REPORTING ADMINISTRATOR S UIDEkb.websense.com/pf/12/webfiles/WBSN Documentation... · Reporting...

v6.3.3

REPORTING ADMINISTRATOR’S GUIDE

Websense Enterpr ise®

Websense® Web Secur i ty Sui teTM

©1996–2009, Websense, Inc. All rights reserved. 10240 Sorrento Valley Rd., San Diego, CA 92121, USAPublished February 12, 2009 Printed in the United States of America and IrelandThe products and/or methods of use described in this document are covered by U.S. Patent Numbers 6,606,659 and 6,947,985 and other patents pending.

This document may not, in whole or in part, be copied, photocopied, reproduced, translated, or reduced to any electronic medium or machine-readable form without prior consent in writing from Websense Inc.Every effort has been made to ensure the accuracy of this manual. However, Websense Inc., makes no warranties with respect to this documentation and disclaims any implied warranties of merchantability and fitness for a particular purpose. Websense Inc. shall not be liable for any error or for incidental or consequential damages in connection with the furnishing, performance, or use of this manual or the examples herein. The information in this documentation is subject to change without notice.

TrademarksWebsense and Websense Enterprise are registered trademarks of Websense, Inc. in the United States and certain international markets. Websense has numerous other unregistered trademarks in the United States and internationally. All other trademarks are the property of their respective owners.Microsoft, Windows, Windows NT, Windows Server, and Active Directory are either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries.Sun, Solaris, UltraSPARC, Sun Java System, and all Sun Java System based trademarks and logos are trademarks or registered trademarks of Sun Microsystems, Inc., in the United States and other countries.Netscape is a registered trademark of Netscape Communications Corporation in the U.S. and other countries. Netscape Navigator and Netscape Communicator are also trademarks of Netscape Communications Corporation and may be registered outside the U.S.eDirectory and Novell Directory Services are a registered trademarks of Novell, Inc., in the U.S. and other countries.Adobe, Acrobat, and Acrobat Reader are either registered trademarks or trademarks of Adobe Systems Incorporated in the United States and/or other countries.Pentium is a registered trademark of Intel Corporation.Red Hat is a registered trademark of Red Hat, Inc., in the United States and other countries. Linux is a trademark of Linus Torvalds, in the United States and other countries.This product includes software distributed by the Apache Software Foundation (http://www.apache.org). Copyright (c) 2000. The Apache Software Foundation. All rights reserved.Other product names mentioned in this manual may be trademarks or registered trademarks of their respective companies and are the sole property of their respective manufacturers.

Contents

Chapter 1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7

Understanding Websense Enterprise Reporting . . . . . . . . . . . . . . . . . . . . 8Database partitioning. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

Catalog Database . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11Extract, Transform, and Load process (ETL) . . . . . . . . . . . . . . . . . . 11

Delegated Reporting roles . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13Role-based Reporting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14The Main Page in Explorer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15Reporter application window . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18Real-Time Analyzer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20Related documentation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21Online Help . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22Technical Support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22

Chapter 2 Managing Access to Explorer. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25

Accessing Explorer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25Remote logons . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26

Self-Reporting in Explorer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26The Reporting Tools Portal in Explorer . . . . . . . . . . . . . . . . . . . . . . . . . 27

Virtual Private Network (VPN) connections . . . . . . . . . . . . . . . . . . . 28Identifying remote users. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28Laptop users . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29

Chapter 3 Accessing Reporter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31

Chapter 4 Real-Time Analyzer Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33

System requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33Accessing Real-Time Analyzer. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34Using Real-Time Analyzer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34

Reporting Administrator’s Guide 3

Contents

Configuring Real-Time Analyzer settings . . . . . . . . . . . . . . . . . . . . . . . 36Chapter 5 Managing Log Server. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41

Log Server configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41Connection tab . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42Database tab . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44Settings tab . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46Consolidation tab . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48WebCatcher tab. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51

Stopping and starting Log Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56Chapter 6 Choosing Display and Print Options for Explorer . . . . . . . . . . . . . . 57

Changing configuration settings via the wse.ini file . . . . . . . . . . . . . . . 57Chapter 7 Connecting to the Database . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59

Explorer connection to a database . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59Changing the database . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61Reporter connection to a database . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61

Creating a new database connection for Reporter. . . . . . . . . . . . . . . 63Chapter 8 Administering the Database . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69

Database partitions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69Reporting on database partitions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69Accessing Database Administration. . . . . . . . . . . . . . . . . . . . . . . . . . . . 70Database Administration tool . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71

Chapter 9 Troubleshooting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79

General troubleshooting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79Explorer troubleshooting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83Reporter troubleshooting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86

Appendix A Configuring to Use Windows Trusted Connection . . . . . . . . . . . . . . 89

Log Server Service setup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89Reporter Scheduler Service setup. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91Explorer Settings Page . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92Configuring the IIS Web Server. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 95

Appendix B User Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 97

4 Websense Enterprise Reporting

Contents

Appendix C Migrating a Database . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .99

When Migrate Utility controls are available . . . . . . . . . . . . . . . . . . . . . .99Migrating a v5.5.x database . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .100

Appendix D Maintaining the Database . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .101

Index fragmentation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .101Diagnosing index fragmentation issues . . . . . . . . . . . . . . . . . . . . . .102Fixing index fragmentation issues . . . . . . . . . . . . . . . . . . . . . . . . . .103

Summary statistics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .104Diagnosing statistics issues . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .104Fixing statistics issues . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .104

Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .107


Contents


CHAPTER 1 Introduction

Information provided in this guide applies equally to Websense Enterprise® and Websense® Web Security Suite™. Any information that pertains specifically to 1 of these products is noted separately.

The same software is installed for these products, but the Web Security Suite features are enabled only if you enter a Web Security Suite subscription key.

Websense,® Inc., produces software that manages employee use of the internet. Websense Enterprise is the core module that gives an organization the ability to control or monitor network traffic to the internet. The Websense Enterprise components provide the ability to filter requested Internetdata, to set policies regarding that filtering, and to track Internetusage.

Websense Enterprise must be installed and working in your network before installing any of the Websense Enterprise Reporting modules. For detailed information on requirements and installation, see the Websense Reporting Installation Guide.

The Websense Enterprise Reporting components provide the ability to gather and keep information about Internetusage. The Log Server receives incoming data about Internetusage from Websense Enterprise and stores it in a database called the Log Database. When referring to the Log Database, this term encompasses the Catalog Database, which is created at installation, the incoming buffer database, and database partitions for reporting. The Log Database receives and stores Internetactivity data.

Websense Enterprise Explorer and Websense Enterprise Reporter are modules that give you a look into the Log Database that contains information about how your employees are actually using the internet. These reports are based on current Internetusage, or on archived data.

Read the following to understand how Reporting works:

Understanding Websense Enterprise ReportingDelegated Reporting roles


Chapter 1: Introduction

Role-based ReportingThe Main Page in ExplorerReporter application windowReal-Time AnalyzerRelated documentation

Understanding Websense Enterprise Reporting

Understanding Websense Enterprise Reporting requires an understanding of how the Websense components work with the Reporting components. See the overviews below.

Websense Component

Overview

Policy Server Stores Websense configuration information and communicates this data to the Filtering Service. Policy Server also identifies all other Websense components and tracks the location and status of all other Websense services.

User Service Communicates with Directory Service to enable you to apply filtering policies based on users, groups, domains, and organizational units.

Filtering Service Carries out Internetusage policies that are defined for the enterprise, including permitting, blocking, or deferring access to particular Internetsites.Interacts with the firewall, proxy server, or cache appliances (Integration Partner products) and Network Agent to control access to the Internetand to track Internetactivity. It sends activity data to a Log Server.



Websense Master Database:

Organizes Internetsites (by IP addresses and their associated URLs) into 1 of approximately 90 major categories and subcategories. The updated version is downloaded daily from Websense, Inc., and saved to the Filtering Service machine. Filtering Service uses the Websense Master Database to categorize Internetactivity for filtering and tracking.Websense Master Database is updated daily by Websense, Inc. If you choose to purchase the optional Real-Time Security Updates feature, you have the capability to get database security updates as soon as they are published by Websense. To read about database updates, see the Websense Administrator’s Guide.

Integration Partner product

Network device that is either a firewall, proxy server, or cache appliance. It sends users’ Internetrequests to the Websense server for analysis.

Network Agent Manages Internetprotocols and applications outside the Web browser. Depending on how it is configured for the organization, it can also filter and log Internetactivity through the Web browser.

Websense Component

Overview



Components of Websense Enterprise Reporting include.

Reporting Component

Overview

Log Server Receives Internetactivity data from Filtering Service and inserts data into the Log Database.

Log Database Created and powered by Microsoft SQL Server or MSDE. The term Log Database encompasses the Catalog Database, which is created at installation, and database partitions for reporting.The Log Database receives and stores Internetactivity data.

Database Administration

Manages the database partitions with a scheduled rollover and automatic creation of new database partitions.

Microsoft MSDE or SQL Server Database

Log Database is created and powered by Microsoft MSDE or SQL Server.

Explorer Viewer into the Log Database from your Web browser. Runs flexible detail reports on the logged activity.

Microsoft® Internet Explorer

Standard Web browser used by Explorer to request reports.

Reporter Viewer into the Log Database.



Database partitioning

In the v6.3.x database schema, database partitions are a way to provide flexibility and better performance.

If a large database exists on a system, partitioning the database can lead to better performance through parallel operations. Large-scale organizations can benefit by performing multiple operations against individual partitions in parallel.

When you hear the term Log Database, this encompasses the Catalog Database, which is created at installation, and database partitions for reporting.

Catalog DatabaseThe installer creates the Catalog Database with the first database partition. The lookup tables are stored in the Catalog Database, which is the central data storage for information that stays the same.

Extract, Transform, and Load process (ETL)The Extract, Transform, and Load (ETL) batch process is used to separate database writes (where incoming new log records are placed) from database reads (where records are used to serve report queries). In this process, the Log Server puts incoming log records into an unindexed buffer table through a batched bulk insert. An ETL batch process on the database side is then responsible for maintaining referential integrity and importing the new records into the database partition.



The process loops continuously, importing new records as they become available and refreshing the data for reporting.



Delegated Reporting roles

Delegated Reporting roles are only available in Windows and provide the ability to run Explorer reports on selected users.

Delegated Administration and Explorer Delegated Reporting enable the main administrator (Super Administrator) to designate other administrators with privileges to administer certain functions. These roles consist of specific permissions on a particular set of users. Once a role is created in Websense Manager, the Super Administrator assigns an administrator to that role to support Reporting.

Delegated Reporting Administrators run Explorer reports on a specific set of users.

The Super Administrator creates the Delegated Reporting Roles and defines sets of users (client sets) within Websense Manager. When defining client sets, consider the following restrictions:

Each directory object or IP address cannot be in more than one client set.It is possible to have a single IP in one client set and a range of IPs in another client set, but if a different policy is set for the single IP, it will cause an error.You will not be allowed to use a directory object or IP address in more than one client set.Depending upon how the directory service has been set up, there can be a problem defining a client set for the larger group (the entire site) and client sets for the smaller groups (individual departments). The work-around for this problem is to create additional directory objects in the directory service.

For more information on setting up client sets, see the Websense Administrator’s Guide.

