By default, Forefront TMG creates log files in it’s own local SQL Express instance. The instance name is MSFW. New databases are created each day, and there is a log table for Firewall and another for Web Proxy data. You can import this log database using the ‘Database Connection’ option in WebSpy Vantage, however, you need to first enable network access and permissions to the databases.

To do this, please see our detailed article: Accessing Microsoft Forefront TMG’s Log Files (SQL Express).

Although not recommended, you can avoid opening the SQL Express logs to network access by installing Vantage on your Forefront TMG Server, and running reports in off-peak times. See our article on how to do this here.

Logging to a remote SQL Server enables you to centralize all your Forefront TMG log files, and has some other great advantages for enterprises. You can import these logs using the ‘Database Connection’ option in WebSpy Vantage and you can select whether to connect with Windows Authentication or SQL Authentication.

If using Windows Authentication, make sure the User Account running WebSpy Vantage has db_reader permission on the SQL databases and tables.

Logging to File (Text log) is by far the easiest method of accessing your log files with WebSpy Vantage. We recommend you use the W3C format due to the standards compliant log structure, however, the native .iis format is supported as well. Simply share the folder that your log files are stored in, and use the ‘Local Networked Files or Folders’ option when importing the logs in WebSpy Vantage.

• Storage Name: Enter anything you like such as ‘TMG Web Proxy Logs’
• Input Type Page: Select Database connection
• Loader Selection: Select Microsoft FTMG
• Input Selection: Click Add and select/enter the following:
  • MS SQL
  • Server: Enter the Forefront TMG’s server name  followed by \MSFW. For example 10.0.0.10\MSFW. If Vantage is installed on your TMG Server, you can enter .\MSFW (‘.’ means localhost)
  • Port: 1433
  • Database Filter: Enter a database filter of *WEB* to only import the web proxy databases, or leave it set to * to import everything including the Firewall databases.
  • Table Filter: Leave this set to * to import all tables in the Databases.

For more information see Accessing Microsoft Forefront TMG Log Files (SQL Express)

• Storage Name: Enter anything you like such as ‘TMG Web Proxy Logs’
• Input Type Page: Select Database connection
• Loader Selection: Select Microsoft FTMG
• Input Selection: Click Add and select/enter the following:
  • MS SQL
  • Server: Enter the name or IP address of your SQL Server. For example 10.0.0.10.
  • Port: 1433
  • Database Filter: Enter the database name, or a suitable database search string (such as *LogDB*) to select the databases that contains the TMG log tables.
  • Table Filter: Enter the table name or a suitable search string (such as *WebProxy*), where your TMG logs are being written to. Leave it as * to import all tables in the database.

Click OK and you should see a list of the databases and tables appear in the Import Wizard. Click OK again on the Import Wizard to start importing.

• Storage Name: Enter anything you like such as ‘TMG Web Proxy Logs’
• Input Type Page: Select Local Networked Files or Folders
• Loader Selection: Select Microsoft FTMG
• Input Selection: Click Add | Folder and select/enter the following:
  • Folder: Browse to the folder containing your Forefront TMG log files. Make sure you specify a UNC path such as \\servername\logs rather than a mapped network drive (Vantage cannot import from mapped drives when logged off)
  • File Mask: Leave this set to * to import all logs, or enter a suitable search string such as *WEB* to only import web proxy logs, or *FWS* to only import Firewall logs.
  • Timezone Offset: Forefront TMG logs in GMT time. Make sure you specify a timezone offset so that your reports show activity in your local timezone rather than in GMT.
  • Leave all other options as default

Click OK and you should see a list of TMG log files appear in the Import Wizard. Click OKagain on the Import Wizard to start importing.

On the Directory Server page, select your directory type and server, along with a username (in domain\username format) and password to authenticate with your directory server, and click Test. Click Next after you have successfully connected to your directory server.

Select a Root Distinguished Name to search for users within (for example, ‘dc=mydomain, dc=com’) from the dropdown list. If your users are contained within a specific OU, select the ‘…‘ button to select the OU in your directory.

The LDAP search query defaults to a query that returns ‘user accounts’. It’s important to note that WebSpy Vantage’s licensing is based on ‘number of users’, so if necessary, use the Quick Queries drop-down to change the LDAP search query and import a more specific set of user accounts, such as enabled users with an email address. WebSpy Vantage will import all users up to the license limit, which is unlimited during your trial. Click Next.

The User Details page defines how Vantage maps user objects in your Directory to authenticated usernames in your log files, as well as configuring user login names for the Web Module, the email address to send report notifications to, and the attribute to use to find a user’s manager.

If you are using Active Directory, you choose Use Active Directory Defaults. WebSpy Vantage will attempt to detect the name of your domain, and prefix this to all account names so that your authenticated usernames logged by Microsoft Forefront TMG are correctly aliased to a user object in Active Directory.

If your domain prefix on user accounts is different to your computer network’s domain name, click Custom, then check the Prefix checkbox and enter the required domain prefix.

The Grouping page enables you to configure how you would like users grouped, such as by Departments, Offices, OUs etc. User Objects in Active Directory have a number of attributes, including department, office, description, company, and you can also place user objects in OU containers, and configure attributes on those containers. WebSpy Vantage can hook into any of these attributes to group your users for the purpose of reporting.

By default, there are two groups specified: Offices (using the ‘physicalDeliveryOfficeName’ attribute in Active Directory) and Departments (using the ‘department’ attribute in Active Directory).

If a user does not have one of these values populated in Active Directory, then they will be imported into the ‘Unknown’ department and office respectively. Alternatively, you can uncheck the Import Ungrouped Users option at the bottom of the Grouping page.

You can edit or delete these groups as necessary.

When adding or editing a group:

1. First, enter the name of the Group into the Name field. This is up to you and should represent what the group is, such as ‘Departments’, ‘Locations’, ‘Business Centers’ etc. (Note, there are a few default Report Templates that use ‘Departments’ so use the word ‘Departments’ in one of your grouping levels utilize these reports).
2. Enter the exact name of the attribute into the Attribute field. For example, enter ‘physicalDeliveryOfficeName’ to import the Office attribute from Active Directory. To import the name of an OU, use the attribute ‘OU’.
   

   By default, Active Directory Users and Computers hides the real attribute names. You can change this by selecting View | Advanced Features to show the Attribute Editor with real attribute names when editing a User or OU.

3. Relative to user:
   Use this option if the attribute is located on the user object itself or on one of its parent OU containers. For example, if you are using the ‘Department’ attribute on the user objects, then select Relative to user and select User node. Or if your users are in a consistent OU structure, specify either Parent of the user node, or Node ‘n’ levels above to access the attribute on the appropriate parent OU container.
4. Relative to root:
   Use this option to select OUs relative to the Root Distinguished Name that you specified on the Directory Server page. For example, if you have defined OUs for all your Offices directly underneath your Root DN, with user objects located anywhere underneath those OUs, then use the Immediate children of Root option, or the Children ‘n’ levels below Root option. For inconsistent OU structures, you can use the Single group from Root node option, and use the Import Organization wizard multiple times (usually configured with multiple task actions within a Task) with the Merge options set appropriately, to create groups from multiple Root DNs in your directory.
5. Click OK to add your Grouping level.

Tip: Later, you’ll need to configure Web Module access permissions for people and/or groups. To create a default set of permissions that apply to your entire organization, create a top-level group using an attribute that everyone is a member of. For example, call the group ‘Domain’ and use the attribute ‘dc’.

Once you have specified all the Groups you would like to use in your reporting process, click Next.

The Merging page enables you to use the Import Organization wizard multiple times, and merge the results into your existing Organization structure. For example, first import your Organization from one domain (or one Root DN on your domain), with the Overwrite existing organization tree option set to create an initial Organization tree, then run the Import Organization wizard again to import your Organization from another domain (or a different Root DN on your domain) and merge the results into your existing Organization tree.

The Merge options enable to you to keep or remove users that can no longer be found in the directory, as well as keep or update existing user’s details. Use the ‘keep users / keep details’ options if importing from a different domain or root DN.

Note: When merging, only users that have previously been added from your LDAP/LDIF directory will be affected. Users that have been manually added will not be affected.

1. Go to the Reports tab and select one of the availalbe Report Template and click the Generate Report option to launch the Generate Report Wizard.
2. On the Storages page, select the Storage you want to report on.
3. On the Format page, select the type of document you want to create the report as (HTML, Word, PDF, CVS, Text).
4. On the Publish page, you can customize the name of the report, prefix the name with today’s date, copy the report to a location and compress it using zip (useful when emailing the ‘HTML, Loose Files’ Report Format to someone as an attachment).
5. On the Documents page, you can choose to split your report into multiple documents based on anything in your log files, and/or aliases you have created such as Categories, Departments, Subnets, and so on. Leave this option unchecked to create a single report document.
6. On the Filters page, click Add | Date Filter and select the dates you want to report on. You can also include/exclude any values from your log files using Add | Field Value Filter.
7. The Email page enables you to email the report to someone as an attachment (Set your SMTP options in Tools | Options | Email).
8. Once the report has been generated, it will appear in the Report Manager at the bottom of the screen. Double-click the file to open and view the report.

1. Go to the Reports tab and select an available Report Template and click the Publish Report option to launch the Publish Report to Web Module wizard.
2. On the Storages page, select the Storage you want to report on.
3. On the Template page, select the Report Template that you want to generate (the template selected in step 1 will be automatically selected)
4. On the Publish page, select the Web Module you want to publish the report to. If you would like the option to drill down past the bounds of the report when viewing the report in the Web Module, check the Publish the selected storages to enable the ‘further analysis feature’ option.
5. On the Split and Permit page, select No Separation to create just a single report, and select Everyone as the permission. Splitting reports by groups or managers and giving permission to certain people requires first importing your Organization information from LDAP on the Organization tab. See below.
6. On the Filters page, click Add | Date Filter and select the dates you want to report on.
7. The Notification page can be used to send a notification email to everyone with permission to the report(s). For now, leave the option unchecked.
8. Click OK to publish the report to the Web Module.
9. Once the report has been published, log into the Web Module and go to the Reports tab. Click the report to open and view it.

You can automate the generation or publishing of Reports using the Tasks tab.

1. Go to the Tasks tab and select or create a new task that runs on the desired schedule.
2. Click the Add button to add a new Task Action.
   • To generate reports as a document (Web, Word, PDF, CSV or Test), select the Run a Comparison or Analysis Report or Run a Trend Report action, depending on the type of report template you want to automate.
   • To publish reports to the Web Module, select the Publish Report to Web Module action.
3. Follow the wizard presented to configure the options for generating or publishing your report on the schedule. Make sure you add a Relative Date Filter on the Filters page to avoid reporting on your entire storage everytime the task runs.
4. Use the up / down arrows to move the report action underneath other actions that need to occur first, such as the import of log files, or the importing your organization from LDAP (see below).