لطفا منتظر باشید ...
Lesson 3 Creating ISA Server Reports
ISA Server can automatically generate graphical reports from information stored in the logs. You can schedule these reports, which display patterns in Internet usage and connectivity, to be generated once, daily, monthly, or on selected days of the week.
After this lesson, you will be able to
Configure ISA Server to generate reports according to a specific schedule
View reports in ISA Server to analyze patterns in Internet usage
Estimated lesson time: 45 minutes
Configuring Reports
You can use the reporting feature of ISA Server to create reports about the Internet usage patterns of your client users and computers. These reports are generated when you configure report jobs in the Monitoring Configuration node of ISA Management, as shown in Figure 9.12. Report jobs can create reports once or according to a specific schedule, and they summarize log information over any period of time you specify.
Figure 9.12 Creating a new report job
Viewing Reports
Each report job actually creates a set of five reports, each of which can be viewed in a separate folder in the Monitoring node of ISA Management, as shown in Figure 9.13. The five folders, named Summary, Web Usage, Application Usage, Traffic & Utilization, and Security, contain reports corresponding to each folder name. Each report is viewed as a Web page and itself contains a number of smaller reports.
Figure 9.13 Viewing report folders in the Monitoring node
Summary Reports
Summary reports include a set of reports that illustrate network traffic usage, sorted by application. These reports are most relevant to the network administrator or the person managing or planning a company's Internet connectivity.
The Summary reports combine data from the Web Proxy service and Firewall service logs. A sample report found in the Summary folder is shown in Figure 9.14.
Figure 9.14 Sample summary report
Web Usage Reports
Web Usage reports include a set of reports that display top Web users, common responses, and browsers. These reports are most relevant to the network administrator or the person managing or planning a company's Internet connectivity. It shows how the Web is being used in a company.
Web Usage reports are based on the Web Proxy service logs.
Application Usage Reports
Application Usage reports illustrate Internet application usage in a company, including incoming and outgoing traffic, top users, client applications, and destinations. These reports can help determine network saturation and are therefore useful to network administrators managing or planning a company's Internet connectivity.
Application Usage reports are based on the Firewall service logs.
Traffic & Utilization Reports
Traffic & Utilization reports illustrate total Internet usage by application, protocol, and direction; average traffic and peak simultaneous connections; cache hit ratio; errors; and other statistics. These reports can help plan and monitor network capacity.
Traffic & Utilization reports combine data from the Web Proxy and Firewall service logs.
Security Reports
Security reports list attempts to breach network security. Security reports can help identify attacks or security violations after such violations have occurred.
Security reports are based on the Web Proxy service, Firewall service, and Packet Filter logs.
Follow these steps to view a report:
In the console tree of ISA Management, expand the Monitoring node, expand the Reports folder, and then click the applicable report type: Summary, Web Usage, Application Usage, Traffic & Utilization, or Security.
In the details pane, right-click the applicable report and then click Open.
Follow these steps to sort report data:
In the console tree of ISA Management, expand the Monitoring node, expand the Reports folder, right-click a report type, and then click Properties.
Click a tab (if more than one tab is present) and then, in the Sort Order area, click the option that should be used to sort the data in the report.
The report will be sorted the next time you view it.
Configuring Report Jobs
The ISA Server reporting mechanism enables you to schedule reports based on the data collected from the log files. You can schedule reports to be generated on a recurring basis: daily, on specified days of the week, or monthly. The report can include daily, weekly, monthly, or yearly data; or it can include data collected over any specific period of time you define.
To configure report generation, create a report job. For each report job you create, you can specify a period of time over which the information in the logs will be collected, and the schedule by which a report based on that period will be generated.
Follow these steps to create a report job:
In the console tree of ISA Management, expand the Monitoring Configuration node, right-click the Report Jobs folder, point to New, and then click Report Job.
On the General tab, in the Name text box, type the name of the report job.
(Optional) In the Description text box, type a description of the report job. On the Period, Schedule, and Credentials tabs, specify the following:
Period of activity that the report should cover
When and how often the report should be generated
User name of a user authorized to create the report
Follow these steps to configure the period for an existing report job:
In the console tree of ISA Management, expand the Monitoring Configuration node and click the Report Jobs folder.
In the details pane, right-click the applicable report job, and then click Properties.
On the Period tab:
To generate reports that show the previous day's activity, click the Daily radio button.
To generate reports that show the previous week's activity, click the Weekly radio button.
To generate reports that show the previous month's activity, click the Monthly radio button.
