Basic rules of thumb: - don't go messing about in the ISA logs while ISA is using them. - don't change the log data; use something a bit more specific than "select *" in your SQL queries If you're truly uninterested in outbound logging, simply disable logging for outbound rules. It's impossible to provide guides for SQL sizing for ISA because (as you're seeing) it's completely dependent on the load your ISA will handle and how much of that traffic is logged. ISA already employs log buffering, but as with anything else in this universe, there's an upper limit. If you go playing silly buggers on the SQL server while ISA is logging, you get what you ask for. ------------------------------------------------------- Jim Harrison MCP(NT4, W2K), A+, Network+, PCG http://isaserver.org/Jim_Harrison/ http://isatools.org Read the help / books / articles! ------------------------------------------------------- -----Original Message----- From: William Holmes [mailto:wtholmes@xxxxxxxxxxxxxx] Sent: Monday, October 31, 2005 11:02 To: [ISAserver.org Discussion List] Subject: [isalist] RE: Filtering Logging. http://www.ISAserver.org Hello, I can accept this. The problem is the shear volume of the logging that is being sent to my SQL server and the nasty problem of ISA hanging when there is a problem with the SQL server. I see a solution to this at: http://www.isaserver.org/pages/article_p.asp?id=346 I didn't actually have my SQL server go down, I was running a clean-up script on the log table to clean up old and unwanted data. During this run my ISA server stopped responding. Obviously my SQL server needs to be configured differently to handle the load. I have approx 2 million entries/day. Are there any guides on sizing a SQL server for ISA logging? I know what doesn't work. I think for reliability SQL logging should have a significant local buffering capability on the ISA server. If a background process could deal with the transfer of data to the SQL server a leave ISA working in the event of a communications/SQL Server problem that has the potential for a higher level of reliability. Bill -----Original Message----- From: Jim Harrison [mailto:Jim@xxxxxxxxxxxx] Sent: Monday, October 31, 2005 11:54 AM To: [ISAserver.org Discussion List] Subject: [isalist] RE: Filtering Logging. http://www.ISAserver.org You're wasting your and ISA's time with this. It will actually take more time to sort out what specific requests need to be logged than it will to filter them out in a SQL query. ------------------------------------------------------- Jim Harrison MCP(NT4, W2K), A+, Network+, PCG http://isaserver.org/Jim_Harrison/ http://isatools.org Read the help / books / articles! ------------------------------------------------------- ________________________________________ From: William Holmes [mailto:wtholmes@xxxxxxxxxxxxxx] Sent: Monday, October 31, 2005 08:00 To: [ISAserver.org Discussion List] Subject: [isalist] Filtering Logging. http://www.ISAserver.org Hello, I have a couple of questions about logging. Background: The ISA server in question is used exclusively for web proxying and web publishing. I would like to log all inbound (Web Publishing) traffic to SQL. I don't wish to log outbound (web proxy) traffic. Due to the amount of traffic being generated I would like to filter some of it out right at the ISA server level rather than swamp an SQL table with stuff I don't really need information on. For instance I could care less about image (.jpg, .gif, .png ....) files that are part of the site and I would prefer that they never get logged. So is there a way to accomplish filtering what gets logged. I know I can shut off logging for specific rules have how about for specific types of content (its not clear how I could setup a web publishing rule that would server *.gif ... from anywhere in a published path. I also can't see where to shut off outbound web proxy logging. I hope I'm just missing that one due to fatigue. Thanks Bill ------------------------------------------------------ List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ ------------------------------------------------------ Visit TechGenix.com for more information about our other sites: http://www.techgenix.com ------------------------------------------------------ You are currently subscribed to this ISAserver.org Discussion List as: jim@xxxxxxxxxxxx To unsubscribe visit http://www.webelists.com/cgi/lyris.pl?enter=isalist Report abuse to listadmin@xxxxxxxxxxxxx All mail to and from this domain is GFI-scanned. ------------------------------------------------------ List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ ------------------------------------------------------ Visit TechGenix.com for more information about our other sites: http://www.techgenix.com ------------------------------------------------------ You are currently subscribed to this ISAserver.org Discussion List as: wtholmes@xxxxxxxxxxxxxx To unsubscribe visit http://www.webelists.com/cgi/lyris.pl?enter=isalist Report abuse to listadmin@xxxxxxxxxxxxx ------------------------------------------------------ List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ ------------------------------------------------------ Visit TechGenix.com for more information about our other sites: http://www.techgenix.com ------------------------------------------------------ You are currently subscribed to this ISAserver.org Discussion List as: jim@xxxxxxxxxxxx To unsubscribe visit http://www.webelists.com/cgi/lyris.pl?enter=isalist Report abuse to listadmin@xxxxxxxxxxxxx All mail to and from this domain is GFI-scanned.