Description

The following configuration is needed after configuring web filtering (enhanced/surf control/local webfiltering)


Symptoms

How to view webfiltering logs in in a syslog file

Solution


To configure a syslog file and view web filtering logs

The following procedure outlines the creation of a syslog file to capture web filtering logs. The match statement of "WEBFILTER_" is used to capture all web filtering logs.

[edit]

root@SRX # set system syslog file webfilter-log match WEBFILTER_ any any

The following output displays the log file. The default action was set to 'permit-and-log'. This is why permitted URLs are shown in the log file. 

Oct 25 16:08:54  rng-aa RT_UTM: WEBFILTER_URL_PERMITTED: WebFilter: ACTION="URL Permitted" 10.252.2.11(50222)->77.67.126.10(80) CATEGORY="N/A" REASON="BY_OTHER" PROFILE="junos-wf-enhanced-default" URL=a2.espncdn.com OBJ=/prod/assets/header_sprite_fp.v4.png USERNAME=N/A ROLES=N/A


To view only the blocked URLs, run the same command but match on URL_BLOCKED. This displays only the web filtering URL blocked log events. The log file configuration could also be modified to match 'WEBFILTER_URL_BLOCKED'. This would write only these types of events to the log file. 

Oct 25 16:08:54  rng-aa RT_UTM: WEBFILTER_URL_BLOCKED: WebFilter: ACTION="URL Blocked" 10.252.2.11(50227)->74.125.239.155(80) CATEGORY="Enhanced_Advertisements" REASON="BY_PRE_DEFINED" PROFILE="junos-wf-enhanced-default" URL=ad.doubleclick.net OBJ=/adj/espn.us.com.espn/espnfrontpage;pgtyp=espnfrontpage;sp=espn;ref=other;mnr=f;pos=incontent;swid=20b69aac-7584-4e46-b1a6-880a71f319ab;dcopt=ist;sz=300x600,300x250,1x1;tile=3;ord=3800646760 USERNAME=N/A ROLES=N/A