RE: Filtering Logging.

  • From: "Jim Harrison" <Jim@xxxxxxxxxxxx>
  • To: "[ISAserver.org Discussion List]" <isalist@xxxxxxxxxxxxx>
  • Date: Mon, 31 Oct 2005 11:18:02 -0800

Basic rules of thumb:
- don't go messing about in the ISA logs while ISA is using them.
- don't change the log data; use something a bit more specific than "select *" 
in your SQL queries

If you're truly uninterested in outbound logging, simply disable logging for 
outbound rules.
It's impossible to provide guides for SQL sizing for ISA because (as you're 
seeing) it's completely dependent on the load your ISA will handle and how much 
of that traffic is logged.

ISA already employs log buffering, but as with anything else in this universe, 
there's an upper limit.  If you go playing silly buggers on the SQL server 
while ISA is logging, you get what you ask for.

-------------------------------------------------------
   Jim Harrison
   MCP(NT4, W2K), A+, Network+, PCG
   http://isaserver.org/Jim_Harrison/
   http://isatools.org
   Read the help / books / articles!
-------------------------------------------------------
 

-----Original Message-----
From: William Holmes [mailto:wtholmes@xxxxxxxxxxxxxx] 
Sent: Monday, October 31, 2005 11:02
To: [ISAserver.org Discussion List]
Subject: [isalist] RE: Filtering Logging.

http://www.ISAserver.org

Hello,

I can accept this. The problem is the shear volume of the logging that is
being sent to my SQL server and the nasty problem of ISA hanging when there
is a problem with the SQL server.

I see a solution to this at:
http://www.isaserver.org/pages/article_p.asp?id=346

I didn't actually have my SQL server go down, I was running a clean-up script
on the log table to clean up old and unwanted data. During this run my ISA
server stopped responding. 

Obviously my SQL server needs to be configured differently to handle the
load. I have approx 2 million entries/day.

Are there any guides on sizing a SQL server for ISA logging? I know what
doesn't work. 

I think for reliability SQL logging should have a significant local buffering
capability on the ISA server. If a background process could deal with the
transfer of data to the SQL server a leave ISA working in the event of a
communications/SQL Server problem that has the potential for a higher level
of reliability.

Bill

-----Original Message-----
From: Jim Harrison [mailto:Jim@xxxxxxxxxxxx] 
Sent: Monday, October 31, 2005 11:54 AM
To: [ISAserver.org Discussion List]
Subject: [isalist] RE: Filtering Logging.

http://www.ISAserver.org

You're wasting your and ISA's time with this.
It will actually take more time to sort out what specific requests need to be
logged than it will to filter them out in a SQL query.

-------------------------------------------------------
   Jim Harrison
   MCP(NT4, W2K), A+, Network+, PCG
   http://isaserver.org/Jim_Harrison/
   http://isatools.org
   Read the help / books / articles!
-------------------------------------------------------

________________________________________
From: William Holmes [mailto:wtholmes@xxxxxxxxxxxxxx] 
Sent: Monday, October 31, 2005 08:00
To: [ISAserver.org Discussion List]
Subject: [isalist] Filtering Logging.

http://www.ISAserver.org
Hello,
 
I have a couple of questions about logging.
 
 
Background:  The ISA server in question is used exclusively for web proxying
and web publishing.  I would like to log all inbound (Web Publishing) traffic
to SQL. I don't wish to log outbound (web proxy) traffic.  Due to the amount
of traffic being generated I would like to filter some of it out right at the
ISA server level rather than swamp an SQL table with stuff I don't really
need information on.
 
For instance I could care less about image (.jpg, .gif, .png ....) files that
are part of the site and I would prefer that they never get logged.
 
So is there a way to accomplish filtering what gets logged. I know I can shut
off logging for specific rules have how about for specific types of content
(its not clear how I could setup a web publishing rule that would server
*.gif ...  from anywhere in a published path.
 
I also can't see where to shut off outbound web proxy logging. I hope I'm
just missing that one due to fatigue.
 
Thanks
 
Bill
------------------------------------------------------
List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist
ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp
ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ
------------------------------------------------------
Visit TechGenix.com for more information about our other sites:
http://www.techgenix.com
------------------------------------------------------
You are currently subscribed to this ISAserver.org Discussion List as:
jim@xxxxxxxxxxxx
To unsubscribe visit http://www.webelists.com/cgi/lyris.pl?enter=isalist
Report abuse to listadmin@xxxxxxxxxxxxx 

All mail to and from this domain is GFI-scanned.


------------------------------------------------------
List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist
ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp
ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ
------------------------------------------------------
Visit TechGenix.com for more information about our other sites:
http://www.techgenix.com
------------------------------------------------------
You are currently subscribed to this ISAserver.org Discussion List as:
wtholmes@xxxxxxxxxxxxxx
To unsubscribe visit http://www.webelists.com/cgi/lyris.pl?enter=isalist
Report abuse to listadmin@xxxxxxxxxxxxx

------------------------------------------------------
List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist
ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp
ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ
------------------------------------------------------
Visit TechGenix.com for more information about our other sites:
http://www.techgenix.com
------------------------------------------------------
You are currently subscribed to this ISAserver.org Discussion List as: 
jim@xxxxxxxxxxxx
To unsubscribe visit http://www.webelists.com/cgi/lyris.pl?enter=isalist
Report abuse to listadmin@xxxxxxxxxxxxx

All mail to and from this domain is GFI-scanned.



Other related posts: