Has your problem been resolved
- From: Nutty Nut
- Date: Wed, 28 Oct 2009 16:38:38 -0700
I have the same issue. Serveral clients are experiencing the same thing as you've mentioned. When they logged on to another machine, its fine.
Goldi wrote:
username not showing in ISA log
21-Nov-07
Hi there,
We are in the process of implementing an application to enable us to report
on user web browsing statistics.
The package is great but there is one problem. A few of the users are not
showing up in the reports - i thought this was a problem with the app but
when examining the log there is no evidence of these users in the log.
However, if i work out the IP address of the user and search the log they
(and all their activity) are there.
Why, when the users in question are all using the proxy like everyone else,
are these users usernames not visible in the lo? Their activity is there but
it is anonymous...
Sorry for the long winded explanation!
Any assistance greatly appreciated!
G
Previous Posts In This Thread:
On Wednesday, November 21, 2007 6:54 AM
Goldi wrote:
username not showing in ISA log
Hi there,
We are in the process of implementing an application to enable us to report
on user web browsing statistics.
The package is great but there is one problem. A few of the users are not
showing up in the reports - i thought this was a problem with the app but
when examining the log there is no evidence of these users in the log.
However, if i work out the IP address of the user and search the log they
(and all their activity) are there.
Why, when the users in question are all using the proxy like everyone else,
are these users usernames not visible in the lo? Their activity is there but
it is anonymous...
Sorry for the long winded explanation!
Any assistance greatly appreciated!
G
On Wednesday, November 21, 2007 9:11 AM
David Carson wrote:
Re: username not showing in ISA log
On Wed, 21 Nov 2007 03:54:00 -0800, Goldie
<Goldie@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote:
They probably aren't using the proxy server. The proxy server is used
when "Use a proxy server for your LAN" is checked in Control Panel ->
Internet Options -> Connections -> LAN settings. That setting is also
accessible via the Tools menu of IE.
David Carson
On Wednesday, November 21, 2007 9:25 AM
Goldi wrote:
Hi David, thanks for the replyAll our users are going through the proxy server
Hi David, thanks for the reply
All our users are going through the proxy server - Our firewall prevents all
other internet access
Strange thing is that one of the users in question happens to be me. I
thought it was something to do with me being an admin, but my colleagues are
picked up in the logs OK
I have a feeling its something to do with authenticating with the proxy
server/ or not as the case may be...
Again, I can search the logs for my IP address and find my web activity -
but we need all users identified in the log by their username, not their IP
as it is DHCP'd
Cheers
G
"David Carson" wrote:
On Wednesday, November 21, 2007 9:50 AM
Phillip Windell wrote:
If they are showing in the Logs,...
If they are showing in the Logs,...then it will also tell you what Rule
allowed the traffic.
They probably are not using the Rule that you think they are. You probably
have a rule conflict and they are using a rule that does not require
authentication.
--
Phillip Windell
www.wandtv.com
The views expressed, are my own and not those of my employer, or Microsoft,
or anyone else associated with me, including my cats.
-----------------------------------------------------
Understanding the ISA 2004 Access Rule Processing
http://www.isaserver.org/articles/ISA2004_AccessRules.html
Troubleshooting Client Authentication on Access Rules in ISA Server 2004
http://download.microsoft.com/download/9/1/8/918ed2d3-71d0-40ed-8e6d-fd6eeb6cfa07/ts_rules.doc
Microsoft Internet Security & Acceleration Server: Partners
http://www.microsoft.com/isaserver/partners/default.asp
Microsoft ISA Server Partners: Partner Hardware Solutions
http://www.microsoft.com/forefront/edgesecurity/partners/hardwarepartners.mspx
-----------------------------------------------------
"Goldie" <Goldie@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:71EFB9BD-51B5-4F6D-BE18-C45CCF252E38@xxxxxxxxxxxxxxxx
On Wednesday, November 21, 2007 10:00 AM
David Carson wrote:
Re: username not showing in ISA log
On Wed, 21 Nov 2007 06:25:02 -0800, Goldie
<Goldie@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote:
You're welcome. I cut-n-pasted your post so that each person's reply
is below the other's. If you post your next reply below mine instead
of on top of it, it will make things easier for anyone who might wish
to reply to you in context.
