Thread Info
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Viewing FULL Urls in Web Usage Report UTM 9.310

brendan.daniel
Hi,

I have been asked to retrieve the web logs for a particular user in a particular time frame but we actually need to see the full Urls they have visited. For example, when I add a filter of user and time it shows that googlevideo.com is their top site but I want to actually see which YouTube Urls they went to in that period. Can anyone point me in the right direction to see these?

Cheers,
Brendan


This thread was automatically locked due to age.
  • 0
    I think the best way is to search/filter the raw data from the webprotection log. The reporting features and even iView does not allow the filter a time range (just a date range) and putting the full url into the reporting database would be very ressource intensive (i don't know if it is even possible).

    Regards
    Manfred
    • 0
      Moving to the reporting forum.
      __________________
      ACE v8/SCA v9.3

      ...still have a v5 install disk in a box somewhere.

      http://xkcd.com
      http://www.tedgoff.com/mb
      http://www.projectcartoon.com/cartoon/1
      • 0
        I have been asked to retrieve the web logs for a particular user in a particular time frame but we actually need to see the full Urls they have visited. For example, when I add a filter of user and time it shows that googlevideo.com is their top site but I want to actually see which YouTube Urls they went to in that period. Can anyone point me in the right direction to see these?


        Supported, by searching Web Filtering log files for Allowed/Accepted events in desired timeframe:

      • 0

        Hi everyone, this maybe old but I need the answer for this aswell.

        Thanks everyone.

        • 0 in reply to John RielCruz

          Vilic's answer above is still correct, John.

          Cheers - Bob

           
          Sophos UTM Community Moderator
          Sophos Certified Architect - UTM
          Sophos Certified Engineer - XG
          Gold Solution Partner since 2005
          MediaSoft, Inc. USA
          • 0 in reply to BAlfson

            All,

             

            The steps given do in fact provide a url but it appears to not show the entire string.

             

            Is there any way to figure out what specific page was visited within a web site?  

            • +1 in reply to James Shakour

              James, for example, I started a report and got:

              Then, I did a search on the log files:

              That gave me the following line among others:

              /var/log/http.log:2018:07:31-00:51:37 secure httpproxy[6359]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="CONNECT" srcip="172.21.1.155" dstip="172.217.9.10" user="balfson" group="" ad_domain="ourdomain" statuscode="200" cached="0" profile="REF_DefaultHTTPProfile (Default Web Filter Profile)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="6887" request="0xe334b200" url="https://www.googleapis.com/" referer="" error="" authtime="0" dnstime="16040" cattime="83931" avscantime="0" fullreqtime="240443770" device="0" auth="0" ua="" exceptions="" category="178" reputation="trusted" categoryname="Internet Services" country="United States" application="googapis" app-id="176"
               
              Here you see the full URL that the user visited.

              Cheers - Bob

               
              Sophos UTM Community Moderator
              Sophos Certified Architect - UTM
              Sophos Certified Engineer - XG
              Gold Solution Partner since 2005
              MediaSoft, Inc. USA