GFI WebMonitor 2

Manual

By GFI Software Ltd.

 http://www.gfi.com
E-mail: info@gfi.com

Information in this document is subject to change without notice.

Companies, names, and data used in examples herein are fictitious
unless otherwise noted. No part of this document may be reproduced
or transmitted in any form or by any means, electronic or mechanical,
for any purpose, without the express written permission of GFI
SOFTWARE Ltd.

GFI Webmonitor is copyright of GFI SOFTWARE Ltd.  2000-2004

GFI SOFTWARE Ltd. All rights reserved.

Version 2.0 – Last updated May 5th, 2004

Contents

Introduction 1
What is GFI WebMonitor for ISA Server? ..................................................................... 1
Features......................................................................................................................... 1
How does GFI WebMonitor work?................................................................................. 1
Freeware!....................................................................................................................... 2

Installing GFI WebMonitor 3

GFI WebMonitor System requirements ......................................................................... 3
Installing GFI WebMonitor ............................................................................................. 3
Configuring who has access to GFI WebMonitor .......................................................... 4
Allowing access - Adding users........................................................................ 4
Troubleshooting access.................................................................................... 5
Common installation issues........................................................................................... 5
How can I monitor an ISA server that is part of an array? ............................................ 6

Using GFI WebMonitor 7

Introduction .................................................................................................................... 7
Web access in progress ................................................................................................ 7
URL history .................................................................................................................... 8
Users history.................................................................................................................. 8
Last Web access ........................................................................................................... 9

Troubleshooting 10
Introduction .................................................................................................................. 10
Knowledgebase ........................................................................................................... 10
Web Forum .................................................................................................................. 10
Build notifications......................................................................................................... 10

GFI WebMonitor Contents • i

Introduction

What is GFI WebMonitor for ISA Server?

GFI Webmonitor is a lightweight tool, designed as a plug-in for
Microsoft ISA Server, which allows you to monitor the sites users are
browsing and what files they are downloading – in REAL TIME. It also
allows you to block web connections in progress.
GFI Webmonitor is the perfect solution to transparently exercise a
degree of control over users’ browsing habits and ensure legal
compliance – in a manner that will not alienate your network users.

Features
• Monitor web and ftp browsing real time
• Block web access or downloads in progress
• Web Access View shows all web access
• URL history View shows all visited websites
• User history View shows all sites visited per user
• Native integration with ISA Server as a web filter
• Web based interface allows viewing from anywhere in the network
• Supports both Microsoft ISA server 2000 & 2004
• Easy installation, no configuration required.
• Does not duplicate functionality already in Microsoft ISA server

How does GFI WebMonitor work?

GFI WebMonitor installs on ISA Server as a web filter and can be
accessed by a web browser from anywhere in the network. Simply
load up Explorer and type "http://monitor.isa". You will see all current
connections, as well as a list of recent connections.

The GFI WebMonitor ISAPI web filter extension

The extension is installed on ISA server and can be found under
Extensions, web filters, in the ISA server configuration.

GFI WebMonitor Introduction • 1

 The GFI WebMonitor webfilter listed under extensions, web filters

Freeware!
GFI WebMonitor for ISA Server is freeware! No license fees are due
and it is not limited in any way. Note that support is NOT included.
Please respect the concept of freeware and use the software as is. Do
not call or email us for support. If you have questions, use the forums
and check the knowledge base first. A commercial version of GFI
WebMonitor will be released in the second half of the year, which will
add blocking of URLs and web pages based on keywords as well as
site categories (based on IIS Cobion site categorization database).

2 • Introduction GFI WebMonitor

Installing GFI WebMonitor

GFI WebMonitor System requirements

• Windows 2000 or 2003 server
• Microsoft ISA server 2000 (not firewall only mode) OR Microsoft
ISA server 2004
• Internet explorer to access GFI WebMonitor

Installing GFI WebMonitor

Before you install GFI WebMonitor for ISA Server, make sure:
• You are an administrator for the domain or machine on which you
are installing GFI WebMonitor for ISA server.
• You have Windows 2000/2003 server and Microsoft ISA Server
2000/2004 installed and running.
Before you run the installation procedure please make sure that you
are logged on as Administrator and the system requirements are met!
1. Run the GFI WebMonitor setup program on the ISA server machine
by double clicking on the webmon.exe file.
2. A welcome dialog will appear. Close other Windows programs and
click Next.
3. In the License agreement dialog box, click Yes to accept the
agreement and continue the installation.

Screenshot 1 - Configuring access

GFI WebMonitor Installing GFI WebMonitor • 3

 4. Set-up will ask you for an IP or Username that you wish to allow
access. GFI WebMonitor denies or allows access based on IP or
authenticated user name. For more information see the next
paragraph ‘Configuring who has access to GFI WebMonitor’. By
default set-up will add the IP of the ISA server machine, so that you
can always access GFI WebMonitor from the ISA server machine
itself.
5. Set-up will now ask you where you want GFI WebMonitor to be
installed. Specify the location and click Next. After the files are copied,
click Finish to end setup.
6. If you are using Microsoft ISA server 2000, you need to restart the
ISA server web proxy service! This can be done from the ISA server
configuration.
Note: When you do this, all currently connected users will be
disconnected!
7. You can startup the GFI WebMonitor from the GFI WebMonitor
program group. You can access the GFI WebMonitor from anywhere
in the network after you have been given access.

Configuring who has access to GFI WebMonitor

You can control access to GFI WebMonitor in 2 ways:
1. Via IP. GFI WebMonitor will check from which IP the request is
being made and deny or allow access. Most administrators have
allocated themselves a fixed IP, so this should be an easy way for an
admin to ensure access.
2. Via authenticated user name. If you use this method, you must
ensure that users are authenticated in the following format
‘Domain\username’.

Allowing access - Adding users

Screenshot 2 - Configuring access

During installation, set-up asked you for at least one person who
should have access to the GFI WebMonitor. To add more users
afterwards:
1. From the GFI WebMonitor screen, click on Configuration

4 • Installing GFI WebMonitor GFI WebMonitor

 2. In the Add allowed IP or User edit box, type an IP or a name.
3. Click Add.
4. Click Apply to apply the changes.
The user will now have access.

Troubleshooting access
If you are being denied access to GFI WebMonitor, you will get an
error message as shown in the dialogs below.

Screenshot 3 - An authenticated user is denied access

The above screenshot shows an AUTHENTICATED user who is

denied access. This can be seen from the fact that both the IP and the
username are listed. Therefore, in this example, adding either the IP
192.168.0.3 or the user ISA2004DEV\administrator, would allow this
particular user access to GFI WebMonitor.

Screenshot 4 - Unauthenticated user is denied access

In this screenshot, only the IP is shown of the user trying to access the
monitor. The session is therefore unauthenticated, and simply adding
the IP 192.168.0.3 would allow the person access to GFI WebMonitor.
If you want to allow access based on user name only, you would have
to enforce authentication in Microsoft ISA server.

Common installation issues

The following are the most frequent installation mistakes. Please
check the following if you are experiencing a problem connecting to
GFI WebMonitor.
1. Ensure you restarted the ISA web proxy service after installing GFI
WebMonitor (If using ISA server 2000).

GFI WebMonitor Installing GFI WebMonitor • 5

 2. Check if the GFI WebMonitor web filter is enabled in the WEB
FILTERS extension list in ISA server's configuration.
3. Check if your browser is using ISA server as a Proxy. (i.e Tools >
Internet Options > Connections > LAN settings
4. If you get an access denied page, check that your IP or
authenticated username has been added to the list of allowed users.
For more information see the above paragraph.

How can I monitor an ISA server that is part of an array?

GFI WebMonitor for ISA Server would have to be installed on each
ISA server. The proxy server settings in Internet Explorer (Tools ->
Internet Options -> Connections -> LAN Settings) would have to be
modified to reflect the ISA server that is to be monitored.

6 • Installing GFI WebMonitor GFI WebMonitor

Using GFI WebMonitor

Introduction

Screenshot 5 - main view

When you connect to GFI WebMonitor, you will see a web page
divided into the following areas:
• Web access in progress
• URL history
• Users history
• Last Web access
• Configuration
To access a particular view, click on the relative tab.
At the top of the screen you will see a refresh button. Note that if you
want to refresh the data in any of the screens, you have to click the
refresh button. The page is NOT updated automatically.

Web access in progress

The web access in progress view (see screenshot in previous
paragraph) shows the currently active web browsing sessions by user,
ip, received bytes, status and real file type followed by the URL being
accessed. You can cancel a particular connection by clicking on the
button with the red X
Note: You need to click refresh to see the currently active web access.

GFI WebMonitor Using GFI WebMonitor • 7

URL history

Screenshot 6 - URL history view

The URL history view groups all accesses to a particular URL and
lists them according to popularity. Number of hits, file types accessed
and the users that accessed the site are also listed.

Screenshot 7 - viewing user access to a particular URL

You can click on a URL to list all users that have accessed this URL.

Users history

Screenshot 8 - Users history view

8 • Using GFI WebMonitor GFI WebMonitor

 The Users history view lists all network users with the URLs accessed.
Most active users are listed at the top. Number of hits, distribution of
web browsing over time and a detailed list of URLs accessed by the
user are listed.

Screenshot 9 - User activity

You can click on a user name to list all URLs for that user on a
separate page

Last Web access

Screenshot 10 - Last web access view

This view displays all URL accesses, ungrouped, for the current day.
User, IP, Time, Received Bytes, Type and exact URL are shown. This
view is identical to the main view of GFI WebMonitor version 1.

GFI WebMonitor Using GFI WebMonitor • 9

Troubleshooting

Introduction
The troubleshooting chapter explains how you should go about
resolving issues you have. Note that GFI WebMonitor is distributed as
freeware, which means we can only offer user-to-user support via the
GFI WebMonitor forums. We also recommend visiting the GFI support
site.

Knowledgebase
GFI maintains a knowledgebase, which includes answers to most
common problems. If you have a problem, please consult the
knowledgebase first. The knowledgebase always has the most up-to-
date listing of support questions and patches.
The knowledgebase can be found on http://kbase.gfi.com

Web Forum
User to user support is available via the web forum. The forum can be
found at:
http://forums.gfi.com/

Build notifications
We strongly suggest that you subscribe to our build notifications list.
This way, you will be immediately notified about new product builds.
To subscribe to our build notifications, go to:
http://support.gfi.com

10 • Troubleshooting GFI WebMonitor