NotePolicy Server stores information on the Delegated Reporting roles that are set up within Websense Manager.



1. Go to Websense Manager.2. Right-click Report Administration in the left pane.

For detailed information, see the Websense Administrator’s Guide.

Role-based Reporting

Gives users access to the web-based Reporting tools. Permissions are granted by the administrator.

Explorer Reporting permissions are:

Hide user names in reports: Makes report entries anonymous in reports the administrator runs.Save Favorite reports: Allows the administrator to create and save report criteria for repeated use.Schedule Favorite reports: Allows the administrator to set Favorite reports to run in Explorer.Database Administration: Allows the administrator to use Database Administration to manage Log Database contents by controlling the partitions being viewed, creating and deleting partitions, and maintaining database partitions.Real-Time Analyzer: Allows the administrator to access Real-Time Analyzer.

Set up with access permissions to all web-based Reporting tools, and set up with administrators attached to them.

NoteWhen setting up Reporting Roles, there is one column to check for Administration and another column to check for Reporting. The left hand pane defines the administrators who are attached to a role, and the right hand pane defines users (or a client set) for each role.



1. Go to Websense Manager.2. Right-click on Report Administration in the left pane.

The Main Page in Explorer

After Explorer has been installed and the Log Database has been prepared, use Explorer to view the Log Database from your Web browser. For detailed system requirements, see the Websense Deployment Guide. For detailed installation steps, see the Websense Enterprise Reporting Installation Guide for your system.



Start defining all reports from Explorer’s Main Page. There are drill-down options from some report results, but your initial choices will be made from the main page.

Select and display Top N Report dates

Output to PDF or Excel Spreadsheet

Links Description

Primary report choices Vary, depending on the users, groups and domains in the database. If there are too many users, users will not be available as a primary report choice in the drop-down options. If there are no groups available (or too many groups available), Group will not be available as a primary report choice in the drop-down options. If User and Group are not primary report choices, you have access to them as you drill down into the other choices. If there is only 1 domain, Domain will not display as a primary report choice.

Report dates Can be typed into the boxes or picked via a calendar.

Select and display Top N

Where N represents the number of objects to compare by another filter.

Search for Allows you to quickly find Internetusage for a particular user, or locate a particular URL hostname, source IP, or destination IP.

Hide Names Allows you to show a report using only user IDs instead of user names. This link toggles back to Show Names.



The results of the report in Explorer’s Main Page are shown by result labels, number of Hits (or Kilobytes of Bandwidth), and graphic bars.

Results of Report

View Outliers Lets you see which users have the most unusual Internetactivity usage for the report being viewed.

Help Offers online guidance on how to create the report you want.

User by Day/Month Lets you select a specific user and view that user’s activity for a specific date. Go to the User Activity Detail to view a specific day or month of that user’s activity.

Settings Gives information about the database being viewed for the report results that are displayed. Database information is either viewed by the catalog database with the database partitions chosen in Database Administration or the machine name (where the database is located) and the database name.

Output to Portable Document Format (PDF) icon

Exports the report data to a Portable Document Format.

Output to spreadsheet icon

Exports the report data to a Microsoft Excel file.

Links Description

Result labels # of Hits (or Kb of Bandwidth or Browse Time) Graphic bars



Even if the Log Server is logging visits instead of hits, Explorer will label the log information as Hits.

Reporter application window

The Reporter application window looks like this.



There are over 80 different report formats, broken up by type into Trend, Management, Detail and Summary.

To run reports in Reporter:

1. Select a type of report.2. Select a specific report from 1 of the folders.3. Select the specifics about the report you want.



4. Generate the report. Reporter displays the generated report.

Real-Time Analyzer

Websense Enterprise Real-Time Analyzer (RTA) is a Websense Enterprise component that graphically displays real-time Internetactivity via a Web browser.

Some of the information helps you to determine:

The top 10 URLs that are currently being requested.How much bandwidth is being used and by which categories.The status of Websense; how it is working and effectively blocking sites and protocols.

Additionally, RTA reports on trends for individual users and lets you view system health and statistics for the RTA Server and Filtering Service.



When reports past 24 hours are needed, run reports using Websense Enterprise Explorer.

Related documentation

For complete information on other Websense modules, see the following.

For information on See

Installation of Websense Enterprise

Integration-specific guide for your enterprise. All Websense Installation Guides are located at www.websense.com. Go to Support and Knowledge Base, and then navigate to Product Documentation.

Operation of Websense Enterprise

Websense Administrator’s Guide

Installation of Websense Enterprise Reporting (including Websense Enterprise Explorer and Reporter)

Websense Reporting Installation Guide for your system

Using Websense Enterprise Reporting (including Websense Enterprise Explorer and Reporter)

Websense Explorer and Real-Time Analyzer User GuideWebsense Reporter User Guide

Installation and Operation of Microsoft MSDE or SQL Server database

Microsoft documentation


http://www.websense.com


Online Help

Select the Help option within the program to display detailed information about using the product.

Technical Support

Technical information about Websense software and services is available 24 hours a day at:

www.websense.com/support/

the latest release informationthe searchable Websense Knowledge BaseSupport ForumsSupport Webinarsshow-me tutorialsproduct documentsanswers to frequently asked questionsTop Customer Issuesin-depth technical papers

For additional questions, click the Contact Support tab at the top of the page.

IMPORTANTDefault Microsoft Internet Explorer settings may block operation of the Help system. If a security alert appears, select Allow Blocked Content to display Help.

If your organization’s security standards permit, you can permanently disable the warning message on the Advanced tab of the Tools > Internet Options interface. (Check Allow active content to run in files on My Computer under Security options.)


www.websense.com/support/


If your issue is urgent, please call one of the offices listed below. You will be routed to the first available technician, who will gladly assist you.

For less urgent cases, use our online Support Request Portal at ask.websense.com.

For faster phone response, please use your Support Account ID, which you can find in the Profile section at MyWebsense.

For telephone requests, please have ready:

Websense subscription keyAccess to the Websense management console.

Location Contact information

North America +1-858-458-2940

France Contact your Websense Reseller. If you cannot locate your Reseller: +33 (0) 1 5732 3227

Germany Contact your Websense Reseller. If you cannot locate your Reseller: +49 (0) 69 517 09347

UK Contact your Websense Reseller. If you cannot locate your Reseller: +44 (0) 20 3024 4401

Rest of Europe Contact your Websense Reseller. If you cannot locate your Reseller: +44 (0) 20 3024 4401

Middle East Contact your Websense Reseller. If you cannot locate your Reseller: +44 (0) 20 3024 4401

Africa Contact your Websense Reseller. If you cannot locate your Reseller: +44 (0) 20 3024 4401

Australia/NZ Contact your Websense Reseller. If you cannot locate your Reseller: +61 (0) 2 9414 0033

Asia Contact your Websense Reseller. If you cannot locate your Reseller: +86 (10) 5884 4200

Latin Americaand Caribbean

+1-858-458-2940


ask.websense.com

www.mywebsense.com

www.mywebsense.com


Access to the machine running reporting tools and the database server (Microsoft SQL Server or MSDE)Familiarity with your network’s architecture, or access to a specialist


CHAPTER 2 Managing Access to Explorer

Role-based Reporting manages access to Explorer via assigned privileges and specific policies for a user or a particular set of users.

Accessing ExplorerSelf-Reporting in ExplorerThe Reporting Tools Portal in Explorer

Accessing Explorer

Access Explorer and other web-based Reporting tools through the Reporting Tools Portal. Log on at this page with your network User Name and password. The page will open in your browser (Microsoft Internet Explorer).

The logon is validated through the directory service. If no directory service is available, you will have to use the default Administrator logon of WebsenseAdministrator and the password that was set up to access the Policy Server in Websense Manager.

To access Reporting tools from the Windows Start menu, select Programs > Websense > Web Reporting Tools.To access the Reporting Tools Portal directly after installation:a. Launch Websense Manager and create a password.

Access to the Reporting Tools Portal is based on the Reporting Roles created in Websense Manager. To learn about creating roles, read the Websense Administrator’s Guide.

NoteRecent versions of Microsoft Internet Explorer have the highest default security settings. This will cause users with this Web browser to be blocked from the Explorer pages, even though they are retrieved from an intranet server.


Chapter 2: Managing Access to Explorer

b. After roles have been defined in Websense Manager, enter your network User Name and Password to access the Reporting Tools Portal.

To access Enterprise Explorer from the Reporting Tools Portal, click Websense Enterprise Explorer.To access Reporting tools that are not web-based (Websense Enterprise Reporter, Log Server, and Migrate Utility), use shortcuts from the Windows Start menu.

Remote logonsExplorer can perform remote logons, which means you have access to logging on to a different machine where Explorer may be installed at a different location.

If you log on to machine A and access Real-Time Analyzer and later decide to log on to machine B where Websense Enterprise Explorer is installed, you will no longer see Real-Time Analyzer available to you. It will be dimmed. You will have to log back onto machine A to get back into Real-Time Analyzer.

Self-Reporting in Explorer

Allows users to see Explorer reports only on their own Web browsing, showing what information is being gathered and monitored on them. This gives users the opportunity to alter their Internetbrowsing habits and accommodates any government regulations in a given country that require companies to allow users to see the type of information that is being collected.

Roles do not need to be set in Websense Manager to initiate self-reporting. Instead, check Self Reporting in Settings on the Reporting Tools Portal page to allow users to self report in Websense Enterprise Explorer. See information on editing these settings in the appendix titled User Settings.



The Reporting Tools Portal in Explorer

Opens in your browser (Microsoft Internet Explorer).

For information on accessing Explorer and the Reporting Tools Portal, see Accessing Explorer, page 25.

To test the Explorer installation, click Websense Enterprise Explorer. You should see a report like the following.

NoteRecent versions of Microsoft Internet Explorer have the highest default security settings. This will cause users with this Web browser to be blocked from the Explorer pages, even though they are retrieved from an intranet server.



If you do not get an opening report similar to this from the Explorer Main Page, see Troubleshooting, page 79.

Virtual Private Network (VPN) connectionsIf your organization’s users are connected via a network-based Virtual Private Network (VPN) and access the Internetvia the default network gateway or firewall, then these remote clients are filtered in the same manner as internal clients. However, VPN connections can allow remote users to access the Internetvia alternate gateways. This is commonly known as Split Tunneling.

In this case, you need to set up a rule on your organization’s firewall to disable the connection between the remote client and the port the client connects to on the Remote Filtering Server machine. For more information, see the Websense installation guide and firewall product documentation.

Identifying remote usersFor Websense to transparently identify remote users, users must log on to their cached domains. Users are then identified just as internal users. If users log on using only a local account, they will not be recognized according to their network user account. In this case, Websense applies the Global policy, and user activity is logged under a different user name.

NoteIf the Explorer Web server is running under IIS v6.x, access to the Explorer Main Page will not be affected. However, when viewing reports, users may be asked to enter a Windows user name and password before viewing reports through the browser.

NoteRemote clients also must log on to cached domains to have their Internetactivity logged to the Log Database.

Users also must log on to cached domains in order for users to be identified and Delegated Administration roles to take effect.



Laptop usersFor laptop users, Websense uses the last portion of the Media Access Control (MAC) address to recognize laptop users, rather than the standard IP address. This means that policies assigned to specific IP addresses will not take effect. If no other policy is found for a particular remote (laptop) user, Websense applies the Global policy.

It is also possible that the last 4 bytes of a MAC address overlap with another IP address. In this case, any policy assigned to that particular IP address will be applied to the laptop user.

For more information about transparent identification of users, see the Websense Administrator’s Guide.


CHAPTER 3 Accessing Reporter

Access to Reporter is based on:

A user who has installed Reporter needs database privileges to be able to access the Log Database.A user who is running reports must log on as a local administrator with assigned privileges to the Log Database machine to generate reports in Reporter.When Reporter is installed, it cannot be accessed remotely; it must run from the machine where it is installed.

To access Reporter and the Reporting tools (Log Server and Migrate Utility) that are not web-based, use shortcuts from the Windows Start menu.

NoteThe Log Server and Log Database can run on different machines.


Chapter 3: Accessing Reporter


CHAPTER 4 Real-Time Analyzer Settings

Real-Time Analyzer (RTA) displays users’ Internetactivity as it flows through Filtering Service. By default, RTA is installed on the same machine as Filtering Service. However, it can be installed on a different machine. For installation instructions, see the Websense installation guide for your system.

At all times, RTA must have access to Policy Server, Filtering Service, and any browsers that will connect to it. A Web server must be established so that browsers can connect to RTA.

RTA connects to Filtering Service where it receives users’ Internetrequest information. This information can be displayed through a browser via HTML report templates as requests occur.

The following topics are discussed in this chapter.

System requirementsAccessing Real-Time AnalyzerUsing Real-Time AnalyzerConfiguring Real-Time Analyzer settings

System requirements

Websense Enterprise components:Filtering Service (any integration)Policy Server

Internet browser: Internet Explorer v5.5 or later Web server, such as Apache HTTP or IIS, must be installed. Apache HTTP Server is installed by default with a typical Websense Enterprise installation. For detailed information on system requirements, see the Websense Deployment Guide.


Chapter 4: Real-Time Analyzer Settings

For installation information, see the Websense installation guide for your system.

Accessing Real-Time Analyzer

The Websense Reporting Tools portal is a browser-based graphical user interface. The Portal acts as a single entry point for the Websense Enterprise web-based Reporting tools.

To access Reporting tools from the Windows Start menu, select Programs > Websense > Web Reporting Tools.To access the Reporting Tools Portal directly after installation:a. Launch Websense Manager and create a password.

Access to the Reporting Tools Portal is based on the Reporting Roles created in Websense Manager. To learn about roles, read the Websense Administrator’s Guide.

b. After roles have been defined in Websense Manager, enter your network User Name and Password to access the Reporting Tools Portal.The logon is validated through the directory service. If no directory service is available, you will have to use the default Administrator logon of WebsenseAdministrator and the password that was set up to access the Policy Server in Websense Manager.

To access Real-Time Analyzer from the Reporting Tools Portal; click Real-Time Analyzer.

Using Real-Time Analyzer

The Real-Time Analyzer (RTA) window displays in a browser window. The RTA window has 2 frames: the reports list and the content frame. The Available Reports list displays on the left side of the window and allows you to select reports.



Select the report you want to see from the list. The populated report displays in the content frame.

Real Time Analyzer window

NoteReal-Time Analyzer only views data that is associated with one Policy Server.

Data from all Policy Servers is collected in the Log Database and viewed by Explorer or Reporter.



Configuring Real-Time Analyzer settings

Once you install RTA, you can change the default values RTA uses to generate reports.

Settings include:

Number of items in reportsHow you view dataRefresh rateTrend graph intervalsPeriod of time the trend graph coversHow long the system retains values

NoteAny selections in the Display settings area of the page are associated with the user logon name and impact reports whenever that user logs on.

The options in the Systems settings area are accessible only to users who have administrative rights.



1. From the Real-Time Analyzer window, click Settings. The Real-Time Analyzer Settings window appears.

2. Change the Display settings, which are available to logged-on users and impact only their sessions.

Field Description

Show the top N items in a Top URL/Category/User report

Limits the number of entries that are shown in the Top URLs, Top Categories, and Top Users reports. The default value is 10. Values start at 5.

Show the last N entries in a Running Detail report

Limits the number of entries that are shown in the Running Detail reports. The default value is 20. If you change the value to 0, RTA does not show any entries. The upper boundary is 999. Ultimately, the maximum value is a function of the client browser, Web server, and Web server configuration. Some Web servers limit transfers to 10 MB, which could be reached with an upper limit above 50,000.



3. Change the System settings, which area are accessible only to users who have administrative rights. Any changes here cause RTA to discard previous values. Your changes impact all users.

Keep hit information along with visits: Select this option to keep hit information in memory. The default setting is checked. If you disable this setting, visit information displays in reports, not hit details.

View data by visits/View data by hits

All Internetaccess requests pass through Filtering Service. These requests are analyzed to determine either the actual sites a user views (visits), or the images, text blocks, ads, and other files (hits) acquired during a page request. Select whether to display data as hits or visits. The default setting is Visits.

Default data units Changes the unit displayed when viewing reports. The default setting is Visits.

Refresh page every N seconds

Specifies how often real-time data in the content frame updates. The default setting is 60 seconds. Acceptable values range from 15 seconds to 5 minutes.

Trend graph interval: N minutes

Specifies the intervals between grid settings on trend reports. Trend data is collected in 1-minute units, but minutes can be grouped into larger time periods. The default setting is 1 minute. The acceptable values are 1 to 5 minutes.

Trend graph coverage: N minutes

Specifies the length of time covered by the trend graphs. The default setting is 30 minutes. Acceptable values range from 5 to 60 minutes, or 2 to 24 hours. The number entered here is used to derive the number of vertical grid lines divided by the value entered for the Trend graph Interval setting.

NoteKeeping both hit and visit information increases the amount of memory RTA uses. While the information may be valuable, you need to balance your data tracking requirements with the amount of memory being used.

Field Description



Keep information for N hours: Choose how long RTA stores hit or visit information. Choosing a shorter duration will ease the amount of memory that RTA uses. The default value is 1 hour. The minimum duration is 1 hour and the maximum duration is 24 hours.Keep a maximum of N detail records: Decide how many detail records RTA keeps. When RTA reaches this value, the oldest record rolls out to make place for the new. The default value is 2,000. (Approximately 1MB of memory is required to store 3000-4500 records.)

4. Click Save to exit and keep all changes. Changes to System settings discards previous configuration information, saves your changes, and applies them to all users.


CHAPTER 5 Managing Log Server

Log Server is a separate service that Reporting uses to receive Internetaccess information from Websense. Log Server saves this information to a log cache file (logx.tmp, where x is a number). Log cache files (also called log files) act as temporary storage for data accumulated by Log Server. Log Server stores information in a log file until the file reaches the specified capacity, or a certain amount of time has passed. After reaching either limit, Log Server saves the file and creates a new one. You can select a capacity and time interval on the Settings tab in the Log Server Configuration window.

Log Server will cache log records until CPU time becomes available. Log Server then reads the oldest log file and sends its information to the Log Database.

Log Server configuration

During installation of Log Server, establish settings that define how Log Server should interact with Websense Enterprise and the Log Database. The Log Server Configuration window allows you to modify those settings, as follows:

1. From the Windows Start menu, select Programs > Websense > Utilities > Log Server Setup.The Log Server Configuration window contains tabs with options. The remainder of this chapter describes the options available on each of these tabs.

2. Select a tab to display its options and make any changes.

IMPORTANTAfter making changes on 1 or more of the Log Server Configuration tabs, click Apply, and then stop and restart Log Server for the changes to take effect.


Chapter 5: Managing Log Server

3. Click Apply to save the changes.4. Stop and restart Log Server for the changes to take effect.

Connection tabThe Connection tab contains options for creating and maintaining a connection between the Log Server and Websense.

Field Description

Connections: Log Server input port (Default set to 55805)

Enter the port over which the Log Server will communicate with Websense. After changing the port here, a corresponding change must be made on the Logging tab in the Policy Server Configuration dialog box. For further details, see the Websense Administrator’s Guide.



User/Group update interval (hours)

Enter how often you would like Log Server to contact the directory service to update Log Database with user and group information. Each time Log Server starts, Log Server contacts the network directory service to obtain a current list of users and groups. It then updates existing log records to reflect any changes to user names and group assignments. While Log Server is running, it requests updates from the directory service according to the frequency entered here.

Service Status (Start or Stop)

Click the button to Stop or Start the Log Server service. For example, whenever you make changes in the Log Server Configuration window, Stop and Start the Log Server service for the changes to take effect.Keep in mind that no Internetaccess activity can be logged when Log Server is stopped.

Field Description



Database tabOpen the Database tab to select a database engine and configure the Log Database.

Field Description

Database ConfigurationLog Insertion Method --Open Database Connectivity (ODBC) --Bulk Copy Program (BCP)--recommended

Choose the method for inserting log records into the database. Your choices are:

Open Database Connectivity (ODBC) = Uses a database driver to manage data between Enterprise Reporting and the database.Bulk Copy Program (BCP)--recommended = Inserts batches into the Log Database and provides better performance. If batch inserts cannot be done, data will be inserted via ODBC.

Note:BCP is only enabled when the database is on the same machine as Log Server. If BCP is not on the same machine as Log Server, the BCP selections will be unavailable and greyed out.

ODBC Data Source Name (DSN)

Enter a brief descriptive name for the new ODBC connection (for example, wslogdb63).



ODBC Login Name Login name used to access the database.

Connection Click this button to select the Log Database for storing new Internetaccess information from Websense.1. In the Data Source dialog box, select the

Machine Data Source tab.2. Select the ODBC connection for the database into

which new information will be logged.3. Click OK to display the SQL Server Logon

dialog box.If the Use Trusted Connection option is available, make sure it is set properly for your environment.

Note:MSDE users: Uncheck the option. SQL Server users: Contact your Database Administrator for assistance.

4. Enter the Logon ID and Password established when the database was created. Usually this is the same Logon ID and password entered during Log Server installation and database creation.

5. Stop and restart Log Server via the Connection tab after making this and any other changes in the Log Server Configuration window.

BCP ConfigurationBCP file path location

Specify the location where Log Server resides to process and store files used for the BCP inserts.

BCP file creation rate (minutes)

Indicates the maximum number of minutes that the BCP program should spend sending batches of data to the Log Database before closing and creating a new batch. This setting works in combination with the size setting: BCP creates a new batch file as soon as either limit is reached.

BCP maximum batch size (number of logs)

Specify how large a batch size should get before a new file is created. This setting works in combination with the time setting: Log Server creates a new log file as soon as either limit is reached.

Field Description



Settings tabOn the Settings tab, use the Cache section to establish how often the Log Server should create a new logx.tmp file for saving information. The Log

Maximum connections allowed

Set the maximum number of connections between Log Server and Microsoft SQL Server if Microsoft SQL Server is the selected database engine. This can be any number from 4 (the default) to 50, depending on your SQL Server license. --Minimum connections allowed for ODBC = 4--Minimum connections allowed for BCP = 2Note: Increasing the number of connections can increase processing speed, but could impact other programs in the network that use SQL Server. In most cases, you should set the number of connections to less than 20. Contact your Database Administrator for assistance.When MSDE is the selected database engine, this value is preset and cannot be changed.

Enhanced logging Checking this option assures that Log Server will not create duplicate records in the Log Database after a shutdown. This option should be enabled if you are using Consolidation. Enabling Enhanced logging can slow Log Server processing.If this option is unchecked, as it is by default, after a shutdown Log Server starts processing at the beginning of the oldest log file. This could result in duplicate entries in the Log Database, but speeds Log Server processing.

Field Description



Server creates a new log cache file when either the time limit is reached, or the size of the current log file reaches the size indicated on this tab.

Field Description

Log Cache File ControlLog file path location

Enter a custom path for storing log files. By default, this path is set to: <WebsenseInstallPath>\bin\Cache.

Cache file creation rate (minutes) (Default - 1 minute)

Indicate the maximum number of minutes that the Log Server should spend sending Internetaccess information to a temporary log file (logx.tmp) before closing it and creating a new file. This setting works in combination with the size setting: Log Server creates a new log file as soon as either limit is reached.



Consolidation tabUse the Consolidation tab to enable consolidation and set preferences for it. Consolidation decreases the size of your Log Database by combining Internetrequests that share the following elements:

Domain Name (for example: www.websense.com)CategoryKeywordDisposition (for example: Category Blocked)User/Workstation

Consolidation decreases the size of the Log Database, making report generation within a time interval faster.

Cache file creation size (MB)(Default - 1 MB)

Specify how large a temporary log file should be before the Log Server closes it and creates a new file that will store Internetaccess information. This setting works in combination with the time setting: Log Server creates a new log file as soon as either limit is reached.

Visits ProcessingEnable visits(Default - Visits)

Specify whether Websense Enterprise Reporter will log entries from the Filtering Service as Visits or as Hits.This option checked specifies that log entries will be logged as Visits.Logging as Visits results in 1 log record per Web page requested, combining all related data items, such as graphics and advertisements. Logging as Hits results in multiple log records for each Web page visited.Note:Websense recommends creating a new database

partition prior to changing the method of logging from Visits to Hits. Use Database Administration to create a new database partition. Be aware that making this change will cause your Log Database to rapidly increase in size.

Field Description

IMPORTANTEnabling Consolidation may skew the accuracy of some report calculations, such as InternetBrowse Time reports.



Consolidating log data may result in a loss of Internetrequest records for the same domain name, and may decrease the accuracy of some detail reports.



Field Description

ConsolidationConsolidate Log Records(Default - disable Consolidation)

Leave this option unchecked to disable Consolidation and retain full detail of each logged Internetrequest. Disable Consolidation while running the Migrate Utility to migrate data. For information on the Migrate Utility, see the Websense Enterprise Reporting Installation Guide.

Consolidation time interval - Hours or Minutes(Default - 1 minute)

Specify the period of time you want Log Server to process log entries before saving them to the Log Database. Log Server will consolidate as many entries as it can within the time you select (Hours or Minutes). Increase the time interval to maximize consolidation. During this consolidation period, Log Server considers all log files (logx.tmp) and creates a single log record for matching entries. At the end of the consolidation period, the consolidated entries are saved to the Log Database.Depending upon the volume of Internetrequests and how often consolidation runs, consolidation may combine Internetrequests made over several minutes or several hours. Log entries considered during different consolidation periods are not combined.If you have also enabled the full URL option in Database Administration, the consolidated log record will contain the full path (or the first 255 characters) of the first matching site Log Server encounters. For example, suppose a user visited the following sites and all were categorized in the shopping category.

www.domain.com/shoeshoppingwww.domain.com/clotheshoppingwww.domain.com/jewelryshopping

With the full URL active, consolidation would create a single log entry under the full URL www.domain.com/shoeshopping. While this does not identify all shopping sites the user visited, it does give the general idea of the type of site.



WebCatcher tabUse WebCatcher to analyze unrecognized URLs and Security URLs for categorization and the potential for security and liability risks. Storing full URLs is not necessary to use WebCatcher. Subsequent downloads of the Websense Master Database will include category revisions reflected in the improved filtering.

Note that the information sent to Websense, Inc., contains only URLs and does not reflect individual user information.

The following example illustrates the information that would be sent to Websense, Inc., if you activated 1 or both of the send options. The IP address in this entry reflects the address of the machine hosting the URL, not the requestor’s IP address.

<URL HREF=”http://www.ack.com/uncategorized/” CATEGORY=”153” IP_ADDR=”200.102.53.105” NUM_HITS=”1” />

You may need to make changes on your proxy server or firewall to permit this information to be sent via HTTP post. For information on the types of changes that could be needed, see the documentation located at www.websense.com. Go to Support and Knowledge Base, and then navigate to Product Documentation.

NoteCurrently, intranet sites are not sent with WebCatcher. This includes all sites in the 10.xxx.xxx.xxx, 172.16.xxx.xxx, and 192.168.xxx.xxx ranges.



WebCatcher runs when the maximum file size has been reached or at the daily start time.



Field Description

Send uncategorized URLs - improve URL categorization

Check this option to send Websense, Inc., a list of all uncategorized URLs found in your Log Database. Websense, Inc., analyzes these websites to add them to the Websense Master Database.Uncheck this option to prevent reporting on this information.Note: The Log Server machine must be configured to use Internet Explorer v5.5 or later as the default browser to send WebCatcher files to Websense, Inc.

Send security URLs - improve security effectiveness

Check this option to send Websense, Inc., a list of specified security URLs found in your Log Database. Websense, Inc., makes note of these websites to determine the activity of keyloggers, malicious websites, phishing and other fraud, spyware, and malicious mobile code.Uncheck this option to prevent reporting on this information.Note: The Log Server machine must be configured to use Internet Explorer v5.5 or later as the default browser to send WebCatcher files to Websense, Inc.

Select the country which best reflects your location

Select the country where the majority of activity is being logged.

Save a copy of the data transmitted to Websense

Check this option to save a copy of the data that is being sent to Websense, Inc. WebCatcher will save the unencrypted xml files to the Websense\Reporter directory. These files will be date and time stamped.Uncheck this option to disable saving the data that is being sent to Websense, Inc.

No do not send information to Websense

Checking this option does not send Websense, Inc., any URL information identified by WebCatcher, disabling WebCatcher.

Maximum upload file size (KB)(Default 4096 KB)

Set the maximum size of the file that you want to send to Websense (from 4096 KB to 8192 KB). Ensure that your system can post a file of the specified size.



Minimum Daily start time(Default 11:00:00 PM)

Set the start time that WebCatcher processes the URL data collected when the size threshold is not reached. This ensures that the collected URL data is processed and removed from the system at least once a day.

Authentication Click this button if the Log Server machine must authenticate to access the internet. The Authentication dialog box that appears is described in Authentication dialog box. Enter the appropriate information and click OK to return to the WebCatcher tab.

Field Description



Authentication dialog boxThe Authentication dialog box appears after you click Authentication on the WebCatcher tab.

Field Description

Proxy SettingsUse a proxy server

Check this option if the Log Server machine must access the Internetthrough a proxy server.

Proxy server name Enter the machine name or IP address of the proxy server that you use to access the internet.

Proxy server port Enter the port number over which the proxy server communicates.

Use Basic Authentication

Check this option if the Log Server machine requires authentication to access the internet.

User Name Enter your user name for Internetauthentication.

Password Enter your password for Internetauthentication.

Confirm Password Enter your password again to confirm your password.



Stopping and starting Log Server

Log Server receives information from Websense and saves it in the Log Database for use by Explorer and Reporter. It runs as a Windows 2000 service, which can be started during installation.

Stop and restart Log Server any time you make changes through the Log Server Configuration window.

Log Server restarts each time you restart the machine. You can also stop and start the Log Server manually through the Connection tab in the Log Server Configuration window.

1. From the Windows Start menu, select Programs > Websense > Utilities > Log Server Setup.

2. Select the Connection tab.3. In the Service area, click Stop.4. Wait several seconds, and then click Start to restart the Log Server

service.5. Click OK to close the Log Server Configuration window.

NoteWebsense cannot log Internetaccess that occurs while the Log Server is inactive.


CHAPTER 6 Choosing Display and Print Options for Explorer

Modify the Display and Print options for Explorer via the wse.ini file.

Changing configuration settings via the wse.ini file

Make adjustments to the way Explorer displays report choices and report results by making parameter changes to the wse.ini file. If you selected the default location during installation, this file is located at:

C:\Program Files\Websense\webroot\Explorer\wse.ini

The following table explains the parameter, what it controls, and the default value.

Parameter Default value

What it controls

maxUsersMenu 5000 The database must have fewer users than this value to show User as a primary report choice at the top of Explorer’s Main Page.

maxGroupsMenu 3000 The database must have fewer groups than this value to show Group as a primary report choice at the top of Explorer’s Main Page.Note: You need more than 1 group for Group to show as a primary report choice. You need more than 1 domain for Domain to show as a primary report choice. There is no maximum value on the number of domains.

maxUsersDrilldown 5000 User displays in red during drill down, if there are more users than this number in the proposed report.

maxGroupsDrilldown 2000 Group displays in red during drill down, if there are more groups than this number in the proposed report.


Chapter 6: Choosing Display and Print Options for Explorer

warnTooManyHits 10000 If there are more users than the maxUsersDrilldown value, but fewer hits than this value, user will not display in red.If there are more users than the maxUsersDrilldown value and more hits than this value, user will display in red.

hitsPerPage 100 The number of items displayed per page will be no greater than this value.

maxOutputBufferSize 4000000 This is the limit (in bytes) on the total size of a page that can be displayed in Explorer’s Main Page. When this limit is reached, a message stating that some results are not shown will display in gray.

timelineCompression Threshold

10 In the User Activity by Day or Month, when the Expand/Collapse button is available: This is the time threshold to collapse hits that occur within this time with the same base URL. For example, everything up to the third slash, Websense category, and disposition.

PageSize Letter Explorer report results can be output to Portable Document Format (PDF). The page size can be modified to A4 or Letter (8.5 X 11 inches).

Parameter Default value

What it controls


CHAPTER 7 Connecting to the Database

At any time, you can change the database that Explorer uses to run reports.

Explorer connection to a databaseChanging the databaseReporter connection to a databaseCreating a new database connection for Reporter

Explorer connection to a database

After the Explorer installation, the default connection will be made to the same Log Database to which Log Server is logging. A custom connection can be made by supplying the database name, location, user name, and password for the database. When using a trusted Windows connection, the user name and password are not used.

To access this page directly after installation:

Launch Websense Manager and create a password.Access to the Reporting Tools Portal is based on the Reporting roles created in Websense Manager. To learn about creating roles, see the Websense Administrator’s Guide.After roles have been defined in Websense Manager, enter your network User Name and Password to access the Reporting Tools Portal.The logon is validated through the directory service. If no directory service is available, you will have to use the default Administrator logon of WebsenseAdministrator and the password that was set up to access the Policy Server in Websense Manager.

1. Go to Programs > Websense > Web Reporting Tools.2. When the Reporting Tools menu opens, click Websense Enterprise

Explorer. The Websense Enterprise Explorer Main Page appears.3. Click Settings to open the Explorer Settings page.


