Any Smoothwall report experts?

[kennysarmy]

I am struggling to see how I can create a report which will output the blocked sites for the Group Guests, ideally this output would be:

 

Set start and end date/time:

 

 

IP Address 1

Sites blocked ordered by time/date

 

IP Address 2

Sites blocked ordered by time/date

 

IP Address 3

Sites blocked ordered by time/date

 

etc

[ibpalle]

First option:

 

Go to Reports - reports - custom.

 

Add the details for name, description and location.

 

Find the reports in the Guardian 3 folder called 'IP Activity and Domain activity' and add it to the included sections. Select both and group them.

 

In the parameters section set the IP Activity as the feeder and press the update button in the customize reports section at the top. The layout will change slightly.

 

Change the display top to a suitable number, the group to Guests. Enter the advanced option and select denied in the request status.

 

Move down to the domain activity report and set the top to a suitable number of entries.

 

Press create report and try to run it for a suitable timeframe. This will give you the top blocked IPs list and then a report on the top blocked domains for each IP.

 

2nd report

 

This will be a report run for a single IP.

 

In custom add the 'Individual User' report.

In the options, set the group and select denied in the request status.

Go to the Export tab and select IP address.

 

You can run this report by IP address.

 

 

3rd and closest to what you want. However, this can be a massive report if you run this with a top value of say 500. You will get up to 500 IPs and then up to 500 log extract reports with 500 entries in each.

 

Add the IP activity and Individual user report section and group them. Select feeder to be IP Activity and update.

Set top number and denied status.

Create the report and run it.

[kennysarmy]

First option:

 

Go to Reports - reports - custom.

 

Add the details for name, description and location.

 

Find the reports in the Guardian 3 folder called 'IP Activity and Domain activity' and add it to the included sections. Select both and group them.

 

In the parameters section set the IP Activity as the feeder and press the update button in the customize reports section at the top. The layout will change slightly.

 

Change the display top to a suitable number, the group to Guests. Enter the advanced option and select denied in the request status.

 

Move down to the domain activity report and set the top to a suitable number of entries.

 

Press create report and try to run it for a suitable timeframe. This will give you the top blocked IPs list and then a report on the top blocked domains for each IP.

 

2nd report

 

This will be a report run for a single IP.

 

In custom add the 'Individual User' report.

In the options, set the group and select denied in the request status.

Go to the Export tab and select IP address.

 

You can run this report by IP address.

 

 

3rd and closest to what you want. However, this can be a massive report if you run this with a top value of say 500. You will get up to 500 IPs and then up to 500 log extract reports with 500 entries in each.

 

Add the IP activity and Individual user report section and group them. Select feeder to be IP Activity and update.

Set top number and denied status.

Create the report and run it.

 

 

Thanks.

 

If I choose "hits" in option 1 report, I presume that's just a count of "blocked" requests, so I could use this to determine which IP is potentially belonging to someone going a little off-task and then run report 2?

[ibpalle]

Yup. Use 1 to find the interesting ones and 2 for details.