Monitoring ISA Server.

ISA Server is a product that directly meets the needs of network clients while protecting the network from intruders and content that is not allowed. Monitoring that system and the effectiveness of the server is another administrative job often forced on your plate. The good news, however, is that ISA Server provides with some helpful capabilities that allow you to easily monitor ISA Server and client usage.

Under the desired ISA Server or array, you see a node for Monitoring and Monitoring Configuration, shown in Figure 1. The Monitoring Configuration node enables you to setup items that can be monitored so that you can get the information that you want.

Curt Simmons is the Author of ‘Microsoft Internet Security and Acceleration Server 2000 Study Guide : Exam 70-227 ( Certification Study Guides)‘

Amazon.com (June 2001)

CHAPTER 10 of this book available on ISAserver.org! CLICK HERE!!!!

Curt Simmons is also the Author of ‘Microsoft ISA Configuration and Administration ‘

If you expand Monitoring Configuration, you see three options available to you:

Alerts – ISA Server provides may pre-configured alerts that you can enable. For example, if there is a DNS Intrusion, you can enable an alert. Alerts provide some action for a trigger, and with ISA Server alerts, you can have the alert send an administrative e-mail, start a program, report to the Windows 2000 event log, and start / stop services.
Logs – Log files are recorded for packet filters, the firewall service, and the Web Proxy service. You can configure the log files so that they write to text files or databases, and you can configure the fields you want recorded.
Report Jobs – Reports provide a way for you to easily view statistical information taken from the log files. You can create report job, which determines how often the report is generated and on what schedule.
Once you have the Monitoring Configuration items set, you then use the Monitoring node to actually monitor ISA Server and the reports, if you have created any report jobs. If you expand the Monitoring node, you see the following:
Alerts – you can view the alerts in this window and reset the alerts.
Services – you can see what ISA Server services, such as the firewall service, Web proxy service, etc., are running. You can also stop and start services here, as you can see in the following figure.
Sessions – you can view all active sessions from this window, including what clients are connected to what server, the session type, user name etc. You can also select a session and disconnect it.
Reports – The report jobs that you create generate reports and store them here. Reports are divided into five categories: