ISA SQL logging SourceIP

Posted on 2009-02-20
Last Modified: 2012-05-06
I'm logging to a SQL database in ISA.
Only the IP's in the column are showing up as ints i.e. 'SourceIP' = 3232238700
and 'DestinationIP' = 1113983331.
Should it now be something like or something similar.
Where did I go wrong, I also see that the script coming with ISA to create the DB creates the column as bigint ' [SourceIP] bigint,'
How can I correct this ?
Question by:wilcosw
    LVL 51

    Expert Comment

    by:Keith Alabaster
    Are you trying to interrogate the database directly or viewing through the ISA screen in monitoring - logging and monitoring - reports
    LVL 1

    Author Comment

    This is directly from the DB.
    LVL 51

    Expert Comment

    by:Keith Alabaster
    Thought so - there is nothing to fix - that is the way ISA stores its information. The translation is performed by the realtime log monitor, the historic logging view and the reporting module.
    LVL 1

    Accepted Solution

    Apparently the IP gets stored as its Integer value, in other words the IP = 10*2^24 + 254*2^16 + 52*2^8 + 5 = 184431621 (This is what gets stored in the DB)

    I found this arcticle at Microsoft: that explains how to convert it back.

    Can I now create a trigger that will automatically change the value to readable IP's, or will it cause porblems with ISA ?


    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone.

    Featured Post

    Why You Should Analyze Threat Actor TTPs

    After years of analyzing threat actor behavior, it’s become clear that at any given time there are specific tactics, techniques, and procedures (TTPs) that are particularly prevalent. By analyzing and understanding these TTPs, you can dramatically enhance your security program.

    I have been asked to explain on many, many occasions the correct way to setup network cards and DNS settings on ISA Server 2004, 2006 and forefront Threat management gateway (FTMG) and have willing done so. I have also promised my self everytime tha…
    Forefront Threat Management Gateway 2010 or FTMG comes with some very neat troubleshooting tools built-in when trying to identify what is actually happening behind the scenes within the product when traffic is passing through its interfaces. To the …
    To add imagery to an HTML email signature, you have two options available to you. You can either add a logo/image by embedding it directly into the signature or hosting it externally and linking to it. The vast majority of email clients display l…
    Here's a very brief overview of the methods PRTG Network Monitor ( offers for monitoring bandwidth, to help you decide which methods you´d like to investigate in more detail.  The methods are covered in more detail in o…

    760 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    7 Experts available now in Live!

    Get 1:1 Help Now