To generate reports that show the previous year's activity, click the Yearly radio button.
To generate reports that show activity for a specified period, click the Custom radio button and then type the desired dates in the From and To text boxes.
Follow these steps to configure the schedule for an existing report job:
In the console tree of ISA Management, expand the Monitoring Configuration node and click the Report Jobs folder.
In the details pane, right-click the applicable report job, and then click Properties.
On the Schedule tab:
To generate the report immediately, click the Immediately radio button.
To generate the report at the specified time, click the At radio button, and then type a date and a time.
In the Recurrence Pattern area,
To generate a report once, click the Generate Once radio button.
To generate reports every day, click the Generate Every Day radio button.
To generate reports on specific days, click the Generate On The Following Days radio button and select the appropriate check boxes.
To generate reports once a month, click the Generate Once A Month radio button and type the day of the month on which to generate the reports.
Report Job Credentials
For each report job you configure, whether locally or remotely, you must specify a user name and password with appropriate credentials to generate the reports on every server in the array. To begin with, all members of the Domain Admins group can generate reports. In addition, users that meet the following criteria can generate reports:
The user must have local administrator privileges on every ISA Server computer in the array.
The user must be able to access and launch DCOM objects on every ISA Server in the array.
Follow these steps to specify user credentials for an existing report job:
In the console tree of ISA Management, expand the Monitoring Configuration node and click the Report Jobs folder.
In the details pane, right-click the applicable report job, and then click Properties.
On the Credentials tab, in the Username text box, type the name of a user with permissions to generate the report.
In the Domain text box, type the user's domain.
In the Password text box, type the user's password.
Configuring Report Log Summaries
Reports are generated from a database that includes data collected from the ISA Server logs. This data is saved in daily and monthly summaries.
When you enable the summary process, the daily summary process runs every day at 12:30 a.m., regardless of whether you have scheduled reports. The process collates all the logs available on all the servers in the array.
The monthly summary process combines all the daily databases into a single monthly summary. If a daily summary is missing, the monthly summary process checks the logs to see if the information is available from the logs. If the information is not available, the monthly summary process generates an error.
Scheduled reports may be created even if daily and monthly summaries are disabled. If the daily and monthly processes are disabled, the report generator gets the data from the logs. However, the data in the report may not be complete and current since it will not include the latest log information.
Follow these steps to enable and configure the log summary:
In the console tree of ISA Management, expand the Monitoring Configuration node, right-click the Report Jobs folder, and then click Properties.
On the Log Summaries tab, select the Enable Daily And Monthly Summaries check box.
In Number Of Summaries Saved area, in the Daily Summaries text box, type the number of daily summaries to save.
In the Monthly Summaries text box, type the number of monthly summaries to save.
You may specify between 35 and 999 daily summaries and between 13 and 999 monthly summaries to save. These minimums ensure that enough summaries will be saved to generate monthly and yearly reports.
Report Database
The ISA Server reporting mechanism combines the summary logs from all the ISA Server computers in a given array into a database on each ISA server. When a report is created, all relevant summary databases are combined into a single report database. The new report database resides in the location specified when the report job was created, as shown in Figure 9.15. By default, that location is the ISAReports folder of the ISA installation folder. A typical path is %ProgramFiles%\Microsoft ISA Server\ISAReports.
Figure 9.15 Configuring report database location
The reports can then be viewed on the ISA Server computer on which the report database is located. You cannot view the reports if you run ISA Management from another ISA Server computer in the same array.
Follow these steps to configure location of reports:
In the console tree of ISA Management, expand the Monitoring Configuration node, right-click the Report Jobs folder, and then click Properties.
On the General tab, confirm that the Enable Reports check box is selected.
Do one of the following:
To save the reports in the ISAReports subfolder of the ISA Server installation folder, click the ISAReports Folder (In The ISA Server Installation Folder) radio button.
To save the reports in another folder, click the Other Folder radio button, type a path or click the Browse button, and then select the folder in which to save the reports.
Follow these steps to configure the location of the daily summary database:
In the console tree of ISA Management, expand the Monitoring Configuration node, right-click the Report Jobs folder, and then click Properties.
On the Log Summaries tab, select the Enable Daily And Monthly Summaries check box.
Do one of the following:
To save the reports in the ISASummaries subfolder on this computer, click the ISASummaries Folder (In The ISA Server Installation Folder) radio button.
To save the reports in another folder, click the Other Folder radio button, type a path or click the Browse button, and then select the folder in which to save the daily summaries.
