Windows Forum

Ask something
Discussion Locked

Proxy Server Logging Issue

0 helpful
6 replies

by jbellusci 1 view

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I am currently evaluating an Internet Monitoring software, but have run into a small problem with the log files on my Proxy Server. This is MS Proxy 2.0. With SP2

The majority of the log file seems to be fine, but in some cases I am missing information.

For example the log files starts off (moving from the left most column to the right most column, and columns are sepearted by semicolons) the first column is the IP address and the second column is the authenticated user name.

Most ofthe time it's fine.

I get the following information:

100.0.0.***;anonymous;etc....

but in some cases for the first two columns I just get:

-;-;etc...

This then shows up on my Internet Monitoring software's report as user of "Unknown."

What would cause the log file to not recieve this information?

Consequently, I also don't get any browser data for these type entries as well.

In the lines where I get an IP address, I see Mozilla/4.0;MSIE 5.0;NT;etc..

In the lines whereI don't get an IP, I just see MSProxy/2.0 with no mention of the browser or the OS.

I do get information as to what webpages this user/object is going to.

6 replies

by simon sedgwick

Is this software a plugin for Proxy or is is totally seperate ??

Check out the MS Proxy site, there are demo plugins for monitoring and filtering.

by jbellusci

Totally seperate. Isn't even installed on the Proxy Server. It's not a problem with the software, it's a problem with the Proxy logs.

by joshg

You have allow annonymous logons checked in the Proxy MMC. Right click the Default Website, select properties then Directory Security. Click the Annonymous access edit button. Remove the check mark for allow annonymous. Then check the NT Challenge/Resp check box. If you don't check this the user will have to enter his PWD everytime he opens the Browser. The log file will now contain usernames instead of ANNONYMOUS. You will have to stop and start the Default web before the changes will occur.

by jbellusci

Thanks Josh, that was a help, but I'm not ready to award the points quite yet.

What you said worked, but I have a follow up question.

Just for fun, I went ahead and removed the check mark from the NTChallenge/Resp box so that user would needto provide a password to log in to the proxy server, but when I tested it, it didn't prompt me to enter a password it gave me the following message in the browser:

"You must authenticate with a proxy server before this request can be serviced. Please log on to your proxy server and then try again"

This makes perfect sense of course, but
where is it that you peform this logon to the proxy server?

thanks

by jbellusci

OK, so now I do have authenticated user names showing up in my report in place of IP addresses, and that is a big help and thanks for that tip, but my original question still remains unanswered.

I still get an authenticated user called "unkknown"in my report and it's because it's taking information from the Proxy Log where the proxy isn't logging an authenticated username or IP address of the "accesser" for some reason.

This discussion is closed to new replies.