I replied:
On Wed, 21 Nov 2007 06:25:02 -0800, Goldie
<Goldie@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote:
[snip]
I understand your problem exactly. I urge you to double-check the
setting that I referred you to earlier. Check it on one of the client
workstations that isn't logging the user id.
David Carson
On Wednesday, November 21, 2007 10:09 AM
Goldi wrote:
Hi PhilJust had a look and the 'anonymous entry' (me) in the log shows as
Hi Phil
Just had a look and the 'anonymous entry' (me) in the log shows as using the
the same rule as an entry with the full (username - t0041) details. See
below...
Allow Internet Access Allow Rule
192.168.25.182 anonymous Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1;
...NET CLR 1.1.4322; .NET CLR
2.0.50727) N 2007-11-20 09:44:27 w3proxy BRXNTS05 - www.telegraph.co.uk - 80 - 942 2725 http TCP GET http://www.telegraph.co.uk/ - - 407 - - -
And
Allow Internet Access Allow Rule
192.168.25.161 BRXNTD01\T0041 Mozilla/4.0 (compatible; MSIE 6.0; Windows NT
5.0; .NET CLR
1.1.4322) Y 2007-11-20 09:25:57 w3proxy BRXNTS05 - in.yimg.com 202.86.6.232 80 438 242 1146 http TCP GET http://in.yimg.com/icccricket/flash/match_control.swf application/x-shockwave-flash Inet 200 0x1a00000 Allow
Internet Access Allow Rule
As you can see both log entries are using the same rule (we only have a
couple of rules)
But for some reason my username comes up as anonymous
Any thoughts?
Cheers
"Phillip Windell" wrote:
On Wednesday, November 21, 2007 10:14 AM
Goldi wrote:
Re: username not showing in ISA log
"David Carson" wrote:
Hi David,
One of the 'users' not showing in the log is me and I'm definitely going
through the proxy - have double checked a couple of times. If i untick the
proxy i cannot connect to the internet at all...
On Wednesday, November 21, 2007 11:59 AM
Phillip Windell wrote:
Do not confuse what the log entry is saying.
Do not confuse what the log entry is saying. I do not see where the
anonymous rule is being allowed,...I only see the authenticated one being
allowed. A connection to a website does not simply generate one log
entry,...there are *many* log entries created,...it is like a "converation".
What I do see in you log entries is this:
1. The connection attempt is initialized (first log entry)
[anonymous Mozilla/4.0 ]
2. A 407 response is given "Proxy Authentication Required"
[http TCP GET http://www.telegraph.co.uk/ - - 407 - - -]
3. Browser replys to the respose with the user credentials (second log
entry)
[BRXNTD01\T0041 Mozilla/4.0]
4. Connection is allowed to happen (also in second log entry)
[Allow - Internet Access Allow Rule]
It all looks perfectly normal and correct to me.
--
Phillip Windell
www.wandtv.com
The views expressed, are my own and not those of my employer, or Microsoft,
or anyone else associated with me, including my cats.
-----------------------------------------------------
Understanding the ISA 2004 Access Rule Processing
http://www.isaserver.org/articles/ISA2004_AccessRules.html
Troubleshooting Client Authentication on Access Rules in ISA Server 2004
http://download.microsoft.com/download/9/1/8/918ed2d3-71d0-40ed-8e6d-fd6eeb6cfa07/ts_rules.doc
Microsoft Internet Security & Acceleration Server: Partners
http://www.microsoft.com/isaserver/partners/default.asp
Microsoft ISA Server Partners: Partner Hardware Solutions
http://www.microsoft.com/forefront/edgesecurity/partners/hardwarepartners.mspx
-----------------------------------------------------
"Goldie" <Goldie@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:97C0E5D3-81E8-4C88-AA77-3B9B138A8B72@xxxxxxxxxxxxxxxx
On Wednesday, November 21, 2007 12:00 PM
Phillip Windell wrote:
Re: username not showing in ISA log
"David Carson" <davo@xxxxxxxxxxx> wrote in message
news:csg8k35ja56mmjq5b5clqjkp8adihiu6cj@xxxxxxxxxx
It is not allowing anonymous connection.
