Analyzing ISA Server Performance using ISA Server Reporting

Understanding the ISA Server Reporting Feature

ISA Server includes a reporting feature that you can use for a number of purposes:

Use reports to obtain and view information on usage statistics of the server for both computers and client users.
Create your own reports.

Each report here consists of a number of sub-reports, taking the form of charts and graphs. This concept is illustrated on the 2nd page of the Article:

The predefined ISA Server reports are listed here:

Summary reports: These reports combine data from the Firewall service log and Web proxy service log, to show network traffic usage. Summary reports are sorted by application and are especially useful when you need to manage Internet connectivity, or determine trends traffic patterns.
Web Usage reports: These reports show information on how the Web is being used, and detail information on:
- Top Web users
- Common responses
- Browsers in use

Web Usage reports use information in the Web Proxy service logs.

Application usage reports: These reports show Internet application usage, and contains information on:
- Amount of incoming traffic
- Amount of outgoing traffic
- Top users
- Client applications
- Destinations

You should use application usage reports to determine usage of published servers on the internal network, and to determine network saturation situations.

Traffic and utilization reports: These reports combine data from the Web Proxy logs and Firewall service logs to provide information on:
- Internet usage by application
- Internet usage by protocol.
- Internet usage by direction.
- Average peaks
- Peak simultaneous connections
- Cache hit ratio
- Errors
- Statistics

Traffic and utilization reports can assist you with determining trends in usage, planning network capacity, monitoring network capacity, and determining bandwidth policies.

Security reports: These reports combine data from the Web Proxy service logs, Firewall service logs and Packet Filter logs. You can use the information in security reports to:
- Monitor for attempts to breach network security.
- Monitor for security violations.
- Monitor for network attacks.

To view reports:

Open ISA Management.
Expand the Monitoring Configuration node.
Expand the Reports node.
Select the report type which you want to view
Double-click the report in the details pane

Each report here consists of a number of sub-reports, taking the form of charts and graphs:

Summary report: Consists of the following sub-reports:
- Summary Protocols used in descending order
- Traffic by protocol
- Top users
- Traffic by user
- Top Web sites
- Traffic by Web sites
- Cache performance
- Cache usage breakdown
- Traffic
- Traffic by date
- Daily traffic
- Traffic by time of day
Web Usage reports: Consists of the following sub-reports:
- Top Web users
- Web traffic by users
- Top Web sites
- Traffic by Web sites
- Prtocols
- Web traffic by protocols
- HTTP responses
- HTTP response breakdown
- Object types
- Web traffic by object types
- Top browsers
- Web traffic by browser
- Operating system
- Web traffic by operating system
- Browser vs operating system
Application usage reports: Consists of the following sub-reports:
- Protocols
- Application traffic by protocols
- Top application users
- Application traffic by users
- Top applications
- Traffic by application
- Operating systems
- Web traffic by operating system
- Top destination
- Traffic by destination
Traffic and utilization reports: Consists of the following sub-reports:
- Protocols
- Traffic by protocols
- Traffic
- Traffic by date
- Cache performance
- Cache usage breakdown
- Connections
- Peak simultaneous connections by date
- Processing time
- Processing time by date
- Daily traffic
- Traffic by time of day
- Errors
- Error breakdown
Security reports: Consists of the following sub-reports:
- Authorization failures
- Authorization failures by user
- Dropped packets
- Dropped packets by users

ISA Server reporting works by combining all summary logs from each ISA Server computer in the array in a single report database on each ISA server. The report database is stored in the location that you indicate when you create the specific report job. Report databases are by default stored in the ISAReports folder of the ISA installation folder.

The ISA Server reporting feature allows you to schedule reports to be generated at specific times:

Daily
Weekly
Monthly
Yearly
After data has been collected for a predefined time period.

To configure report jobs, you specify the following:

Time period that data must be collected from the ISA log files.
Schedule when the report will be generated – this is based on the time period for which data must be collected from the log files.

For each report job, the user name and password that you configure must have sufficient privileges to generate the reports on the ISA server. The user name and password credentials provided must have the following permissions:

Must be a member of the Domain Admins group. Members of this group have rights to generate reports on the ISA server.
Must have local administrator rights on each ISA Server computer in the array.
Must have rights to access DCOM objects on each ISA Server computer in the array.

How to sort report data

Open ISA Management.
Expand the Monitoring Configuration node.
Expand the Reports folder.
Right-click the report type and select Properties from the shortcut menu.
In the Sort Order area select which option to use to sort report data.
Click OK.

How to create a report job

Open ISA Management.
Expand the Monitoring Configuration node.
Right-click the Report Jobs folder and select New and then Report Job from the shortcut menu.
On the General tab, enter a name for the new report job in the Name textbox.
Enter a description for the report job in the Description textbox.
Ensure that the Enable Reports checkbox is enabled.
Click the Period tab.
Specify when summary reports are generated

- Daily
- Weekly
- Monthly
- Yearly
- Custom

If you select the Custom option, then specify the From date and the To date.
Click the Schedule tab.
Set whether the report should be generated immediately, or at a later date.
Specify the recurrence pattern.
Click the Credentials tab. Provide the information on who is authorized to create reports on the ISA server(s):

- User name
- Domain
- Password

Click OK.

How to configure the log summary

Open ISA Management.
Expand the Monitoring Configuration node.
Right-click the Report Jobs folder and select Properties from the shortcut menu.
Click the Log Summaries tab.
Check the Enable Daily and Monthly Summaries checkbox.
In the Number Of Summaries Saved area of the Log Summaries tab, specify how many daily summaries should be saved. This is done in the Daily Summaries textbox.
In the Monthly Summaries textbox, enter how many monthly summaries should be saved.
Click OK.

How to configure the location of reports

Open ISA Management.
Expand the Monitoring Configuration node.
Right-click the Report Jobs folder and select Properties from the shortcut menu.
Verify that the Enable Reports checkbox is selected.
If you want reports stored in the ISA Reports subfolder within the ISA Server installation folder, then select the ISAReports Folder (In The ISA Server Installation Folder) option. This is the default option.
If you want reports saved in a different location, then select the Other Folder option. Enter the location where reports should be stored.
Click OK.

How to configure the location of the daily summary database

Open ISA Management.
Expand the Monitoring Configuration node.
Right-click the Report Jobs folder and select Properties from the shortcut menu.
Click the Log Summaries tab.
Check the Enable Daily And Monthly Summaries checkbox.
If you want reports stored in the ISA Summaries subfolder within the ISA Server installation folder, then select the ISASummaries Folder (In The ISA Server Installation Folder) option. This is the default option.
If you want reports saved in a different location, then select the Other Folder option. Enter the location where reports should be stored.
Click OK.

How to modify the period for a report job

Open ISA Management.
Expand the Monitoring Configuration node.
Select the Report Jobs folder.
Right-click the specific report job that you want to configure and select Properties from the shortcut menu.
Click the Period tab.
If you want the report generated to show the state of the previous day, then choose the Daily option.
If you want the report generated to show the state of the previous week, then choose the Weekly option.
If you want the report generated to show the activity of the previous month, then choose the Monthly option.
If you want the report generated to show the activity of the previous year, the choose the Yearly option.
If you want to define your own time period, then select Custom option.
In the From textbox and To textbox, define the time period to use in the report job.
Click OK.

How to modify the schedule for a report job

Open ISA Management.
Expand the Monitoring Configuration node.
Select the Report Jobs folder.
Right-click the specific report job that you want to configure and select Properties from the shortcut menu.
Click the Schedule tab.
In the Start Report Generation section of the Schedule tab, choose when the report should be generated:

- If you want to generate the report immediately, then select the Immediately option.
- If you want to generate the report at a specific time, then select the At option. Enter the date and time that the report should be generated.

In the Recurrence Pattern section of the Schedule tab, you can modify the recurrence pattern for the report job.

- If you want the report generated only once, then select the Generate Once option.
- If you want the report generated each day, then select the Generate Every Day option.
- If you want the report generated on a specific day or days, then select the Generate On The Following Days option. Select which day(s) the report should be generated:

- - Monday checkbox
  - Tuesday checkbox
  - Wednesday checkbox
  - Thursday checkbox
  - Friday checkbox
  - Saturday checkbox
  - Sunday checkbox

- If you want the report generated once a month only, then select the Generate Once A Month option. Specify which day of the month the report should be generated.

Click OK.

How to configure credentials for a report job

Open ISA Management.
Expand the Monitoring Configuration node.
Select the Report Jobs folder.
Right-click the specific report job that you want to configure and select Properties from the shortcut menu.
Click the Credentials tab.
Provide the name of the user that has sufficient authority to generate reports in the Username textbox.
Provide the domain for this user account in the Domain textbox.
Enter the password of the user account in the Password textbox.
Click OK.