Chapter 7: Connecting to the Database

4. Choose the new method of database connection, based on your available choices.If Explorer is installed on a different machine than Log Server, your only option will be to make a custom selection.

5. Click Save Settings to complete the database connection change.If you have entered valid information, a message displays stating that you have successfully changed the database.If you have not entered valid information, a message displays that says it could not connect to a database.

Field Description

Server Enter the machine name (or IP address) where the Log Database is stored.

Database Enter the name of the Log Database.

User ID Enter the user ID to access the database. If you are not sure what to use here, enter sa which is the default user ID for MSDE and the default administrator ID in SQL Server.This release of Explorer does support Windows-based authentication (user IDs) to connect to the database. If you are using a trusted connection to access Explorer, leave the user and password fields blank so the Windows user will be used.

Password Enter the password to access the database.

View catalog database

Check this option to view the catalog database. Explorer views the database where Log Server is sending current activity information.Leave this option unchecked to enter database information directly: Choose the database name and the machine name where the database is physically located.

Select the default detail report format

Choose Smart columns selection to default to a standard Report format, or choose Custom columns to customize your Report format and to choose from the available columns.

Select report type Choose to open reports in a Summary view or Detail view.

Available Columns Select the columns to be included in your Report format, if you chose to customize your Report format.



Make sure you entered a valid user ID and password, and correct machine and database names. Also check for a typing error.

6. Click Enterprise Explorer at the top left to go back to the Reporting Tools Portal.

Changing the database

There is no migration path from previous database schemas to the v6.3.x database schema. However, the Migrate Utility will be available for Reporter so that the v5.5.x database schema can be migrated to the v6.2 database schema.

Once the information has been migrated to v6.2, Reporter v6.3.x also can view older data to generate reports. Explorer users can connect to the old database schema to run reports on older data in the v6.1.x and v6.2 databases.

To make sure the Log Database is attached to the database engine, see the Microsoft documentation for details on how to attach a database.

Websense Reporter must be connected to a Log Database through an ODBC connection in order to generate reports. An ODBC connection is generally established automatically during installation and whenever you create a new Log Database. You may have to manually create a needed ODBC connection.

Reporter connection to a database

Reporter can generate reports from an older Log Database or from the current database partitions.

The Log Database selected for reports does not affect where new Internetrequests are logged. The Log Server continues logging to the Log Database selected in the Log Server Configuration window.



1. From the Reporter Tools menu, select Options. A Select Data Source dialog box appears.

2. Select the Machine Data Source tab.3. Highlight the Data Source Name (ODBC connection) created for use with

the desired Log Database. In most cases, the Data Source Name matches the name of the Log Database.

4. Click OK. A SQL Server logon dialog box appears.5. Enter the Logon ID and Password you established when you installed

SQL Server or MSDE. If you are not using a trusted connection for database communications, but the Use Trusted Connection option is checked, uncheck it and enter the appropriate Logon ID and Password.

6. Click OK.

Reporter is now ready to generate reports from the Log Database you just selected.

NoteIf you installed MSDE, enter sa as your Logon ID and leave the Password field blank.



Creating a new database connection for ReporterYou may need to create an ODBC connection manually on the Reporter machine to allow that machine to communicate with a Log Database on a different machine.

You can create an ODBC connection manually through the Windows Control Panel, or by following the steps below.

1. Open the Reporter Tools menu, and then select Options. The Select Data Source screen appears.



2. Select the Machine Data Source tab, and then click New. The Create New Data Source screen appears.

3. Select System Data Source, and then click Next. A dialog box appears with a list of drivers.



4. Highlight SQL Server, and then click Next.

5. Click Finish in the dialog box that displays your selections. The Create a New Data Source dialog box appears.

NoteMSDE installs SQL ODBC drivers as part of its installation, so both SQL Server users and MSDE users should select SQL Server as their driver.



6. Enter a descriptive name for the new ODBC connection in the Name field, such as wslogjul04. Make sure that the name you select begins with a letter and can be easily identified at a later time.

7. Enter a short description of the ODBC connection in the Description field (optional). For example, you may want to describe the data source according to the information the database holds.

8. Enter the location of MSDE or SQL Server, or select 1 from the Server drop-down list. Do not select local, as the system establishes its own local connections.

9. Click Next. The Create a New Data Source to SQL Server dialog box appears.

10. Select the type of authentication established for use with your database engine.

IMPORTANTIf you installed SQL Server 2000/2005 with an instance name other than MSSQLServer (the default), enter the IP address (recommended if known) or machine name of the SQL Server machine, followed by the instance name:

<IP address or machinename>\<instancename>

For example: 10.201.1.1\ReporterSql



MSDE users should select With SQL Server authentication. Enter sa as your Logon ID and leave the Password field blank. If you chose to use Windows Authentication during installation, leave the Logon ID and password fields blank.SQL Server users should select an option according to the authentication method established during SQL Server installation.

11. Check Connect to SQL Server... if you need to enter a logon ID and password.

12. Click Next. The next screen in the Create a New Database Source to SQL Server dialog box appears.

13. Check Change Default Database to, and then select the Log Database for this ODBC connection from the drop-down list.



14. Click Next. The next screen in the Create a New Database Source to SQL Server dialog box appears.

15. Check Perform translation. Leave all other boxes unchecked.16. Click Finish. 17. Review the settings in the ODBC Microsoft SQL Server Setup screen that

appears, and then click OK. The SQL Server Logon dialog box appears. 18. Enter the same Logon ID and Password you entered in step 10.

If you are not using a trusted connection for database communications but the Use Trusted Connection option is checked, uncheck it and enter the appropriate Logon ID and Password.

19. Click OK. Reporter can now communicate with this Log Database.

When you want to generate a report, select the appropriate Log Database within Reporter. Create a separate ODBC connection for each Log Database.


CHAPTER 8 Administering the Database

The Database Administration tool allows you to:

Refresh the Database Administration screenSet database rollover optionsConfigure Internet Browse TimeSet whether or not you want to log full URLsSchedule maintenance on database partitionsCreate database partitionsDelete old database partitionsSee error log activity

Database partitions

Database partitions are defined by date or size. They can be set to roll over so that the data ends up being stored in multiple separate partitions.

When an incoming batch of records exceeds the threshold, the database will automatically create a new database partition and redirect the new records there. Similarly, if individual incoming records come in that are outside the date and time range specified for a partition, the database code will import them into the appropriate partition(s).

Rollover database partitions by size (MB) or time (week or month).

Reporting on database partitions

All Explorer users will view the database partitions chosen in Database Administration. Select the appropriate check boxes in Database Administration to generate reports on specific data.


Chapter 8: Administering the Database

Accessing Database Administration

1. Access Reporting tools from the Windows Start menu. Select Programs > Websense > Web Reporting Tools.To access the Reporting Tools Portal directly after installation:

Launch Websense Manager and create a password.Access to the Reporting Tools Portal is based on the Reporting roles created in Websense Manager. To learn about creating roles, see the Websense Enterprise Administrator’s Guide.After roles have been defined in Websense Manager, enter your network User Name and Password to access the Reporting Tools Portal.The logon is validated through the directory service. If no directory service is available, you will have to use the default Administrator logon of WebsenseAdministrator and the password that was set up to access the Policy Server in Websense Manager.

2. Click Database Administration.in the Reporting Tools Portal. The Database Administration tool appears with the name of the Log Database.

NoteThe Super Administrator creates roles that allow access to other administrative users for database administration. Generally, only one person should have the responsibility for administering the database.

Access permissions are set when roles are created in Websense Manager. For information on creating roles and setting permissions, see the Websense Enterprise Administrator’s Guide.



Database Administration tool

Detailed database administration options can be updated to suit your database and Reporting needs.

Refreshes the Database Administrationdisplay.



Field Description

Refresh The Refresh button at top refreshes the Database Administration display. If you create a new database, it could take a few minutes for Refresh to pick up the new database in the display.Important: When you want to refresh the Database Administration screen, do not use your Web browser refresh option, as this can unnecessarily create new database partitions. Be sure to use the Refresh button at the top of the Database Administration screen.

Database Rollover OptionsRollover Every(default - 5120 MB)

Database partitions are rolled over, based on size (MB) or time (week or month).At the specified time or size, a new partition database will be created. Explorer automatically includes the new database partition for logging and Reporting.

If you select date, state how many weeks or months you want to keep in the database before a new one is created. Remember that full weeks and months mean full calendar weeks and months.If you select size, then when the database hits the specified size, rollover will begin. Important: Since the database can hit a particular size any time during the day, this could cause performance problems if the rollover begins during a busy part of the day.

Note:- If you are using Microsoft SQL Server as your database engine, you cannot select more than 200GB. - If you are using MSDE as your database engine, you must select between 100 MB and 1.5 GB.

Click Update to set the edited Database Rollover Options.

Internet Browse Time ConfigurationJob Start Time(default start time - 02:00)

Explorer uses these values to generate Internet Browse Time (IBT) reports.Choose a time when Internetactivity will be slower, so that this job processing does not negatively impact how long it takes reports to generate.



Read Time Threshold (default - 3 minutes)

A session starts when a user opens a browser and HTTP traffic is generated. A session stays open as long as the user generates HTTP traffic with no time gap larger than the parameter set for the Read Time Threshold.Note:Changing the IBT Read Time Threshold value will cause

your Explorer IBT reports to be inconsistent. You should accept the default or change it as few times as possible.

Last Read Time (default - 3 minutes)

When the time gap of HTTP traffic is longer than the Read Time Threshold, the session is ended and the value of the Last Read Time is added to the session time. This is because it is assumed that there should be time associated with the last Web page requested.Click Update to set the edited Internet Browse Time Configuration options.Note: After upgrade, these options return to the original default settings.

Field Description



Field Description

Full URL logging

Check this option to record the full URL of each site requested. If this option is left unchecked, only the domain name will be saved in the Log Database. Saving full URLs produces a larger Log Database, but provides greater detail.After upgrade, this option is left unchecked and turned off.

Maintenance ConfigurationDelete partitions automatically(default - 365 days)

Check this option to automatically delete database partitions when they reach a certain age. The number of days range from 3 to 365 days old. When you specify the age when partitions should be automatically deleted, Database Administration detaches and then deletes the partitions. For example if you specify 180 days, Database Administration deletes the partitions that are 180 days old.Warning: Once database partitions are deleted, you cannot recover your data.You can use the Available Partitions in Database Administration to manually delete database partitions and prevent loss of data.

Maintenance Start Time(default start time - 01:00)

Select the time of day that maintenance on the database should begin.

Enable automatic reindexing of partitions when necessary on(default - begins Saturday)

Check this option to enable automatic reindexing when necessary to avoid fragmentation issues of the database partitions. This will occur on the day of the week that you select.Important: Reindexing your database partition is a time-consuming task. Reports cannot be run during this time.To read about index fragmentation issues, see the appendix on Maintaining the Log Database.

Number of days before deleting failed batches(default - 20 days)

Check this option to delete failed batches. Failed batches will be deleted after “n” days (where “n” equals the number of days the failed batches are held).



Process the unprocessed batches

Check this option to process any unprocessed batches.

Number of days before deleting error log(default - 15 days)

Check this option to delete error logs. Error logs will be deleted after “n” days (where “n” equals the number of days the error logs are held).Click Update to edit the Maintenance Configuration options.

Field Description



Field Description

Database Partition CreationFile Path, Init Size, GrowthData Log (default Init Size - 100 MB; default Growth size - 100 MB)

If you need to create a new database partition now, enter the following information.

File Path of the database partition and log file.Initial Size of the database partition and log file.--Microsoft SQL Server Standard and Enterprise Data default = 2,048 MB.--Microsoft Database Engine (MSDE) Data default = 100 MB. Growth: How large you expect the database partition and log file to grow. --Microsoft SQL Server Standard and Enterprise Data default = 512 MB. When the database reaches a maximum of 5 GB, the database rolls over.--MSDE Data default = 100 MB. When the database reaches a maximum of 1.5 GB, the database rolls over.

Click Update, or click Create now to immediately create a new database. If you create a new database, this could take a few minutes before the new database is displayed.

Available partitionsSelect allSelect none

Check the boxes to choose which partitions to selectively report on and to control generating reports on specific partitions (and their date ranges).Choose Select all to select all partitions and date ranges for reporting.



Delete When new data is ready to be migrated in (for example the current month), then the oldest data (maybe the parallel month from the previous year) can be removed, improving performance through this management process.If you want to permanently delete some data, check the specific partitions you wish to delete, and then click Delete. You cannot recover deleted partitions.The other (unchecked) time-dependent database partitions are unaffected and can be used for ongoing Reporting.Click Update to enable Available partitions options.

Error Log Activity Choose to view the error logs (the last 5, 25, or 100 activity logs), or choose to view none. These logs may be helpful in troubleshooting.

Field Description


CHAPTER 9 Troubleshooting

Troubleshooting issues are discussed in this chapter.

General troubleshootingExplorer troubleshootingReporter troubleshooting

General troubleshooting

How do I configure SQL Server user permissions, so that I can create SQL Agent jobs for Microsoft SQL Server 2005?Database sizeHow do I determine the cause of a problem or get more information about an error message?The data on my Internet Browse Time reports is skewed.Bytes transferred are larger than expected.After installing Log Server and attempting to start the Service, I receive an error message that states Log Server Service does not exist.Some protocol requests are not being logged.Reports on Risk Classes show different information.All reports have no data.

How do I configure SQL Server user permissions, so that I can create SQL Agent jobs for Microsoft SQL Server 2005?

Microsoft SQL Server 2005 has defined new SQL Agent roles that govern accessibility of the job framework. The new SQL Agent jobs for SQL Server 2005 are stored in the Microsoft ‘msdb’ database. The solution is to provide


Chapter 9: Troubleshooting

membership for the public and SQLAgentUserRole roles in the ‘msdb’ database.

Go to Microsoft SQL Server 2005 to grant the SQL user account the necessary permissions to successfully install the Websense Reporting tools.

1. Go to the Windows Start menu and select Programs > Microsoft SQL Server 2005 > Microsoft SQL Server Management Studio.

2. Select the Object Explorer tree.3. Select Security > Logins.4. Select the login account to be used during the installation.5. Right-click the login account and select Properties for this user.6. Select User Mapping and do the following:

a. Select msdb in database mapping.b. Grant membership to the public role.c. Grant membership to the SQLAgentUserRole role.d. Click OK to save.

7. Select Server Roles, and then select BCreator. The DBCreator role is created.

8. Click OK to save.

Database sizeDatabase size is always a concern. If you have been successfully using Websense Enterprise Explorer or Websense Enterprise Reporter and you notice the reports are taking much longer to display or you begin receiving time-out messages from your Web browser, you may want to consider taking some database partitions off-line using Database Administration. Go to the Windows Start menu and select Programs > Websense > Web Reporting Tools. Log on, and then select Database Administration.

NoteThe SQL user account must also be a member of the DBCreator fixed server role.



How do I determine the cause of a problem or get more information about an error message?

The Event Viewer provides additional information about various error messages that occur on your machine. If you have Reporter, Policy Server, Log Server, and the Log Database installed on different machines, you may need to check the Event Viewer at each of them to determine the cause of the problem.

1. At the Windows Start menu, select: Programs > Administrative Tools > Event Viewer.

2. In the Tree, click Application Log. This displays a list of application errors logged by the Event Viewer. The Source column lists the application or service that generated an error.

3. Double-click an error message to view its details.

The data on my Internet Browse Time reports is skewed.Be aware that consolidation may skew the data for Internet Browse Time reports. These reports calculate the time users spend accessing the Internetand can include details about the time spent at each site and the cost associated with Internetbrowsing. Internet Browse Time is calculated using a special algorithm, and enabling consolidation may skew the accuracy of the report calculations.

Bytes transferred are larger than expected.Most Websense integrations provide bytes transferred information. (Check Point FireWall-1, Cisco Secure PIX Firewall, or Cisco Cache Engine do not send bytes transferred information to Websense.)

When a user requests a file download, the integration partner sends Websense the full file size as bytes transferred. Websense logs this information when it is received.

If the user subsequently cancels the actual download, or the file does not download completely, the bytes transferred value in the Log Database represents the full file size. As a result, the reported bytes transferred will be larger than the actual number of bytes transferred if users have canceled download requests, or if the download process was unsuccessful.



Also, if users are blocked, the bytes transferred value in the report represents the amount of data that would have been downloaded had filtering not taken place, thus quantifying the filtering bandwidth savings.

After installing Log Server and attempting to start the Service, I receive an error message that states Log Server Service does not exist.

1. Run the installation again. 2. Select the Repair option.

Some protocol requests are not being logged.A few protocols, such as those used by ICQ and AOL, prompt requesting users to log into a server having 1 IP address, and then send a different identifying IP address and port number to the client for messaging purposes. In this case, all messages sent and received may not be monitored and logged by the Websense Network Agent, because the messaging server is unknown at the time messages are exchanged.

As a result, the number of requests logged may not match the number of requests actually sent. This affects the accuracy of reports produced by Websense Enterprise Reporter and Websense Enterprise Explorer.

Reports on Risk Classes show different information.

The mapping between risk classes and categories can now be changed in Websense Manager. These new mappings will be reflected in both Explorer and Reporter reports.

All reports have no data.If there is no data for any of your reports, you should check to make sure the Log Server is correctly set up to receive log information from a Websense Filtering Service.

NoteThe Repair option repairs all components installed on your machine.



1. Open Websense Manager.2. Log on as a user who has administrator permissions.3. From the Server menu, select Settings > Logging.4. Enter the machine name or IP address where the Log Server is located.5. Enter the port that Log Server is listening on (the default is 55805).6. Click Check Status.

There is an indicator as to whether the connection test passed.7. Click OK to save changes.

Explorer troubleshooting

Explorer troubleshooting information discusses the following issues.

No Catalog DatabaseProblems with Microsoft IIS or Apache Web server.Cannot obtain a URL list, because special characters exist in domain names.Pop-up blocking is blocking certain Reporting features.Potential issues when generating Explorer reports.

No Catalog DatabaseIf the Catalog Database did not get created at installation or if the database has been corrupted, you can create it manually via the Command line.

1. From the Windows Start menu, go to Programs > Accessories > Command Prompt. The Command shell opens.

2. Use the Command shell to see the Command line options. Enter:C:\Program Files\Websense\SQL\CreateDbU.exe - Help

A list of the CreateDbU Help options displays.3. Get the name of the Server, which is the database instance or host name.4. Enter the command to create the new Catalog Database, including:

Server nameUser name or ““ (two double quotes) for trusted connection



Password or ““ (two double quotes) for no password for trusted connectionComponent (enter LogServer, Reporter, or Both)New Catalog Database nameDatabase path (C:\Program Files\Websense\SQL)

Be sure to include spaces in between each command and enclose each command with double quotes. For example:”WS-DB-SERVER” “ws_admin” “password1” “LogServer” “newlogdb63” “C:\Program Files\Websense\SQL”

5. Go to Microsoft SQL Server to verify that the new Catalog Database has been created. For Microsoft SQL Server 2000, go to Enterprise Manager. For Microsoft SQL Server 2005, go to Management Studio.a. For SQL Server 2000, the default path for Microsoft SQL Server

2000 is: C:\Program Files\Microsoft SQL Server\Enterprise Manager

b. Expand the navigation tree to reveal the SQL Server name and the folders beneath it.

c. Open the Databases folder to see the new Catalog Database (for this example, newlogdb63).

6. Restart the Log Server. a. Go to the Windows Start menu and select Programs > Websense >

Utilities > LogServer Setup. The Log Server Configuration displays with multiple tabs.

b. Go to the Connection tab and click Stop in Service Status.c. Click Start in Service Status. You should see the message that says

the service is running.7. Update your Explorer Settings.

a. Go to Enterprise Explorer via Programs > Websense > Web Reporting Tools.

b. Select Settings in Enterprise Explorer.c. Check the View the catalog database option.d. Click Save Settings.

8. Go to Database Administration in the Reporting Tools Portal to see that the new Catalog Database name is displayed.



At the top of the Database Administration screen, you will see Settings for: <machine name> \ <new Catalog Database name>.

Problems with Microsoft IIS or Apache Web server.For installation or operational issues specific to either of these Web servers, please contact Microsoft or Apache directly for technical support.

Cannot obtain a URL list, because special characters exist in domain names.

When special characters are included in domain names, you may not be able to obtain a URL list for that particular domain name. Special characters include items such as a degree sign (°) and some country-specific characters such as an accent (Á).

Pop-up blocking is blocking certain Reporting features.If your Web browser has pop-up blocking at a very strict setting, it may block certain Reporting features or even use of some Reporting products.

Potential issues when generating Explorer reports.Some queries will take a very long time. You may see a blank screen or get a message saying that your query has timed out. This can happen for the following reasons

Web server (IIS or Apache) times out,MSDE or SQL Server times out, orProxy and Caching Server times out.

You may need to manually increase the time out limit for these components.If users are not in any group, they will not show up in a domain either. Both Group and Domain choices will be inactive.Even if the Log Server is logging visits instead of hits, Explorer will label log information as Hits.



Reporter troubleshooting

After exporting to Excel, some report data is missing.The Windows Event Viewer on Log Server machine shows an HTTP post failed message for WebCatcher with an Event ID 50x.Reporter closes or displays a Dr. Watson error after generating a report.Multiple reports contain identical information when they should not.Increasing Reporting speed in Reporter.

After exporting to Excel, some report data is missing.The largest number of rows that can be opened in any 1 Excel worksheet is 65,536. If you export a report with more than 65,536 records to Microsoft Excel format, the 65,537th and all following records will not be available in the worksheet.

To assure access to all information in the exported report, do 1 of the following:

change the Report Criteria to define a smaller report, perhaps by setting a shorter date range, selecting fewer users and groups, or selecting fewer dispositions.select a different export format.

The Windows Event Viewer on Log Server machine shows an HTTP post failed message for WebCatcher with an Event ID 50x.

Some early versions of Internet Explorer v5.0 do not support the HTTP post command, which is used to send WebCatcher information. If the HTTP post fails, Websense does not receive the Miscellaneous URLs and cannot categorize them in the Master Database.

To resolve this problem, upgrade the browser on the Log Server machine to Internet Explorer v5.5 or later.



Reporter closes or displays a Dr. Watson error after generating a report.

