Understanding the reporting databases

Administering Websense Databases | Web, Data, and Email Security Solutions | v7.6.x - v7.8.x

Applies to:

In this topic

Web Filter, Web Security, and Web Security Gateway (Anywhere), v7.6.x - v7.8.x

Data Security, v7.6.x - v7.8.x

Email Security Gateway (Anywhere), v7.6.x - v7.8.x

SQL Server Express on the TRITON management server

SQL Server on another machine

Each TRITON reporting database stores the logging data collected by a specific TRITON solution: Web Security, Data Security, or Email Security.

Web Security Log Database stores Internet request data collected by Log Server, such as the source, destination, time, category, risk class, action (also called disposition), bytes sent and received, and so on for use by Web Security reporting tools.

Log Server receives information about Internet activity from Filtering Service and initially stores it locally:

Whenever it is able, Log Server forwards the cache files to the Log Database, where the ETL job processes them into log records in a database partition:

An end user who uses the Filtering Service has no direct or indirect influence over the database. Thus, although the log entry is stored in the MSSQL database, the user did not direct its storage and cannot retrieve it.

The only interface to the database itself is from the Log Server, the Reporting services, and the Manager. Filtering Service and Websense Content Gateway do not access the database, but instead send information via the Log Server.

Email Security Log Database stores records of email traffic and the associated filtering actions on that traffic. Email Security reporting uses this information to generate dashboard status charts and email activity reports showing, for example, the size and volume of messages processed, message filtering disposition, and email source and destination.

Log and quarantine data are recorded as follows:

Data Security Incident and Configuration Database stores information about email, Web, and other traffic that resulted in data loss prevention (DLP) policy breaches, such as the source, destination, time, status, and severity of each breach. It also stores Data Security policy configuration and system settings.

TRITON reporting databases are all hosted by Microsoft SQL Server. They may be hosted by the same installation and instance, or by different installations or instances.

Although Microsoft SQL 2008 R2 Express (SQL Server Express) is packaged with Websense software, enterprises with high transaction volume should purchase Microsoft SQL Server Standard or Enterprise. (See Can I use SQL Server 2008 R2 Express? for guidance.)

When you install Websense software, you can either install SQL Server Express on the TRITON management server or connect to an existing SQL Server instance on another machine.

Related topics:

Reporting database specifications and recommendations

How big will my reporting database be?

Can I use SQL Server 2008 R2 Express?

Factors that affect reporting database size

Other factors that affect the performance of Websense reporting

TRITON reporting database FAQs

SQL Server Express on the TRITON management server

For smaller deployments (up to 500 users), TRITON reporting databases can be installed on the TRITON management server.

The TRITON Unified Security installer installs SQL Server 2008 R2 Express (32-bit) to host reporting databases when you select Install SQL Server Express on this machine during installation. SQL Server 2008 R2 Express is the only version of SQL Server that may reside on the TRITON management server.

If you are upgrading from a previous version of Web Security and have a different version of SQL Server installed on the TRITON management server machine, move your reporting database to a different machine for improved performance and a better overall product experience.

SQL Server Express can run on the following Windows platforms. Note that Windows Server 2008 R2 and later support all TRITON modules.


	Windows Server 2003*	Windows Server 2008 32-bit	Windows Server 2008 R2	Windows Server 2012**
Data Security	x (v7.6 only)		x	x
Web Security	x (v7.6 only)	x	x	x
Email Security			x	x
* In v7.6.x, Windows 2003 is supported for a single TRITON module (Web Security or Data Security), but not for a combination of modules. Windows Server 2003 is not supported from v7.7 onwards. **Windows Server 2012 is supported for v7.8 and later.

SQL Server on another machine

In medium and larger deployments (over 500 users), the best practice is to host TRITON reporting databases on a Standard or Enterprise installation of Microsoft SQL Server. SQL Server typically resides on a dedicated machine. It may host databases for third-party applications, in addition to the Websense databases.

When installing Websense software, you are prompted to provide the IP address or hostname of the SQL Server machine. You may also specify:

An instance name

(v7.7.x and later) The port to use for SQL Server communication

(v7.7.x and later) Whether or not to encrypt communication with SQL Server

The following databases are supported. Note that:

In versions 7.6 and 7.7, you cannot use SQL Server 2005 for the reporting database if you plan to run Data Security or Email Security.

Versions 7.8 and later do not support SQL Server 2005 for any module.

Versions 7.7.x and earlier are not supported with SQL Server 2012.


	SQL Server 2005 SP4*	SQL Server 2008**	SQL Server 2008 R2 Express	SQL Server 2008 R2***	SQL Server 2012â€¡
Data Security		x	x	x	x
Web Security	x	x	x	x	x
Email Security		x	x	x	x
All editions except Web, Express, and Compact; all service packs; 32- and 64-bit, excluding IA64. Only supported for 7.6.x and 7.7.x. * All editions except Web, Express, and Compact; all service packs, 32- and 64-bit, excluding IA64. ***All editions except Web and Compact; all service packs, 32- and 64-bit, excluding IA64. â€¡ Service Pack 1. Only supported for 7.8.x.

Clustering is supported for all supported versions of SQL Server noted in the table above. See Can Websense reporting databases be hosted in a SQL Server cluster?.