It is working just as it should.
See my other post.
--
Phillip Windell
www.wandtv.com
The views expressed, are my own and not those of my employer, or Microsoft,
or anyone else associated with me, including my cats.
-----------------------------------------------------
Understanding the ISA 2004 Access Rule Processing
http://www.isaserver.org/articles/ISA2004_AccessRules.html
Troubleshooting Client Authentication on Access Rules in ISA Server 2004
http://download.microsoft.com/download/9/1/8/918ed2d3-71d0-40ed-8e6d-fd6eeb6cfa07/ts_rules.doc
Microsoft Internet Security & Acceleration Server: Partners
http://www.microsoft.com/isaserver/partners/default.asp
Microsoft ISA Server Partners: Partner Hardware Solutions
http://www.microsoft.com/forefront/edgesecurity/partners/hardwarepartners.mspx
-----------------------------------------------------
On Wednesday, November 21, 2007 6:41 PM
Sasha wrote:
Hi GoldieCant follow thread on OE properly due to 'bottom' posting but will
Hi Goldie
Cant follow thread on OE properly due to 'bottom' posting but will the
following help...?
http://www.isaserver.org/tutorials/2004recorduserinfo.html
particular the statement...
The key to getting user names and URLs in log files is to make sure that you
do not create any anonymous allow or deny rules pertaining to sites that you
want user information for. While the Firewall client will always send user
information to the firewall, the Web proxy client will not send user
information if authentication is not required.
"Phillip Windell" <philwindell@xxxxxxxxxxx> wrote in message
news:O%23CIz$FLIHA.5764@xxxxxxxxxxxxxxxxxxxxxxx
On Thursday, November 22, 2007 5:50 PM
JDMil wrote:
I think Phillip is correct.
I think Phillip is correct. The browser seems to try to connect to the
internet thru ISA as anonymous. The ISA Server replies to the browser that
authentication is required and thus the browser responds with the correct
credentials. This happens all the time.
Are you users using the Firewall client or just the proxy settings in IE?
--
+-- JDMils
+-- Navman GPS Forums @ http://forum.jdmils.com
"Phillip Windell" wrote:
On Sunday, November 25, 2007 12:16 AM
Phillip Windell wrote:
Re: username not showing in ISA log
"JDMils" <JDMils@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:45C958CE-2D17-408B-85E2-2C8D4EE88BF1@xxxxxxxxxxxxxxxx
It would be the Browser's Proxy Settings (as a Web Proxy client).
If it was the Firewall Client (as a Firewall/Winsock client), then the
Firewall Client would have already done the authentication and the Browser
would not even know the proxy existed.
If the client is both types at the same time, then it is a little fuzzy to
me what exactly happens.
--
Phillip Windell
www.wandtv.com
The views expressed, are my own and not those of my employer, or Microsoft,
or anyone else associated with me, including my cats.
-----------------------------------------------------
Understanding the ISA 2004 Access Rule Processing
http://www.isaserver.org/articles/ISA2004_AccessRules.html
Troubleshooting Client Authentication on Access Rules in ISA Server 2004
http://download.microsoft.com/download/9/1/8/918ed2d3-71d0-40ed-8e6d-fd6eeb6cfa07/ts_rules.doc
Microsoft Internet Security & Acceleration Server: Partners
http://www.microsoft.com/isaserver/partners/default.asp
Microsoft ISA Server Partners: Partner Hardware Solutions
http://www.microsoft.com/forefront/edgesecurity/partners/hardwarepartners.mspx
-----------------------------------------------------
EggHeadCafe - Software Developer Portal of Choice
Database Normalization For Developers
http://www.eggheadcafe.com/tutorials/aspnet/0107750d-ed18-46b7-a695-1283294e3e1c/database-normalization-fo.aspx
.
- Prev by Date: Web Publishing Results in 401 Unauthorized
- Next by Date: Re: Web Publishing Results in 401 Unauthorized
- Previous by thread: Web Publishing Results in 401 Unauthorized
- Index(es):
Relevant Pages
|
