access permissions, then please see the guide below on configuring Microsoft Forefront TMG logging and reporting with WebSpy Vantage.
1. Accessing Forefront TMG’s Log Files
The first step in reporting on your Forefront TMG server is to access the Forefront TMG log files. Forefront TMG has three different logging options. WebSpy Vantage can import all of these formats, but some work may be required to access them from your WebSpy Vantage machine:
By default, Forefront TMG creates log files in it’s own local SQL Express instance. The instance name is MSFW. New databases are created each day, and there is a log table for Firewall and another for Web Proxy data. You can import this log database using the ‘Database Connection’ option in WebSpy Vantage, however, you need to first enable network access and permissions to the databases.
Although not recommended, you can avoid opening the SQL Express logs to network access by installing Vantage on your Forefront TMG Server, and running reports in off-peak times. See our article on how to do this here.
Logging to a remote SQL Server enables you to centralize all your Forefront TMG log files, and has some other great advantages for enterprises. You can import these logs using the ‘Database Connection’ option in WebSpy Vantage and you can select whether to connect with Windows Authentication or SQL Authentication.
If using Windows Authentication, make sure the User Account running WebSpy Vantage has db_reader permission on the SQL databases and tables.
Logging to File (Text log) is by far the easiest method of accessing your log files with WebSpy Vantage. We recommend you use the W3C format due to the standards compliant log structure, however, the native .iis format is supported as well. Simply share the folder that your log files are stored in, and use the ‘Local Networked Files or Folders’ option when importing the logs in WebSpy Vantage.
To find the log format Forefront TMG is currently using:
- Open the Forefront TMG Management Console.
- Select Logs and Reports in the left-hand side.
- Click Configure Web Proxy Logging in the left-hand side. The logging options above are selected in this dialog.
- If you’re logging to Text or Remote SQL, click the Advanced button to see where those log are being created.
The default ‘ISA Logs Folder’ is C:\Program Files\Microsoft Forefront Threat Management Gateway 2010\Logs
About Firewall Logs: You will also notice an option to Configure Firewall Logging in step 3 above. Logging is configured in exactly the same way as the Web Proxy logs and the Firewall logs are fully supported in WebSpy Vantage. However, if you are mainly interested in analyzing web browsing behavior, simply import and analyze the Web Proxy log files into WebSpy Vantage.
Importing Microsoft Forefront TMG SQL Express logs into WebSpy Vantage
Automating the process of importing and reporting on Microsoft Forefront TMG log files as a Daily Task
2. Importing Microsoft Forefront TMG Logs into WebSpy Vantage
WebSpy Vantage imports text log files from over 200 common network devices, into its own database format called a Storage. You can then use this Storage for analysis and reporting, you can regardless of whether the original log file has been moved, archived or deleted.
To import your Microsoft Forefront TMG logs into WebSpy Vantage, go to the Storages tab and click Import logs. The options to select vary slightly depending on your log file type:
- Storage Name: Enter anything you like such as ‘TMG Web Proxy Logs’
- Input Type Page: Select Database connection
- Loader Selection: Select Microsoft FTMG
- Input Selection: Click Add and select/enter the following:
- MS SQL
- Server: Enter the Forefront TMG’s server name followed by \MSFW. For example 10.0.0.10\MSFW. If Vantage is installed on your TMG Server, you can enter .\MSFW (‘.’ means localhost)
- Port: 1433
- Database Filter: Enter a database filter of *WEB* to only import the web proxy databases, or leave it set to * to import everything including the Firewall databases.
- Table Filter: Leave this set to * to import all tables in the Databases.
- Storage Name: Enter anything you like such as ‘TMG Web Proxy Logs’
- Input Type Page: Select Database connection
- Loader Selection: Select Microsoft FTMG
- Input Selection: Click Add and select/enter the following:
- MS SQL
- Server: Enter the name or IP address of your SQL Server. For example 10.0.0.10.
- Port: 1433
- Database Filter: Enter the database name, or a suitable database search string (such as *LogDB*) to select the databases that contains the TMG log tables.
- Table Filter: Enter the table name or a suitable search string (such as *WebProxy*), where your TMG logs are being written to. Leave it as * to import all tables in the database.
Click OK and you should see a list of the databases and tables appear in the Import Wizard. Click OK again on the Import Wizard to start importing.
- Storage Name: Enter anything you like such as ‘TMG Web Proxy Logs’
- Input Type Page: Select Local Networked Files or Folders
- Loader Selection: Select Microsoft FTMG
- Input Selection: Click Add | Folder and select/enter the following:
- Folder: Browse to the folder containing your Forefront TMG log files. Make sure you specify a UNC path such as \\servername\logs rather than a mapped network drive (Vantage cannot import from mapped drives when logged off)
- File Mask: Leave this set to * to import all logs, or enter a suitable search string such as *WEB* to only import web proxy logs, or *FWS* to only import Firewall logs.