Practice: Creating and Viewing Reports
In this exercise, you configure a report job to generate a set of reports based on the past month of network activity.
To create a report job
Log on to Server1 as Administrator.
Open ISA Management, and then expand the Monitoring Configuration node.
Click once on the Report Jobs folder.
Right-click the Report Jobs folder, point to New, and then click Report Job.The Report Job Properties dialog box appears.
On the General tab, in the Name text box, type Last Month's Activity.
Click the Period tab.
Select the Custom radio button.The From and To date boxes appear with the current date indicated.
Click the down arrow next to the From drop-down list box.A month window appears beneath the From drop-down list box, displaying the present month in calendar format.
Click the left arrow in the month window to move the calendar one month earlier.The month window now displays the previous month in calendar format. The day corresponding to one month before the present day of the month is highlighted with a blue oval.
Click the highlighted day.The From date box now displays the day one month before the present date.
Click the Schedule tab. Note that in the Start Generation Report area, the Immediately radio button is selected. Also note that in the Recurrence Pattern area, the Generate Once radio button is selected.
Click the Credentials tab.
In the User Name text box, type Administrator.
In the Domain text box, type domain01.
In the Password text box, type the password you have assigned to the domain01\Administrator account.
Click OK. You will see the Last Month's Activity report job listed in the details pane in ISA Management. Note that the current status is listed as Running.
After a minute, right-click the Report Jobs folder in ISA Management and click Refresh. If the status of Last Month's Activity has changed to Ready, proceed to Exercise 2. Otherwise, wait another minute and repeat this step until the status changes to Ready.
Exercise 2: Viewing Reports
In this exercise, you view all five sets of reports generated by the report job that has just completed.
To view reports in ISA Server
In ISA Management, expand the Monitoring node, and then expand the Reports folder.
Last Month's Activity report appears in the Details pane.
Click the Summary folder.
In the details pane, right-click the Last Month's Activity icon and click Open.ISA Server opens a Web page displaying the MyArray array Summary reports.
Review the six Summary reports contained on the Web page by clicking on each report link in the left frame of the page.
Close the Summary Reports Web page containing the Summary reports.
In ISA Management, select the Web Usage folder.
In the details pane, right-click the Last Month's Activity icon and click Open.ISA Server opens a Web page displaying the MyArray array Web Usage reports.
Review the eight Web Usage reports contained on the Web page by clicking on each report link in the left frame of the page.
Close the Web Usage Reports Web page.
In ISA Management, select the Application Usage folder.
In the details pane, right-click the Last Month's Activity icon and click Open.ISA Server opens a Web page displaying the MyArray array Applications Usage reports.
Review the five Applications Usage reports contained on the Web page by clicking on each report link in the left frame of the page.
Close the Applications Usage Reports Web page.
In ISA Management, select the Traffic & Utilization folder.
In the details pane, right-click the Last Month's Activity icon and click Open.ISA Server opens a Web page displaying the MyArray array Traffic and Utilization reports.
Review the seven Traffic and Utilization reports contained on the Web page by clicking on each report link in the left frame of the page.
Close the Traffic and Utilization Reports Web page.
In ISA Management, select the Security folder.
In the details pane, right-click the Last Month's Activity icon and click Open.ISA Server opens a Web page displaying the MyArray array Security reports.
Review the two Security reports contained on the Web page by clicking on each report link in the left frame of the page.
Close the Security Reports Web page.
Lesson Summary
The ISA Server reporting mechanism enables you to create graphical summaries of Internet usage. These reports are based on data collected from the log files and are generated by report jobs you configure in the Monitoring Configuration node of ISA Management.
Every report job generates a set of five reports, each of which appears as a Web page. These reports can be viewed in five specific folders in the Monitoring node of ISA Management. These five folders are named Summary, Web Usage, Application Usage, Traffic & Utilization, and Security.
You can schedule reports to be generated once, daily, on specified days of the week, or monthly on a specified day. The report can include daily, weekly, monthly, or yearly data; or data collected over any specific period of time you define. For each report job you configure, you must specify a user name and password with credentials to generate reports on every server in the ISA Server array.
Reports are generated from a database of log summaries, which include data collected from the ISA Server logs. The ISA Server reporting mechanism combines the summary logs from all the ISA Server computers in a given array into a database on each ISA server. When a report is created, all relevant summary databases are combined into a single report database. You can only view reports on the ISA Server computer on which this report database is located.
