ISA Log uri

Posted on 2006-06-07
Last Modified: 2013-11-16
Can anyone tell me if the uri entry in the ISA log is limited to what a user requests or is it everything that comes up on the screen? I'm trying to get a good idea of usage by website, but I don't want to capture each and every image downloaded when a user hits a website. I know I can use destination host, but I'd like a little more detail.
Question by:t1clausen
    LVL 51

    Accepted Solution

    Are you running ISA2000 or ISA2004?

    It is everything that passes through the ISA server filters. If a web site redirects, for example, or a pop up appears, then this data has to come donw through the http/https stream and therefore can be captured. ISA2000 logging was OK but ISA2004/ISA2006 is excellent.

    No, it doesn't cover each and every web-part, graphic etc. Isa is monitoring for headers, signatures, urls, ip's domain names etc. However, your cache will if you have it activated.
    LVL 2

    Author Comment

    I'm running 2004. I have the log sent to my SQL server and I'm writing a Crystal Report to sum up usage by user. I really just need to see generally what sites are being hit and how often so I guess what I have now will work:

    SELECT     ClientUserName, CONVERT(varchar(19), logTime, 120) AS logTime, DestHost, COUNT(*) AS counter
    FROM         dbo.[Test Lab]
    GROUP BY ClientUserName, CONVERT(varchar(19), logTime, 120), DestHost

    This eliminates duplicates so I get a better idea of what's happening. It will work I guess!
    LVL 51

    Expert Comment

    by:Keith Alabaster
    You know that ISA has some damn fine reports (html/xml) that do all of that for you? Obviously not as detailed as ones you can do yourself but normally good enough for most uses. :)


    and thanks :)

    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone.

    Featured Post

    Maximize Your Threat Intelligence Reporting

    Reporting is one of the most important and least talked about aspects of a world-class threat intelligence program. Here’s how to do it right.

    If you are like regular user of computer nowadays, a good bet that your home computer is on right now, all exposed to world of Internet to be exploited by somebody you do not know and you never will. Internet security issues has been getting worse d…
    Do you have a windows based Checkpoint SmartCenter for centralized Checkpoint management?  Have you ever backed up the firewall policy residing on the SmartCenter?  If you have then you know the hassles of connecting to the server, doing an upgrade_…
    This video is in connection to the article "The case of a missing mobile phone (". It will help one to understand clearly the steps to track a lost android phone.
    Here's a very brief overview of the methods PRTG Network Monitor ( offers for monitoring bandwidth, to help you decide which methods you´d like to investigate in more detail.  The methods are covered in more detail in o…

    758 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    11 Experts available now in Live!

    Get 1:1 Help Now