- Timezone Offset: Forefront TMG logs in GMT time. Make sure you specify a timezone offset so that your reports show activity in your local timezone rather than in GMT.
- Leave all other options as default
Click OK and you should see a list of TMG log files appear in the Import Wizard. Click OKagain on the Import Wizard to start importing.
Entering Directory Server details
Selecting LDAP Root DN and Search Query.
Using LDAP attributes for username aliasing and Web Module login names.
Grouping users by LDAP attributes and/or OUs.
LDAP import merging options.
A successfully imported Organization tree.
3. Import Your Organization
Microsoft Forefront TMG logs authenticated usernames in the format domain\username. WebSpy Vantage can import information from Active Directory to alias these authenticated users into real names (first name last name), departments, offices and OUs.
To do this, go to the Organization tab and click Import Organization.
On the Directory Server page, select your directory type and server, along with a username (in domain\username format) and password to authenticate with your directory server, and click Test. Click Next after you have successfully connected to your directory server.
Select a Root Distinguished Name to search for users within (for example, ‘dc=mydomain, dc=com’) from the dropdown list. If your users are contained within a specific OU, select the ‘…‘ button to select the OU in your directory.
The LDAP search query defaults to a query that returns ‘user accounts’. It’s important to note that WebSpy Vantage’s licensing is based on ‘number of users’, so if necessary, use the Quick Queries drop-down to change the LDAP search query and import a more specific set of user accounts, such as enabled users with an email address. WebSpy Vantage will import all users up to the license limit, which is unlimited during your trial. Click Next.
The User Details page defines how Vantage maps user objects in your Directory to authenticated usernames in your log files, as well as configuring user login names for the Web Module, the email address to send report notifications to, and the attribute to use to find a user’s manager.
If you are using Active Directory, you choose Use Active Directory Defaults. WebSpy Vantage will attempt to detect the name of your domain, and prefix this to all account names so that your authenticated usernames logged by Microsoft Forefront TMG are correctly aliased to a user object in Active Directory.
If your domain prefix on user accounts is different to your computer network’s domain name, click Custom, then check the Prefix checkbox and enter the required domain prefix.
The Grouping page enables you to configure how you would like users grouped, such as by Departments, Offices, OUs etc. User Objects in Active Directory have a number of attributes, including department, office, description, company, and you can also place user objects in OU containers, and configure attributes on those containers. WebSpy Vantage can hook into any of these attributes to group your users for the purpose of reporting.
By default, there are two groups specified: Offices (using the ‘physicalDeliveryOfficeName’ attribute in Active Directory) and Departments (using the ‘department’ attribute in Active Directory).
If a user does not have one of these values populated in Active Directory, then they will be imported into the ‘Unknown’ department and office respectively. Alternatively, you can uncheck the Import Ungrouped Users option at the bottom of the Grouping page.
You can edit or delete these groups as necessary.
When adding or editing a group:
- First, enter the name of the Group into the Name field. This is up to you and should represent what the group is, such as ‘Departments’, ‘Locations’, ‘Business Centers’ etc. (Note, there are a few default Report Templates that use ‘Departments’ so use the word ‘Departments’ in one of your grouping levels utilize these reports).
- Enter the exact name of the attribute into the Attribute field. For example, enter ‘physicalDeliveryOfficeName’ to import the Office attribute from Active Directory. To import the name of an OU, use the attribute ‘OU’.
By default, Active Directory Users and Computers hides the real attribute names. You can change this by selecting View | Advanced Features to show the Attribute Editor with real attribute names when editing a User or OU.
Tip: Later, you’ll need to configure Web Module access permissions for people and/or groups. To create a default set of permissions that apply to your entire organization, create a top-level group using an attribute that everyone is a member of. For example, call the group ‘Domain’ and use the attribute ‘dc’.
Once you have specified all the Groups you would like to use in your reporting process, click Next.
The Merging page enables you to use the Import Organization wizard multiple times, and merge the results into your existing Organization structure. For example, first import your Organization from one domain (or one Root DN on your domain), with the Overwrite existing organization tree option set to create an initial Organization tree, then run the Import Organization wizard again to import your Organization from another domain (or a different Root DN on your domain) and merge the results into your existing Organization tree.
The Merge options enable to you to keep or remove users that can no longer be found in the directory, as well as keep or update existing user’s details. Use the ‘keep users / keep details’ options if importing from a different domain or root DN.
