Go to the table of contents Go to the previous page Go to the next page View or print as PDF
Real-Time Monitor
Web Security Help | Web Security Solutions | Version 7.8.x
Related topics:
Use the Reporting > Real-Time Monitor page to review current Internet activity in your network.
 
Important 
Click Start to populate the page with data. The page shows recent Internet requests, including:
*
The IP address or name of the user who made the request.
*
*
*
The URL requested.
By default, if the URL is too long to display in the space provided, the field shows the first 30 characters of the URL, a space, a hyphen ("-"), and a space, and then last 20 characters of the URL. Right-click the truncated URL to see the entire string.
Click Customize in the toolbar at the top of the page, then select Show the full URL to change this behavior.
*
*
*
*
The Category assigned to the site.
The actual category used to filter the request is shown, whether that is the Master Database category, the custom URL category, or the category dynamically assigned as a result of scanning.
*
The Action (permitted or blocked) applied to the request.
Hover the mouse over an entry to see the policy or policies used to determine the action. Multiple policies may be listed if, for example:
*
*
When multiple policies are listed, you can use the Test Filtering tool (in the Web Security manager Toolbox) to see which policy takes precedence for a request from the user or IP address shown in Real-Time Monitor.
*
The Time the request was passed to Real-Time Monitor.
Because Real-Time Monitor receives request information from Usage Monitor in real time, rather than reading the request from the Log Database, the request time shown here may not match the request time that appears in investigative and presentation reports.
To review current data, click Pause to prevent the page from continuing to refresh. When you are ready to start monitoring new information, click Start again.
*
By default, data is refreshed every 15 seconds. To change the update rate, click Customize in the toolbar at the top of the page, then select a new Data refresh rate value.
Depending on your current settings, Real-Time Monitor holds a set number of records (250, 500, or 1000), and always displays the latest set of available records. When you pause display of new records to review current data, this can mean that the hundreds or thousands of requests that occur while the display is paused are not available for display in the monitor. (The requests are, however, stored in the Log Database, and appear in investigative and presentation reports.)
To change how many records are displayed, click Customize in the toolbar at the top of the page, then select a new Number of records shown value.
Beginning with 7.8.4, IPv6 information is displayed in Real-Time Monitor.
Using filters to show specific Real-Time Monitor data
Web Security Help | Web Security Solutions | Version 7.8.x
To filter the data displayed on the screen:
1.
Enter all or part of a user name or IP address, URL, category, or action in the Filter results by fields. You can also select a time filter to show the past 5, 10, or 15 minutes worth of applicable results.
2.
Click Show Results.
3.
You can also right-click any entry in the User, URL, Category, or Action fields and select the Filter by or Add...to search filter option to immediately filter results based on the selected string.
Understanding timeout behavior
Web Security Help | Web Security Solutions | Version 7.8.x
By default, TRITON Unified Security Center sessions time out after 30 minutes. To run Real-Time Monitor without timing out, click Full Screen to open the monitor in a new window. The IP address of the monitored Policy Server appears in the Real-Time Monitor title bar. If you want to monitor multiple Policy Server instances, see Real-Time Monitor in Multiple Policy Server Deployments for considerations and instructions.

Go to the table of contents Go to the previous page Go to the next page View or print as PDF
Copyright 2016 Forcepoint LLC. All rights reserved.