لطفا منتظر باشید ...
Solutions Fast Track
Exploring the ISA Server 2004 Dashboard
The Dashboard is a brand new feature in ISA Server 2004, and it's a handy way for the ISA Server administrator to tell, at a glance, what's going on in all the various monitoring subnodes.
Each of the Dashboard sections contains an icon that indicates the status of that area.
You can 'roll up' various sections of the Dashboard if you don't want to view them.
The Connectivity section of the Dashboard allows you to monitor connections between the ISA server machine and other computers. You can monitor specific computers on the network or even a connection to a particular Web server, by URL.
The Services section of the Dashboard makes it easy for you to quickly check the status of the services that are running on the ISA Server computer.
The Reports section of the Dashboard tells you, at a glance, the names of reports that have been generated, their status (generating or completed), and the date of generation.
The Alerts section of the Dashboard interface allows you to quickly determine the events that have been logged on the ISA Server computer, when each event occurred, the severity of the event (Information, Warning or Error), and the number of new instances this event occurred.
Sessions section of the ISA Server 2004 Dashboard makes it easy to see, at a glance, the session types and number of sessions that are currently active through the ISA Server 2004 firewall that is being monitored.
The System Performance section of the ISA Server 2004 Dashboard interface provides a 'quickie' view of the two most important performance counters for ISA Server.
You can change the look of the Dashboard to suit your own preferences.
Creating and Configuring ISA Server 2004 Alerts
ISA Server's alerting function means you can be notified of important ISA-related events as soon as they are detected.
The alert service determines when an event occurs and whether an alert is configured to provide notification or perform some other action.
To define a new alert, click the Add button. This will invoke the New Alert Configuration Wizard.
You can assign a category for each alert and select a severity level.
When the conditions specified for an alert have been met, ISA Server can be configured to perform an action.
Some alerts are predefined, but disabled by default.
You can modify the properties of your new alert, or those of any of the predefined alerts.
When you click the Alerts tab in the Monitoring node, the alerts that have been triggered are displayed in the middle pane.
The alerts window is automatically refreshed by default at periodic intervals.
Monitoring ISA Server 2004 Sessions and Services
You can monitor connectivity between the ISA Server and other computers from the Connectivity tab.
You can monitor current sessions for Firewall, Web Proxy, and SecureNAT clients from the Sessions tab.
You can monitor the status of ISA Server services from the Services tab.
You can use one of three methods to verify the connectivity: Ping, TCP Connect, or HTTP Request.
To monitor connectivity to a server by any of these methods, you need to create a connectivity verifier and place it into one of the predefined groups.
If you have selected to verify an HTTP connection, you will see a dialog box informing you that a rule allowing HTTP or HTTPS to the specified destination must be configured in order to do this.
You can delete or disable a verifier by right-clicking it and selecting Delete or Disable from the context menu.
Once you've configured your verifiers, you can tell at a glance whether there are any problems with the servers in a particular group by viewing the Connectivity section of the Dashboard.
A handy feature in ISA Server 2004 is the ability to monitor real-time sessions, that is, the activity of a particular client computer (IP address) by a particular user (account name).
You can monitor sessions from all three types of clients: Firewall, Web Proxy, and SecureNAT.
To view current sessions being conducted through the ISA Server, click the Sessions tab and you will see a list of sessions.
If you have many sessions going through the ISA server, it can be difficult to find the ones in which you're interested. You can use ISA Server 2004's filtering mechanism to sort the sessions data and display only sessions that meet specified criteria.
You can save a filter definition so you can use it again by exporting it to an .xml file.
You can disconnect a session quickly and easily by right-clicking it in the Sessions window and selecting Disconnect Session in the context menu.
You can view the ISA Server services that are running on the firewall by using the Services tab in the Monitoring node.
By default, the Services window in the middle pane will show the names of services, the status of each (running or stopped), and in some cases, the service uptime (how long the service has been running in days, hours, minutes and seconds).
Working with ISA Server 2004 Logs and Reports
ISA Server 2004's logging and reporting features take monitoring a step further and provide you with permanent documentation of the activities related to your ISA server.
ISA Server 2004 logs all components by default. These logs include the following: Web Proxy, Firewall Service, and SMTP Message Screener.
You can use ISA Server 2004's log viewer to display information saved in an MSDE database.
Logging to a SQL server allows you to use standard SQL tools to query the database. There is also some fault tolerance and improved security in having the logs located on a remote SQL server. However, if connectivity with the SQL server is lost, the Firewall service shuts down.
The security of log files is an important consideration when implementing logging of any type.
Configuring logging to a SQL database requires a good understanding of security issues specific to SQL Server.
If you choose to log to a file, you will need to select the file format from the drop-down box: either ISA Server file format or W3C extended log file format.
W3C and ISA Server log files, like MSDE files, are limited to 2GB, but a new file is started automatically when the limit is reached.
You can configure logging separately for each of the three services (Firewall, Web Proxy, and SMTP Message Screener).
If you choose to log to a SQL database, you will first need to set up a SQL server for ISA Server logging. This involves configuring the SQL server to accept the Open Database Connectivity (ODBC) connection from the ISA Server.
The ISA Server installation CD contains the fwsrv.sql and w3proxy.sql scripts to automate the creation of the SQL tables.
The log viewer will show you entries being logged in real time, as they happen.
You can filter the information in log viewer similarly to the way you filtered the sessions information.
When you configure the log record type, you can select to display entries from the Firewall or Web Proxy filter, from the Firewall filter only, or from the Web Proxy filter only. Note that you cannot display entries from the SMTP Message Screener logs.
You can save the data displayed in the log viewer to a file by copying all results, or only selected results, to the Windows clipboard.
You can save your filter definitions in the same way you did with the sessions filters, by selecting Export Filter Definitions in the task pane and selecting a location and file name.
The reporting function is where it all comes together; this is where you create reports that summarize or detail the information in the log files in such a way that allows you to easily analyze the data and spot patterns, trends, and anomalies.
To create a new report, click Generate a New Report in the task pane. This will invoke the New Report Wizard.
You can configure a report job to generate reports on a daily, weekly, monthly or yearly basis. To create a report job, click Create and Configure Report Jobs in the right task pane.
Once a report has been generated, you can view it from the Reports tab in the Monitoring node of the ISA Server Management console.
If you didn't select to automatically publish the report to a directory when you configured the report job, you can publish it after it has been generated.
Reports need to be published if you want to view them on computers other than the ISA Server computer.
1Using ISA Server 2004's Performance Monitor
ISA Server 2004 installs the ISA Server Performance Monitor (a customized view of the Windows System Monitor that includes only ISA Server-related counters) when you install the ISA Server 2004 software.
A number of counters are added to the Performance Monitor for the ISA Server Firewall Packet Engine object, the ISA Server Firewall Service object and the ISA Server Web Proxy object.
You can add or remove counters by right-clicking any column header in the bottom pane of the System Monitor view and selecting Properties.
The ISA Server Performance Monitor is configured in the same way as the Windows Performance Monitor, and you can create counter logs, trace logs, and alerts just as you do when monitoring other aspects of Windows computers.