Note: When merging, only users that have previously been added from your LDAP/LDIF directory will be affected. Users that have been manually added will not be affected.
Click OK to complete the Import Organization wizard and begin the import. Once the import is complete you will see you the Organization tree displayed. You can use the View drop-down list at the top of the Organization tree to display your groups, or your manager/subordinate hierarchy.
9. Fortinet Getting Started v6.0. Логирование и отчетность
Приветствую! Добро пожаловать на девятый урок курса Fortinet Getting Started. На прошлом уроке мы рассмотрели основные механизмы контроля доступа пользователей к различным ресурсам. Теперь перед нами другая задача — необходимо анализировать поведение пользователей в сети, а также настроить получение данных, которые смогут помочь при расследовании различных инцидентов безопасности. Поэтому в данном уроке мы рассмотрим механизм логирования и отчетности. Для этого нам пригодится FortiAnalyzer, который мы развернули в начале курса. Необходимая теория, а также видео урок доступны под катом.
В FotiGate логи делятся на три типа: логи трафика, логи событий и логи безопасности. Они же в свою очередь делятся на подтипы.
Логи трафика записывают информацию о потоке трафика, такие как запросы и ответы, если они имеются. Этот тип содержит подтипы Forward, Local и Sniffer.
Подтип Forward содержит информацию о трафике, который FortiGate либо принял, либо отклонил в соответствии с политиками межсетевого экранирования.
Подтип Local содержит информацию о трафике непосредственно с IP адреса FortiGate и с IP адресов, с которых осуществляется администрирование. Например — подключения к веб интерфейсу FortiGate.
Подтип Sniffer содержит логи трафика, который был получен с помощью зеркалирования трафика.
Логи событий содержат в себе системные или административные события, такие как — добавление или изменение параметров, установление и разрыв VPN туннелей, события динамической маршрутизации и так далее. Все подтипы представлены на рисунке ниже.
И третий тип представляет собой логи безопасности. В данные логи записываются события, связанные с вирусными атаками, посещениями запрещенных ресурсов, использованием запрещенных приложений и так далее. Полный перечень также представлен на рисунке ниже.
Хранить логи можно в разных местах — как на самом FortiGate, так и за его пределами. Хранение логов на FortiGate считается локальным логированием. В зависимости от самого устройства хранить логи можно либо во флеш-памяти устройства, либо на жестком диске. Как правило, модели от middle имеют жесткий диск. Модели с жестким диском отличить довольно просто — в окончании имеется единица. Например — FortiGate 100E идет без жесткого диска, а FortiGate 101E — с жестким диском.
У младших и старых моделей обычно жесткого диска нет. В таком случае для записи логов используется флеш-память. Однако стоит учитывать, что постоянная запись логов во флеш-память может сократить ее эффективность и срок службы. Поэтому, запись логов во флеш-память по умолчанию отключена. Включать ее рекомендуется только для логирования событий во время решения конкретных проблем.
При интенсивной записи логов, неважно, на жесткий диск или во флеш-память — производительность устройства будет снижаться.
Довольно распространено хранение логов на удаленных серверах. FortiGate может хранить логи на Syslog серверах, на FortiAnalyzer или FortiManager. Также для хранения логов можно использовать облачный сервис FortiCloud.
Syslog представляет собой сервер для центрального хранения логов с сетевых устройств.
FortiCloud — это служба управления безопасностью и хранения логов, основанная на подписке. С ее помощью можно удаленно хранить логи и строить соответствующие отчеты. Если у вас довольно маленькая сеть, удачным решением может быть как раз использование данного облачного сервиса, а не покупка дополнительного оборудования. Существует бесплатная версия FortiCloud, которая подразумевает недельное хранение логов. После приобретения подписки логи можно хранить в течение года.FortiAnalyzer и FortiManager являются внешними устройствами хранения логов. Благодаря тому, что они все имеют одинаковую операционную систему — FortiOS — интеграция FortiGate с данными устройствами не представляет никаких сложностей.
Но следует отметить отличия между устройствами FortiAnalyzer и FortiManager. Основной целью FortiManager является централизованное управление несколькими устройствами FortiGate — поэтому объем памяти для хранения логов на FortiManager существенно меньше, чем на FortiAnalyzer (если, конечно, сравнивать модели из одного ценового сегмента).
Основной целью FortiAnalyzer как раз является сбор и анализ логов. Поэтому именно работу с ним мы далее и рассмотрим на практике.
Вся теория, а также практическая часть представлены в данном видео уроке:
В следующем уроке мы рассмотрим основные моменты, связанные с администрированием устройства FortiGate. Чтобы не пропустить его, следите за обновлениями на следующих каналах: