Monitoring Forefront TMG Using the Logging Feature

One of the most powerful troubleshooting tools at the disposal of SharePoint and Forefront TMG administrators is the logging mechanism, which gives live or archived views of the logs on a Forefront TMG computer and allows for quick and easy searching and indexing of Forefront TMG log information, including every packet of data that hits the Forefront TMG computer.

The Forefront TMG logs are accessible via the Logging tab in the details pane of the Logs and Reports node, as shown in Figure 14.8. They enable administrators to watch, in real time, what is happening to the Forefront TMG server, whether it is denying connections, for example, and what rule is being applied for each allow or deny statement.

Figure 14.8. Examining Forefront TMG logging.

The logs include pertinent information on each packet of data, including the following key characteristics:

• Log Time— The exact time the packet was processed.

• Destination IP— The destination IP address of the packet.

• Destination Port— The destination TCP/IP port, such as port 80 for HTTP traffic.

• Protocol— The specific protocol that the packet utilized, such as HTTP, LDAP, RPC, or others.

• Action— What type of action the Forefront Edge line took on the traffic, such as initiating the connection or denying it.

• Rule— Which particular firewall policy rule applied to the traffic.

• Client IP— The IP address of the client that sent the packet.

• Client Username— The username of the requesting client. Note that this is populated only if using the firewall client.

• Source Network— The source network that the packet came from.

• Destination Network— The network where the destination of the packet is located.

• HTTP Method— This column displays the type of HTTP method used, such as GET or POST.

• URL— If HTTP is used, this column will display the exact URL that was requested.

By searching through the logs for specific criteria in these columns, such as all packets sent by a specific IP address, or all URLs that match http://home.companyabc.com, advanced troubleshooting and monitoring is simplified.