Reporter uses the Windows Print Preview feature to display reports onscreen. A supported print driver is required to be installed and set as the default printer on the Reporter machine.

Please visit our website to obtain a list of non-supported printer drivers.

Multiple reports contain identical information when they should not.

Sometimes if there is no printer driver installed on the machine, an initial report may display multiple times, even though you are expecting another report.

Check that you have a print driver installed on the Reporter machine and that it is 1 of the print drivers supported by your operating system. Check the settings for the printer and make sure it is the default printer for the Reporter machine. If using a network printer does not work, try installing a local printer.

Increasing Reporting speed in Reporter.In organizations that have a high volume of Internetaccess, when Microsoft SQL Server and Reporter reside on 2 separate machines, report generation speed can be slow. This is due to the amount of time it takes Reporter to search all data available in the Log Database and transfer that data from 1 machine to another.

Consider the following options to increase reporting speed:

Copy the ntwdblib.dll file included with SQL Server, and paste it into the Winnt\System32 directory on the machine running the Reporter application. (Be sure to leave a copy of the file where it originated on the SQL Server machine as well, or SQL Server becomes corrupted.)Then, set UsingMSDE=false in the wsreporter.ini file (in the directory where you installed Reporter).



These changes allow Reporter to connect directly to SQL Server, bypassing the ODBC connection, which makes communication faster.

Consider installing Reporter on the SQL Server machine, and running most reports from that machine, especially scheduled jobs. Running Reporter on the SQL Server machine eliminates delays caused by network interference.

NoteIf you encounter problems generating reports after making these changes, restore the wsreporter.ini file to set UsingMSDE=true.


APPENDIX A Configuring to Use Windows Trusted Connection

These Websense Reporting services/settings may have to be manually configured to run as the Windows Authenticated User.

Log Server Service setupReporter Scheduler Service setupExplorer Settings Page

When you want to run Explorer reports against a different Log Database, you make a change in the Explorer Settings Page

Log Server Service setup

Most Log Server setup is done via the Log Server Configuration. However, there are 2 situations when you would need to set up the Log Server service with a user name and password.

When Log Server is installed to use a trusted connection for database communications.When the Windows directory service is configured so that an application it perceives as anonymous, such as Log Server, cannot obtain a list of users and groups.

In these situations, Log Server must authenticate to either connect to SQL Server or obtain the user list from the directory service.

Set up Log Server with the appropriate authentication information as follows:

1. From the Windows Start menu, select Programs > Administrative Tools > Services.

2. Right-click Websense Log Server in the list, and then click Stop.3. Double-click the Websense Log Server service to open the Properties

dialog box.


Appendix A: Configuring to Use Windows Trusted Connection

4. Select This account in the Log On tab.5. In the text box, enter the user name for an account with appropriate access

rights to the Log Database on the SQL Server and the directory service. (Some environments require this to be entered as domain\user name. For example: Websense\jdoe.)

6. Enter and confirm the Windows password for this account.7. Click OK to close the Service dialog box.



8. Right-click Websense Log Server in the Services list, and then click Start.

Reporter Scheduler Service setup

Scheduling Reports to run is done via the Reporter window. However, when Reporter is installed using a trusted connection for database communications, you need to set up the Scheduler service with a user name and password.

Scheduler must authenticate to the Log Database.

Set up Scheduler with the appropriate authentication information as follows:

1. From the Windows Start menu, select: Programs > Administrative Tools > Services.

2. Right-click Websense Report Scheduler, and then click Stop.3. Double-click Websense Report Scheduler to open the Properties dialog

box.4. Select This account in the Log On tab.



5. In the text box, enter the user name for an account with appropriate access rights to the Log Database on the SQL Server. (Some environments require this to be entered as domain\user name. For example: Websense\jdoe.)

6. Enter and confirm the Windows password for this account.7. Click OK to close the Service dialog box.8. Right-click Websense Report Scheduler in the Services list, and then

click Start.

Explorer Settings Page

If you have chosen to install Explorer using a trusted connection, after installation you can run reports as that user, subject to the security restrictions placed on that Reporting role.

When you first open Explorer, you may see a message informing you that summary tables are not populated, and that, as the administrator, you can edit your Explorer settings. The page you access by clicking the link is also available on Explorer’s Main Page.

1. From the Windows Start menu, select Programs>Websense>Web Reporting Tools.

2. Log on to Websense Reporting Tools.3. When the Reporting Tools menu opens, click Websense Enterprise

Explorer. The Websense Enterprise Explorer Main Page appears.4. Click Settings to open the Explorer Settings page. 5. Choose the new method of database connection, based on your available

choices.



If Explorer is installed on a different machine than Log Server, your only option will be to make a custom selection.

Field Description

Server Enter the machine name (or IP address) where the Log Database is stored.

Database Enter the name of the Log Database.

User ID Enter the user ID to access the database. If you are not sure what to use here, enter sa which is the default user ID for MSDE and the default administrator ID in SQL Server.This release of Explorer does support Windows-based authentication (user IDs) to connect to the database. If you are using a trusted connection to access Explorer, leave the user and password fields blank so the Windows user will be used.

Password Enter the password to access the database.

View the catalog database

Check this option to view the catalog database. Explorer views the database where Log Server is sending current activity information.Leave this option unchecked to enter database information directly: Choose the database name and the machine name where the database is physically located.

Select default Explorer date range

Select the default date range to use when running Explorer reports.

Select the default detail report format

Choose Smart columns selection to default to a standard Report format.Choose Custom columns to customize your Report format and to choose from the available columns.

Select report type Choose to open reports to a Summary view or Detail view.

Available Columns Select the columns to be included in your Report format, if you chose to customize your Report format.



6. Click Save Settings to complete the database connection change.If you have entered valid information, a message displays, stating that you have successfully changed the database.If you have not entered valid information, a message displays that says it could not connect to a database.Make sure you entered a valid user ID and password, and correct machine and database names. Also check for a typing error.



7. Click Enterprise Explorer at the top left of the page to go back to the Reporting Tools portal.

Configuring the IIS Web Server

To configure the Internet Information Services (IIS) Web Server for trusted connections:

1. Launch Internet Information Services Manager. By default, the program is at: c:\WINNT\system32\inetsrv\inetmgr.exe .

2. In the navigation pane, select and open the folders in:Web Sites\Default Website\

3. Locate and right-click the Websense entry.4. Select Properties from the drop-down menu. The Properties dialog box

opens.5. Click Edit in the Anonymous Access and Authentication section of the

Directory Security tab.6. When the Authentication Methods dialog box opens, check the

Anonymous access box to enable this function, and then click Edit. The Anonymous User Account dialog box opens.

7. Enter an appropriate user name, or click Browse to select an appropriate user. This user name must be able to log on with trusted connection access.

8. Enter the password for the user name you identify in the Password field, if IIS is not set to control the password.

9. Click OK to close the Anonymous User Account dialog box.10. Click OK to close the Authentication Methods dialog box.11. Click OK to close the Websense Properties dialog box.12. Close Internet Information Services Manager.


APPENDIX B User Settings

The administrator designates user settings in Settings on the Reporting Tools Portal, including the SMTP server (email server), to be used by users to email reports and job notifications.

User Settings are accessed via Settings on the Reporting Tools Portal page.

NoteMake sure your email system administrator has set a large enough email size limit. Otherwise, some large reports may not be delivered properly via email.


Appendix B: User Settings

1. Open the Reporting Tools portal, and then click Settings in the top right hand corner. The User Input dialog box appears.

2. The User Name is displayed.3. Enter the Email Address from which email notifications are to be sent.4. Enter the SMTP Server Name that will be used to email reports and job

notifications.5. The Inactivity timeout in minutes field has a default time out of 20

minutes for an inactive session and can be edited as needed.6. The Number of failed logins before lockout field has a default of 10

failed login attempts before an unauthorized user is locked out of the login screen and can be edited as needed.

7. The Lockout time interval field has been set to 20 minutes and can be edited as needed.

8. Check Self Reporting to allow users to self report in Websense Enterprise Explorer.

9. Click Save to update the User Settings.


APPENDIX C Migrating a Database

There is no migration path from previous database schemas to the new v6.3.x database schema. However, the Migrate Utility will be available for Reporter so that the v5.5.x database schema can be migrated to the v6.2 database schema.

The Migrate Utility resides on the Log Server machine. It converts log information from Websense Reporter v5.5.x (wslogdb55x.mdf) into a format compatible with Websense Enterprise Reporter v6.2. Once the information has been migrated to v6.2, Reporter v6.3.x can use it to generate reports. Explorer users can connect to the old database schema to run reports on older data in the v6.1.x and v6.2 databases.

When Migrate Utility controls are available

When connected to a v5.5.x database: Migrate is available, but Data Utilities are not available.When connected to a v6.1.x database: Migrate is not available, but the Data Utilities are available.When connected to a v6.3.x database: Migrate and Data Utilities are not available.

NoteDo not log to a migrated database. The migrated database will only be available for reporting purposes.


Appendix C: Migrating a Database

Migrating a v5.5.x database

1. Back up the existing database. For assistance, see the MSDE 2000 or SQL Server 2000/2005 documentation.

2. Disable consolidation on the Consolidation tab in the Log Server Configuration window, if it is enabled.

3. From the Windows Start menu, select Programs > Websense > Utilities > Migrate Utility to open the Websense Migrate window.

4. Click Connect. The Select Data Source dialog box appears.5. Select the Machine Data Source tab, and then select the Data Source

Name (ODBC connection) for the database you want to migrate. In most cases, the Data Source Name matches the name of the database, for example, wslogdb_55.

6. Click OK. An SQL Server logon dialog box appears.7. Generally, the Use Trusted Connection option is checked. For most,

organizations, you will need to uncheck the box, and then enter the logon ID and password used during Log Server installation.

8. Click Migrate.9. (SQL Server 2000/2005 users only) Enter a location for the new database

in the dialog box that asks for Database Path. This must be a complete path, starting with a local drive letter, and the path must already exist on the SQL Server machine. It cannot be a Network drive.

10. View the messages that appear in the Status area as the Migrate Utility converts the existing log information into a format compatible with Reporting 6.2, and stores the information in a new database.The new database name includes the old database name, and the date and time of migration (for example: wslogdb_61may082006).

11. Run Summarization: Runs summarization queries on the newly-migrated database.

12. When you finish working in the Migrate window, click x in the upper right corner to close the window.


APPENDIX D Maintaining the Database

Aside from the tasks that need to be set while Administering the Database, you can have a more effective database if you properly maintain Index fragmentation and Summary statistics.

This section presents a set of recommendations for your administrator that will help improve the performance of Websense Enterprise Explorer.

Index fragmentation

Queries that selectively extract information from a database table are most affected by index fragmentation. Indexes are used by the database server to return the results of queries more efficiently. Each element in the index contains a pointer to the location in the data file where the associated record is stored. When properly designed and maintained, the database server can use the index to quickly search for the desired record(s) without the need of an exhaustive scan of the entire data table.

However, indexes are much less effective when they become fragmented. Index fragmentation exists when the logical ordering of the index elements are different from the physical ordering of the records in the data file. The database server is then required to examine many more possibilities to find the desired record(s) and do much more internal work in retrieving the data.

Fragmented indexes are a natural development in tables where new records are inserted and data values are frequently changed in indexed columns. Therefore, a database maintenance plan that routinely examines the level of index fragmentation and takes the appropriate steps to reduce significant fragmentation is particularly important.

IMPORTANTBe sure to back up your database before running any of these procedures.

Define Book Name Variable 101

:

Diagnosing index fragmentation issuesYour database server should provide a utility with which to examine the fragmentation level of the indexes. For SQL Server 2000/2005, this is the DBCC SHOWCONTIG command. For other database platforms, see the server documentation.

If your Websense Enterprise Reporting Services v6.3.x database is hosted on SQL Server 2000/2005, the DBA responsible could run the following command from Query Analyzer, replacing <tablename> with the name of the table being examined:

DBCC SHOWCONTIG (<tablename>) WITH ALL_INDEXES, ALL_LEVELS

MetricsA set of metrics is returned for each index on the specified table. The most important metrics returned from SQL Server’s DBCC SHOWCONTIG, for purposes of diagnosing fragmentation that could impact performance, are:

Logical scan fragmentation: The percentage of out-of-order pages when scanning an index should ideally be at 0%.Scan density: The percentage of time that an index scan can read contiguously without a jump should ideally be at 100%.Average page density: Indicates how much jumping around is required to read ordered records, which should ideally be at 100% or the FILLFACTOR specified when the index was created.Extent scan fragmentation: Percentage of out-of-order extents (in SQL Server an extent is a space allocation unit of 8 pages, each of 8K bytes), which should ideally be at 0%.

While the results must be considered in context of your particular needs and configuration, Logical Scan Fragmentation, makes a reasonably good litmus test for Explorer when determining whether or not index fragmentation is having an impact on performance.

102 Define Product Name Variable

:

Fixing index fragmentation issues

If logical scan fragmentation is between 20% and 40%.If logical scan fragmentation is below 20%, then its impact on performance is probably low. However, if logical scan fragmentation is between 20% and 40%, a moderate amount of fragmentation of the index exists and the DBA responsible should consider running the online defragmentation procedure appropriate to your particular database platform.

For SQL Server 2000/2005, this is the DBCC INDEXDEFRAG command. Depending on the load on the table during the process, this will provide a moderate level of reduction in leaf-level fragmentation while not locking out other processes. However, this process does not address extent fragmentation.

To do this on SQL Server 2000/2005, run the following command from Query Analyzer:

DBCC INDEXDEFRAG (<databasename>, <tablename>, <indexname>)Replacing the following to complete the command:

<databasename> with the name of the database<tablename> with the name of the table<indexname> with the name of the index

If logical scan fragmentation is greater than 40% or extent scan fragmentation is over 40%.

If logical scan fragmentation is greater than 40% or extent scan fragmentation is over 40%, then severe index fragmentation exists and the impact to performance of Explorer is high. In these cases, you may want to consider an offline process to rebuild the affected indexes.

In SQL Server 2000/2005, one approach to this is to run the DBCC DBREINDEX command.This is an offline process, which requires locking out any other processes from using the table while it is running.

To rebuild all indexes on a table, run the following command, replacing <tablename> with the name of the table:

DBCC DBREINDEX (<tablename>)


:

Summary statistics

The database server uses summary statistics about the content and distribution of values in the indexes to help optimize queries. If these statistics are out-of-date and no longer accurately reflect the current state of the associated index, then the performance of queries can suffer.

Diagnosing statistics issuesMost database server software feature some tool with which to get the current status of statistics. In SQL Server 2000, this is the DBCC SHOW_STATISTICS command.

Run the following command:

DBCC SHOW_STATISTICS (<tablename>, <indexname>)Replacing the following to complete the command:

<tablename> with the name of the table<indexname> with the name of the index

The piece of information in the output of this command that is of primary interest to determine if stale statistics are potentially impacting performance is the Updated column in the first block of results. This is the date at which the statistics were last updated.

Fixing statistics issuesInterpretation of this result depends heavily on your particular circumstances. In high volume installations, statistics that are more than a few days old could be harmful to the database server’s ability to pick an optimal execution plan.

If the statistics have not been updated recently, you should execute the particular database’s functionality for updating/refreshing the statistics. In SQL Server 2000, this is the UPDATE STATISTICS command.

Run the following command from Query Analyzer, replacing <tablename> with the name of the table:

UPDATE STATISTICS <tablename>

Most database servers have a setting for whether or not the server should update the statistics for a given database. This ensures that the statistics are recalculated from time to time, based on a sampling of the current state of the


:

data. However, many DBAs turn this setting off, because it does cause a small, but definite, increase in overhead on the server. If stale statistics are a repeated problem on your server, you may want to consider enabling this feature.

To determine if automatic update of statistics is turned on for a given database in SQL Server 2000/2005, run the following command, replacing <databasename> with the name of the database:

SELECT DATABASEPROPERTYEX(‘<databasename>’, ‘IsAutoUpdateStatistics’)

If the feature is turned on, a value of 1 is returned.

To turn on the automatic update of statistics for a database in SQL Server 2000/2005, run the following the command, replacing <databasename> with the name of the database:

ALTER DATABASE <databasename> SET AUTO_UPDATE_STATISTICS ON


:


Index

Aaccessing

database, 59Database Administration, 70Explorer, 25Real-Time Analyzer, 34Reporter, 31role-based, reporting, 13, 26, 28, 29

activitydatabase

error log, 77administering

database, 71Authentication Dialog box, 55

Bbatches

unprocessed, 75

CCatalog Database, 10, 11changing

configuration settings via the .INI file, 57configuration settings via the wse.ini file, 57

componentsdatabase, 10

database partitions, 11Database Administration, 10Explorer, 10Filtering Service, 8Integration Partner product, 9Log database

Catalog Database, 11extract, transform, Load (ETL)

process, 11

Log Server, 10Network Agent, 9Policy Server, 8User Service, 8Websense Master Database, 9

configuringIIS Web Server, 95Internet Browse Time, 72Log Server, 41

authentication, 55connection, 42consolidation, 48database, 44stop and start, 56WebCatcher, 51

maintenance, 74Real-Time Analyzer, 36, 38Real-Time Analyzer display, 37settings

.ini file, 57creating

database partitions, 76new database connection

Reporter, 63customer support, 22

Ddatabase, 10, 11

access, 59accessing administration, 70administration, 71configure

Internet Browse Time, 72connection to Reporter, 61create new connection for Reporter, 63delete partitions, 74


Index

deleting error log, 75diagnosing statistics issues, 104error log

activity, 77deleting, 75

extract, transform, Load (ETL) process, 11fixing statistics issues, 104Log Server

configuration, 44maintenance

diagnosing index fragmentation issues, 102

diagnosing statistics issues, 104fixing index fragmentation issues, 103fixing statistics issues, 104index fragmentation, 101statistics, 104tests and tasks, 101

maintenance configuration, 74metrics, 102migrating v5..5.x to v6.2, 99, 100partitions, 69

automatic reindexing, 74creating, 76maintain, 71remove, 77reporting, 69

rollover options, 72settings page, 92size, 80summary statistics, 104unprocessed batches, 75

Database Administration, 10database partitions, 11database settings page, 92Delegated Reporting, 13, 14deleting

error log, 75diagnosing

index fragmentation issues, 102statistics issues, 104

displayconfiguring for RTA, 37options, 57

Eerror log

database activity, 77ETL process, 11Explorer

components, 10connection to a database, 59display options, 57laptop users, 29main page, 15

view database, 15managing access, 25remote users, 28self-reporting, 26Settings page, 92tools page, 25, 27troubleshooting, 83

create a new Catalog Database, 83VPN connections, 28web server, 28

FFiltering Service, 8fixing

index fragmentation issues, 103statistics issues, 104

Ggeneral

troubleshooting issues, 79

Iidentifying

remote users, 28indexes

diagnosing fragmentation issues, 102fixing fragmentation issues, 103fragmentation, 101

fixing, 103maintaining database, 101, 102, 103

INI file, 57configuration settings, 57

Integration Partner product, 9


Index

Internet Browse Timeconfigure, 72

internet browsers supported, 33

Llaptop users, 29Log Server, 10

authentication, 55configuration, 41connection, 42consolidation, 48database configuration, 44managing, 41service setup, 89settings, 45start and stop, 56WebCatcher, 51

Mmain page

Explorer, 15maintaining

databasefixing index fragmentation issues, 103fixing statistics issues, 104index fragmentation, 101index fragmentation issues, 102statistics, 104statistics issues, 104tests and tasks, 101

database partitions, 71maintenance

configuration, 74delete database partitions, 74partitions

automatic reindexing, 74managing

Log Server, 41authentication, 55connection, 42consolidation, 48database connection, 44settings, 45start and stop, 56

WebCatcher, 51metrics

database, 102Migrate Utility

controls, 99migrating

a v5.5.x database to v6.2, 99, 100

NNetwork Agent, 9

Ppartitions, 69

create, 76delete, 74maintain, 71remove, 77

Policy Server, 8pop-up blocking, 85potential issues

when generating Explorer reports, 85

RReal-Time Analyzer

about, 20starting, 34system requirements, 33

reindexingdatabase partitions, 74

related documentation, 21remote users, 28removing

database partitions, 77Reporter

access, 31application window, 18connection to a database, 61create new database connection, 63display reports, 20run reports, 19Scheduler service setup, 91troubleshooting, 86

reporting


Index

database partitions, 69Delegated Reporting, 13, 14Explorer

laptop users, 29remote users, 28self, 26VPN connections, 28

selective, 69tools page, 25

role-based reporting, 14roles

access to reporting, 13, 26, 28, 29rollover

database options, 72

SScheduler

Reporter service setup, 91Selective Reporting, 69self-reporting

Explorer, 26services

Log Server setup, 89Reporter Scheduler setup, 91

setting upLog Server service, 89

settingsdatabase page, 92failed logins, 97inactivity timeout, 97Log Server

connection, 45self-reporting, 97user

SMTP mail server, 97settings page

database, 92starting

Log Server, 56Real-Time Analyzer, 34

statisticsdiagnosing statistics issues, 104fixing statistics issues, 104maintaining database, 104

stoppingLog Server, 56

summary statistics, 104system requirements

Real-Time Analyzer, 33system settings, configuring Real-Time

Analyzer, 38

Ttechnical support, 22tools page, 25, 27

Explorer, 27troubleshooting, 79

Explorer, 83create new Catalog Database, 83

general, 79Reporter, 86

Uunderstanding

Websense Enterprise Reporting, 8User Service, 8user settings, 97users

identifying remote users, 28

VVirtual Private Network (VPN)

connections, 28

Wweb server, 33

Explorer, 28WebCatcher

Log Server configuration, 51Websense Enterprise components

Filtering Service, 8Integration Partner product, 9Network Agent, 9Policy Server, 8User Service, 8Websense Master Database, 9

Websense Enterprise Reporting components


Index

Database Administration, 10Explorer, 10Log Database, 10, 11

Log Server, 10Websense Master Database, 9


Index


REPORTING ADMINISTRATOR S UIDEkb.websense.com/pf/12/webfiles/WBSN Documentation... · Reporting...

Documents

Transcript of REPORTING ADMINISTRATOR S UIDEkb.websense.com/pf/12/webfiles/WBSN Documentation... · Reporting...