Documentation | Support

Go to the table of contents Go to the previous page Go to the next page View or print as PDF
Working with Reports
 
Administrator Help | Forcepoint Email Security | Version 8.5.x
 
Topics:
?
Configuring Log Database options
?
Changing the Log Database
?
Configuring reporting preferences
?
Working with presentation reports
Configuring Log Database options
Administrator Help | Forcepoint Email Security | Version 8.5.x
The Log Database stores the records of email traffic activity and the associated email analysis on that traffic. These data records are used to generate presentation reports of email activity, including size and volume of email messages and identification of senders and recipients. They are also used to generate the status charts on the dashboard.
Administering the Log Database involves controlling many aspects of database operations, including the timing of maintenance tasks, the conditions for creating new database partitions, and which partitions are available for reporting. Manage Log Database operations on the page Settings > Reporting > Log Database.
Making changes to Log Database settings on one appliance applies those changes to all the appliances in your network.
Additional configuration for your Log Database can be completed using Microsoft SQL Server tools. It is recommended to encrypt the database connection as a best practice. See Microsoft documentation for more information on securing SQL Server, and Administering Forcepoint Databases for more information about configuring the Log Database.
The Log Database page is divided into six sections, as detailed in the following table. After making changes in any of these sections of the Log Database page, click the OK button within the section to save and implement the changes in that section.
 
Parameter
Description
Log Database Location
Provides options to configure the IP address/instance or hostname/instance of your Log Database server. By default, the Log Database created at installation is entered. See Configuring the Log Database location and encryption.
Database Rollover Options
Provides options to specify when you want the Log Database to create a new database partition, a process called a rollover.
Maintenance Configuration
Provides options to configure aspects of database processing, such as the time for running the database maintenance job, some of the maintenance tasks performed, and deletion of database partitions and error logs. See Configuring maintenance options.
Database Partition Creation
Provides options to define characteristics for new database partitions, such as location and size options. This area also lets you create a new partition right away, rather than waiting for a planned rollover. See Creating database partitions.
Available Partitions
Lists all database partitions available for reporting. The list shows the dates covered by the partition, as well as the size and name of each partition.
Use this list to control what database partitions are included in reports, and to select individual partitions to be deleted.
Log Activity
Displays log activity to review database maintenance status and event and error messages recorded during the jobs run on the Log Database. See Viewing log activity.
Configuring the Log Database location and encryption
Use the section Log Database Location on the page Settings > Reporting > Log Database to enter the IP address\instance or hostname\instance of your Log Database server. By default, the Log Database created at installation is entered.
If you chose to encrypt the database connection at product installation, the Encrypt connection check box is marked. If you did not select the encryption option during installation, you can encrypt the database connection by marking the check box here.
 
Important 
You must have imported a trusted SSL certificate to the Log Server machine in order to use SSL for the encryption option. See your database documentation for information about importing a trusted certificate.
See the Microsoft article SQL Server encryption for more information about encrypting SQL Server.
Other settings created at installation and displayed here include the designated authentication method (Windows or SQL Server), user name, and password.
Determine the availability of the server
?
From the section Log Database Location, click Check Status.
Configuring database rollover options
The top of the Log Database Options section displays the name of the active Log Database and a Refresh link. Click Refresh to update the information shown on the Log Database page. Be sure you save your settings before you click Refresh, because any unsaved changes on the page will be cleared.
Use the Database Rollover Options section of the page Settings > Reporting > Log Database to specify when you want the Log Database to create a new database partition, a process called a rollover.
Use the Roll over every option to indicate whether database partitions should roll over based on size (MB) or date (weeks or months).
?
For size-based rollovers, select MB and specify the number of megabytes the database must reach for the rollover to begin, from 100–10240 MB (default is 5120).
?
For date-based rollovers, select either weeks or months as the unit of measure, and specify how many full calendar weeks (from 1–52) or months (from 1–12) to keep in a database partition before a new one is created.
 
 
 
If the rollover begins during a busy part of the day, performance may slow during the rollover process.
To avoid this possibility, some environments choose to set the automatic rollover to a long time period or large maximum size. Then, they perform regular manual rollovers to prevent the automatic rollover from occurring.
See Creating database partitions for information on manual rollovers.
Extremely large individual partitions are not recommended. Reporting performance can slow if data is not divided into multiple, smaller partitions.
When a new database partition is created, reporting is automatically enabled for the partition (see Enabling database partitions).
Click OK to activate changes to the database rollover options.
Configuring maintenance options
Use the Maintenance Configuration section of the page Settings > Reporting > Log Database to control certain aspects of database processing, such as the time for running the database maintenance job, some of the maintenance tasks performed, and deletion of database partitions and error logs.

For Maintenance start time, select the time of day for running the database maintenance job. Default value is 1:00.
The time and system resources required by this job vary depending on the tasks you select in this area. To minimize any impact on other activities and systems, it is best to run this job during a slow email traffic period.

Mark the check box Automatically delete a partition with an end date older than, and then specify the number of days (from 1 to 365) after which partitions should be deleted (default is 365).
 
 
After a partition has been deleted, the data cannot be recovered. See Enabling database partitions for an alternative way to delete partitions.

Mark the check box Enable automatic reindexing of partitions on, and then select a day of the week to have this processing performed automatically (default is Saturday).
Reindexing the database is important to maintain database integrity and to optimize reporting speed.
 
Important 
It is best to perform this processing during a quiet time for email traffic. Reindexing database partitions is resource intensive and time consuming. Reports should not be run during the reindexing process.

Mark the check box Delete failed batches after and then enter a number of days (from 1 to 365) after which to delete any failed batches. Default value is 20.
If this option is not checked, failed batches are retained indefinitely for future processing.
If there is insufficient disk space or inadequate database permissions to insert log records into the database, the records are marked as a failed batch. Typically, these batches are successfully reprocessed and inserted into the database during the nightly database maintenance job.
However, this reprocessing cannot be successful if the disk space or permission problem is not resolved. Additionally, if the Process any unprocessed batches option is not selected, failed batches are never reprocessed. They are deleted after the time specified here.

Mark the check box Process any unprocessed batches to have the nightly database maintenance job reprocess any failed batches.
If this option is not checked, failed batches are never reprocessed. They are deleted after the time specified in step 4, if any.

Mark the check box Delete the log after, and then enter a number of days (1 to 120) after which to delete database error records. Default value is 45.
If this option is not checked, error logs are retained indefinitely.

Click OK to activate changes to the maintenance configuration options.
Creating database partitions
Database partitions store the individual log records of email traffic activity. Microsoft SQL Server users can configure the Log Database to start a new partition based on partition size or a date interval.
When partitions are based on size, all incoming log records are inserted into the most recent active partition that satisfies the size rule. When the partition reaches the designated maximum size, a new partition is created for inserting new log records.
When the partitions are based on date, new partitions are created according to the established cycle. For example, if the rollover option is monthly, a new partition is created as soon as any records are received for the new month. Incoming log records are inserted into the appropriate partition based on date.
Database partitions provide flexibility and performance advantages. For example, you can generate reports from a single partition to limit the scope of data that must be analyzed to locate the requested information.
Use the Database Partition Creation section of the page Settings > Reporting > Log Database to define characteristics for new database partitions, such as location and size options. This area also lets you create a new partition right away, rather than waiting for a planned rollover.

Enter the file path for creating both the data and log files for new database partitions.

Under Initial Size (MB), set the initial file size (from 100 to 2048 MB) for both the Data and Log files for new database partitions.
 
 
Best practice recommends calculating the average partition size over a period of time. Then, update the initial size to that value. This approach minimizes the number of times the partition must be expanded, and frees resources to process data into the partitions.

Under Growth (MB), set the increment by which to increase the size (from 8 - 512 MB) of a partition's data and log files when additional space is required.

Click OK to implement the path, size, and growth changes entered.
Database partitions created after these changes use the new settings.

Click Create to create a new partition immediately, regardless of the automatic rollover settings.
To have the new partition use the changes made in this section, be sure to click OK before you click Create.
Click the Refresh link in the content pane periodically. The Available Partitions area will show the new partition when the creation process is complete.
If you later change the partition file path, you should be sure that the new database folder exists with write privileges.
Enabling database partitions
The Available Partitions section of the page Settings > Reporting > Log Database lists all the database partitions available for reporting. The list shows the dates covered by the partition, as well as the size and name of each partition.
Use this list to control what database partitions are included in reports, and to select individual partitions to be deleted.

Mark the check box in the Enable column next to each partition you want included in reports.
Use the Select all and Select none options above the list, as appropriate.
You must enable at least one partition for reporting. Use the Select none option to disable all partitions at one time so that you can enable just a few.
Use these options to manage how much data must be analyzed when generating reports and speed report processing. For example, if you plan to generate a series of reports for June, select only partitions with dates in June.
 
Important 
This selection affects scheduled reports as well as reports that are run interactively. To avoid generating reports with no data, make sure the relevant partitions are enabled when reports are scheduled to run.

Click the Delete option beside a partition name if that partition is no longer needed. The partition is actually deleted the next time the nightly database maintenance job runs.
 
 
Use this option with care. You cannot recover data from deleted partitions.
Deleting obsolete partitions minimizes the number of partitions in the Log Database, which improves database and reporting performance. Use this Delete option to delete individual partitions as needed. See Configuring maintenance options if you prefer to delete older partitions according to a schedule.

Click OK to activate changes to the available partitions options.
Viewing log activity
Use the Log Activity section of the page Settings > Reporting > Log Database to review database maintenance status and event and error messages recorded during the jobs run on the Log Database. Use the View pull-down menu to select the maximum number of messages to display.
Changing the Log Database
Administrator Help | Forcepoint Email Security | Version 8.5.x
The Log Database may need to be changed when one of the following situations occurs:
?
The database IP address changes.
?
The database username and password change.
?
The user wants to change authentication settings.
?
The user wants to use a named instance.
This type of change must be made in two locations: on the page Settings > Reporting > Log Database and in the Email Log Server Configuration wizard.
Use the following steps to change the Log Database configuration:

Enter the IP address for the new Log Database on the page Settings > Reporting > Log Database, in the Log database field.

Open the Email Log Server Configuration wizard for the Windows machine on which Log Server is installed (Start > Forcepoint > Email Log Server Configuration).

In the Database tab, click Connection to open the Select Data Source dialog box.

Select the Machine Data Source tab and click New to open the Create New Data Source dialog box.

Select System Data Source (Applies to this machine only), and click Next.

Select SQL Server and click Next.

Click Finish.

In the Create a New Data Source to SQL Server dialog box, enter the server name, description, and IP address of the new SQL Server database in the Name, Description, and Server entry fields and click Next.

Select With SQL Server authentication using a login ID and password entered by the user.

Enter the username (sa) and a password and click Next.

In the p ull-down menu Change the default database to, select the esglogdb76 database and click Next.

Click Finish.

In the ODBC Microsoft SQL Server Setup dialog box, click Test Data Source to test the server connection.

Click OK.

Enter the new username and password in the SQL Server Login dialog box.

In the Email Log Server Configuration wizard Database tab, notice that the ODBC Data Source Name (DSN) field contains the new server name, and click Apply to confirm the new configuration.

Click OK in the warning message. The Log Server must be stopped and restarted for the new settings to take effect.

In the Email Log Server Configuration wizard Connection tab, click Stop to stop the Log Server service.

In the same tab, click Start to restart the Log Server service. The new database settings are in effect.
Viewing Log Server settings
Administrator Help | Forcepoint Email Security | Version 8.5.x
Use the page Settings > Reporting > Log Server to view the Log Server IP address or hostname and port number. Click Check Status to determine the availability of the server.
Configuring reporting preferences
Administrator Help | Forcepoint Email Security | Version 8.5.x
Reporting preference settings determine how a scheduled report is distributed for review. You can also specify how long to retain a scheduled report and how much warning administrators receive before a report is deleted.
When reporting preferences settings are made on one appliance, they are applied to all the appliances in your network.
Use the page Settings > Reporting > Preferences to provide information used to distribute completed scheduled reports via email. Also define how long scheduled presentation reports are stored before they are deleted automatically, and how far in advance to warn administrators that reports are due to be deleted.

Enter the email address to appear in the From field when scheduled reports are distributed via email.

Enter the SMTP server IP address or name for the email server used to distribute scheduled reports via email.

Use the Store reports for pull-down menu to indicate how long scheduled reports are stored on the email management server (default is five days).
As you increase the length of time that reports are stored, you affect the amount of disk space required on the email management server. This machine is not an appropriate location for a long-term reporting archive.
 
 
If you reduce the report storage time after you have started to generate reports, stored reports that exceed this interval will be automatically deleted.

Use the Give administrators this much warning before a scheduled report is deleted pull-down menu to indicate how much warning (from 1–5 days) an administrator should have before a report is deleted (default is three days).
The warning is intended to give administrators time to archive important reports in an appropriate location before they are deleted from the email management server.

Click OK to implement your changes.
Working with presentation reports
Administrator Help | Forcepoint Email Security | Version 8.5.x
Presentation reports include a set of predefined charts and tabular report templates with which you can generate graphical reports of email message traffic activities. You can run a report, customize a report template, or mark a frequently used report as a Favorite. You can run any presentation report immediately, or schedule it to run at a particular time or on a repeating cycle.
Not all report templates can be customized. Report templates that can be customized display a different icon from reports that cannot be customized. If the Save As button is enabled when you select a report name, then you can save and edit that report to suit your needs. The Save As button is not enabled if you select a report that cannot be customized.
Use the page Main > Status > Presentation Reports to generate charts and tabular reports based on templates in the Report Catalog.
The Report Catalog organizes a list of predefined report templates and custom reports into groups. Expand a group to see its corresponding templates and custom reports. Click on a template or report title to see a brief description of what it includes.
To run a presentation report, select the desired report template in the Report Catalog, click Run, and then follow the instructions given in Running a presentation report.
To use an existing report as a starting point for creating a report variation, select a custom report, and then click Save As, if this button is enabled. If the Save As button is not enabled when you select the report, you cannot edit the template. See Copying a custom presentation report.
To make changes to the report filter applied to any custom report you have created, select the report title in the Report Catalog, and then click Edit. You cannot modify or delete predefined report templates.
Reports that are used frequently can be marked as Favorites to help you find them more quickly. Just click the report title in the Report Catalog, and then click Favorite (see Working with Favorites). Mark Show Only Favorites to display only templates that you have marked as Favorites in the Report Catalog.
To delete a custom report you have created, click Delete. If a deleted report appears in any scheduled jobs, it will continue to be generated with that job. See Viewing the scheduled jobs list for information on editing and deleting scheduled jobs.
 

Changes to report settings made on one appliance are applied to all network appliances.
Use the buttons at the top of the page to schedule reports to run later, view scheduled report jobs, and view and manage reports created by the scheduler.
?
Click Job Queue to see and manage a list of existing scheduled jobs, along with the status of each job. See Viewing the scheduled jobs list.
?
Click Scheduler to define a job containing one or more reports to be run at a specific time or on a repeating schedule. See Scheduling a presentation report.
?
Click Review Reports to see and manage a list of reports that were successfully scheduled and run. See Reviewing scheduled presentation reports.
Copying a custom presentation report
Administrator Help | Forcepoint Email Security | Version 8.5.x
Use the Save As New Report page to create an editable copy of a custom report template. Not all templates can be used to create a new custom report. Use the following steps to copy a custom presentation report:

Select the custom report in the Report Catalog and, if it is enabled, click Save As. If the Save As button is not enabled, you cannot copy and customize the selected report.

In the Presentation Reports > Save As New Report page, replace the report catalog name with a name that will make it easy to identify the new report. (The default name is the name of the original report template, with a number appended to indicate that it is a copy.) The name must be unique and can have up to 85 characters.

Click either Save or Save and Edit.
?
If you click Save, you are returned to the Presentation Reports page, where the new report appears in the Report Catalog. To customize the report at any time, select its name, and then click Edit.
?
If you click Save and Edit, you are taken directly to the Edit Report Filter page. The new report is also added to the Report Catalog.

Edit the report filter to modify the report. The report filter controls elements such as which email senders or recipients are included in your custom report.
For instructions, see Defining the report filter.
Defining the report filter
Administrator Help | Forcepoint Email Security | Version 8.5.x
Report filters let you control what information is included in a report. For example, you might choose to limit a report to selected email senders, email recipients, or message analysis results (for example, clean, virus, spam, commercial bulk, or data loss prevention). You can also give a new name and description for the entry in the Report Catalog, change the report title, specify a custom logo to appear, and designate the new report as a Favorite.
 
 
Using a custom logo requires some preparation before you define the report filter. You must create the desired graphic in a supported graphic format and place the file in the appropriate location. See Customizing the report logo.
The filter for predefined report templates cannot be changed. You can edit the filter for a custom report when you create it by choosing Save and Edit on the Save As New Report page, or select the report in the Report Catalog at any time and click Edit.
The Edit Report Filter page has separate tabs for managing different elements of the report. Select the items you want on each tab, then click Next to move to the next tab. For detailed instructions on completing each tab, see:
?
Setting general report options
?
Selecting email senders for the report
?
Selecting email recipients for the report
?
Selecting message analysis results for the report
On the Save tab, choose whether to run or schedule the report, and save the report filter. See Saving the report filter definition.
Setting general report options
Use the General tab of the page Presentation Reports > Edit Report to configure general report characteristics, as follows:

Modify the name that appears in the Report Catalog for this report by entering a new name in the Report catalog name entry field. The name can have up to 76 characters.
This name does not appear on the report itself; it is used only for identifying the unique combination of report format and filter in the Report Catalog.

Modify the title that actually appears on the report in the Report title entry field. The title can have up to 85 characters.

Use the Description field to modify the brief report description that appears in the Report Catalog. The description can have up to 336 characters.
The description should help you identify this unique combination of report format and filter in the Report Catalog.

Use the Logo pull-down menu to specify a logo for your report. The default entry is Forcepoint Logo. Select No Logo if you do not want a logo displayed on this report.
The list also contains filenames for custom logo image files if you have created and stored supported image files in the appropriate directory. See Customizing the report logo.

Mark the Save as Favorite check box to have the report selected as a Favorite.
The Report Catalog shows a star symbol beside Favorite reports. You can select Show only Favorites on the Report Catalog page to reduce the number of reports listed, which enables you to move more quickly to a particular report.

After all entries and selections are complete, click Next to open the Senders tab.
Customizing the report logo
By default, presentation reports display the Forcepoint logo in the upper left corner. When you create a custom report and edit its report filter, you can choose a different logo, which you have already prepared and copied to the appropriate directory, as follows:

Create an image file in one of the following formats:
.bmp, .gif, .jfif, .jpe, .jpeg, .jpg, .png, .ttf
Use a maximum of 25 characters for the image file name, including the file extension.

Copy the image file to the following default installation directory (or to your own installation directory):
C:\Program Files (x86)\Websense\Email Security\ESG Manager\tomcat\PRTemplate\jasperreports\images
All supported image files in this directory automatically appear in the Logo pull-down menu on the General tab of the Edit Report Filter page. The image is automatically scaled to fit within the space allocated for the logo. (See Setting general report options.)
Selecting email senders for the report
The Senders tab of the page Presentation Reports > Edit Report lets you control which senders are included in the report data. You can select only one type of sender for each report.
No selections are required on this tab to report on all senders.

Select a sender type from the pull-down menu.

Set the maximum number of search results from the Search limit pull-down menu (from 10–1000). Default value is 10.
Depending on the email traffic in your organization, there may be large numbers of users, groups, or domains in the Log Database. This option manages the length of the results list, and the time required to display the search results.

Enter one or more characters for searching, and then click Search.
Use an asterisk (*) as a wildcard to signify missing characters. For example, J*n might return Jackson, Jan, Jason, Jon, Joan, and so forth.
Define your search string carefully, to ensure that all desired results are included within the number selected for limiting the search.

Highlight one or more entries in the results list, and click the right arrow button (>) to move them to the Selected Senders List.

Repeat steps 2–4 as needed to conduct additional searches and add more senders to the Selected Senders List.

To delete an entry from the Selected Senders List, select the entry and click Remove.

After you are finished making selections or deletions, click Next to open the Recipients tab.
Selecting email recipients for the report
The Recipients tab of the page Presentation Reports > Edit Report lets you control which recipients are included in the report data. You can select only one type of recipient for each report.
No selections are required on this tab to report on all recipients.

Select a recipient type from the pull-down menu.

Set the maximum number of search results from the Search limits pull-down menu (from 10–1000). Default value is 10.
Depending on the email traffic in your organization, there may be large numbers of users, groups, or domains in the Log Database. This option manages the length of the results list, and the time required to display the search results.

Enter one or more characters for searching, and then click Search.
Use an asterisk (*) as a wildcard to signify missing characters. For example, J*n might return Jackson, Jan, Jason, Jon, Joan, and so forth.
Define your search string carefully, to ensure that all desired results are included within the number selected for limiting the search.

Highlight one or more entries in the results list, and click the right arrow button (>) to move them to the Selected Recipients List.

Repeat steps 2–4 as needed to conduct additional searches and add more recipients to the Selected Recipients List.

To delete an entry from the Selected Recipients List, select the entry and click Remove.

After you are finished making selections or deletions, click Next to open the Message Analysis Results tab.
Selecting message analysis results for the report
The Message Analysis Result tab of the page Presentation Reports > Edit Report lets you determine which results of email analysis are included in the report. Selections are Clean, Virus, Spam, Data Loss Prevention, Commercial Bulk, Custom Content, Block List, Phishing, Advanced Malware Detection - Cloud, URL Analysis, Spoofed Email, and Advanced Malware Detection - On-Premises. The Block List type applies to a message that is blocked by a Personal Email Manager Always Block List. By default, all available analysis result types are selected. You must select at least one type.
Click Next to open the Save tab.
Saving the report filter definition
The Save tab of the page Presentation Reports > Edit Report displays the name and description that will appear in the Report Catalog, and lets you choose how to proceed.

Review the Name and Description text.
If any changes are needed, click Back to return to the General tab, where you can make those changes. You cannot edit the name or description text in the Save tab. (See Setting general report options.)

Indicate how you want to proceed:
?
Select Save to save the report filter and return to the Report Catalog.
?
Select Save and run to save the report filter and open the Run Report page. See Running a presentation report.
?
Select Save and schedule to save the report filter and open the Scheduler page. See Scheduling a presentation report.

Click Finish to save the report name and description and implement the selection made in step 2.
Working with Favorites
Administrator Help | Forcepoint Email Security | Version 8.5.x
You can mark any presentation report, either template or custom, as a Favorite. Use this option to identify the reports you generate most frequently and want to be able to locate quickly in the Report Catalog.
To mark a report as a Favorite:

On the Presentation Reports page, select a report in the Report Catalog that you generate frequently, or want to be able to locate quickly.

Click Favorite.
A star symbol appears beside any Favorite report name in the list, letting you quickly identify it when the Report Catalog is displayed.

Mark the Show Only Favorites check box above the Report Catalog to limit the list to those marked as Favorites. Clear this check box to restore the full list of reports.
If your needs change and a favorite report is no longer being used as frequently, you can remove the Favorite designation as follows:

Select a report that shows the Favorite star symbol.

Click Favorite.
The star symbol is removed from that report name in the Report Catalog. The report is now omitted from the list if you choose Show Only Favorites.
Running a presentation report
Administrator Help | Forcepoint Email Security | Version 8.5.x
Use the page Presentation Reports > Run Report to generate a single report immediately. You can also create jobs with one or more reports and schedule them to run once or on a repeating cycle (see Scheduling a presentation report).
 
 
Before generating a report in PDF format, make sure that Adobe Reader v7.0 or later is installed on the machine from which you are accessing the email management server.
Before generating a report in XLS format, make sure that Microsoft Excel 2003 or later is installed on the machine from which you are accessing the email management server.
If the appropriate software is not installed, you have the option to save the file.
To run a report:

Select the report you want to run in the Report Catalog and click Run to open the Run Report page.

Select the Report date range to define the time period covered in the report.
If you select Custom, specify the Report start date and Report end date for the report.

Select a Report output format for the report.
XLS
Excel spreadsheet. XLS files are formatted for reuse, and can be opened in Microsoft Excel.
PDF
Portable Document Format. PDF files are formatted for viewing, and can be opened in Adobe Reader.
HTML
HyperText Markup Language. HTML files are formatted for viewing, and can be opened in a Web browser.

If you selected a Top N report type, choose the number of items to be reported.

Specify how you want the report to be generated:
?
Select Run the report in the background (default) to have the report run immediately as a scheduled job. Optionally, you can provide an email address to receive a notification message when the report is complete or cannot be generated. (You can also monitor the job queue for report status.)
If you run the report in the background, a copy of the completed report is automatically saved, and a link to the report appears on the Review Reports page.
?
Deselect Run the report in the background to have the report run in the foreground. In this case, the report is not scheduled, and does not appear on the Review Reports page.
If you run the report in the foreground, the report is not automatically saved when you close the application used to view the report (Microsoft Excel, Adobe Reader, or a Web browser, for example). You must save the report manually.
 
 
If you plan to run multiple reports in the foreground, make sure that you use the embedded Close button to close the pop-up window used to display the "generating report" and "report complete" messages. If you use the browser's close (X) button, subsequent attempts to run reports in the foreground may fail until you navigate away from the Presentation Reports page, come back, and run the report again.

Click Run.
?
If you scheduled the report to run immediately, the completed report is added to the Review Reports list. To view, save, or delete the report, click Review Reports at the top of the Presentation Reports page.
?
If you ran the report in the foreground, a new browser window appears, displaying report progress. HTML reports appear in the browser window when complete; with PDF or XLS formats, you have a choice of whether to open the report or save it.

To print a report, use the print option offered by the application used to display the report.
For best results, generate PDF output for printing. Then, use the print options in Adobe Reader.
Scheduling a presentation report
Administrator Help | Forcepoint Email Security | Version 8.5.x
You can run presentation reports as they are needed, or you can use the page Presentation Reports > Scheduler to create jobs that define a schedule for running one or more reports. In an appliance cluster, only the primary machine can schedule a report.
Reports generated by scheduled jobs are distributed to one or more recipients via email. As you create scheduled jobs, consider whether your email server will be able to handle the size and quantity of the attached report files.
The completed reports are also added to the page Presentation Reports > Review Reports (see Reviewing scheduled presentation reports).
You can access the Scheduler in one of the following ways:
?
Click Scheduler at the top of the Presentation Reports page (above the Report Catalog).
?
When editing a report filter, choose Save and schedule in the Save tab, and then click Finish (see Defining the report filter).
?
Click the job name link on the Job Queue page to edit a job.
?
Click Add Job on the Job Queue page to create a new job.
The Scheduler page contains several tabs for selecting the reports to run and the schedule for running them. For detailed instructions on completing each tab, see:
?
Setting the schedule
?
Selecting reports to schedule
?
Setting the date range
?
Selecting output options
After creating jobs, use the Job Queue to review job status and find other helpful information (see Viewing the scheduled jobs list).
When a scheduled presentation report has run, the report file is sent to recipients as an email attachment. The name of the attachment is the report name. For example, for a report with an output format of PDF, an attachment file may be named Email Hybrid Service Messages.pdf.
Scheduled reports are also automatically saved to a report output directory on the email management server (C:\Program Files (x86)\Websense\Email Security\ESG Manager\tomcat\temp\report\output, by default). The name of the attachment sent via email does not match the name of the file stored in the output directory. The best way to find a specific report is to use the Review Reports page, which can be searched by date or job name, as well as report name.
Reports are automatically deleted from the Review Reports page and the report output directory after the period specified on the page Settings > Reporting > Preferences (5 days, by default). to retain the reports for a longer time, include them in your backup routine or save them in a location that permits long-term storage.
An alert is displayed on the Review Reports page for a period of time before the report is deleted (3 days, by default). Use the page Settings > Reporting > Preferences to change this warning period.
Depending on the number of reports you generate daily, report files can occupy considerable amounts of disk space. Be sure adequate disk space is available on the email management server. If the report output directory grows too large before the files are automatically deleted, you can delete the files manually.
Forcepoint software generates the report in the format you choose: XLS (Microsoft Excel), PDF (Adobe Reader), or HTML. If you choose HTML format, the report may display in the Email module content pane. Reports displayed in the content pane cannot be printed or saved to a file. To print or save a report to file, choose the PDF or XLS output format.
 
Important 
To display presentation reports in PDF format, Adobe Reader v7.0 or later must be installed on the machine from which you are accessing the email management server.
To display presentation reports in XLS format, Microsoft Excel 2003 or later must be installed on the machine from which you are accessing the email management server.
Setting the schedule
Schedule a reporting job to occur once or on a repeating cycle on the Schedule Report tab of the page Presentation Reports > Scheduler.
 
 
It is advisable to schedule report jobs on different days or at different times, to avoid overloading the Log Database and slowing performance for logging and interactive reporting.

Enter a name that uniquely identifies this scheduled job in the Job name field.

Select Recurrence Options for the job based on the Recurrence Pattern you want, as follows:
Recurrence Pattern
Recurrence Options
Once
Enter the exact date on which to run the job, or click the icon to select from a calendar.
Daily
No additional recurrence options are available.
Weekly
Mark the check box for each day of the week the job is to run.
Monthly
Enter the dates during the month for running the job. Dates must be a number between 1 and 31, and must be separated by commas (1,10,20).
To run the job on consecutive dates each month, enter a start and end date separated by a hyphen (3-5).

In the Schedule Time box, set the start time for running the job.
The job begins according to the time on the email appliance.
 
 
To start generating the scheduled reports today, select a time late enough that you can complete the job definition before the start time.

In the Schedule Period box, select a date for starting the job. Options for ending the job are as follows:
No end date
The job continues to run indefinitely, according to the established schedule.
To discontinue the job at some time in the future, either edit or delete the job. See Viewing the scheduled jobs list.
End after
Select the number of times to run the job. After that number of occurrences, the job does not run again, but it stays in the Job Queue until you delete it. See Viewing the scheduled jobs list.
End by
Set the date when the job stops running. It does not run on or after this date.

Click Next to open the Select Report tab.
Selecting reports to schedule
Use the Select Report tab of the page Presentation Reports > Scheduler to choose reports for the job.

Highlight a report for this job in the Report Catalog tree.

Click the right arrow (>) button to move that report to the Selected Reports list.

Repeat steps 1 and 2 until all reports for this job appear in the Selected Reports list.

Click Next to open the Date Range tab.
Setting the date range
Use the Date Range tab of the page Presentation Reports > Scheduler to set the date range for the job. If you selected Once in the Schedule Report tab, the Specific dates field displays the report date specified on that tab.
If you selected a recurring report schedule, you can specify the number of periods to report in the Relative dates field (Current, Last, Last 2, and so forth), along with the type of period (Days, Weeks, or Months). For example, the job might cover the Last 2 Weeks or Current Month.
Week represents a calendar week, Sunday through Saturday. Month represents a calendar month. For example, Current Week produces a report from Sunday through today; This Month produces a report from the first of the month through today; Last Week produces a report for the preceding Sunday through Saturday; and so forth.
After setting the date range for the job, click Next to display the Output tab.
Selecting output options
After you select the reports for a job, use the Output tab to select the output format and distribution options.

Select the file format for the finished report.
XLS
Excel Spreadsheet. Recipients must have Microsoft Excel 2003 or later to view the XLS reports.
PDF
Portable Document Format. Recipients must have Adobe Reader v7.0 or later to view the PDF reports.
HTML
HyperText Markup Language. Recipients must have a Web browser.

Select the number of items you want to appear in a Top format report from the Top N pull-down menu. The value range is from 1 to 200; default value is 10.

Enter recipient email addresses for report distribution.
Each address should be separated by a semicolon.

Optionally, you can also enter email addresses to notify recipients that report generation failed.

Mark the Customize subject and message body of notification email check box, if desired. Then, enter the custom subject and body text for this job's distribution email.

Click Save Job to save and implement the job definition, and display the Job Queue page.

Review this job and any other scheduled jobs. See Viewing the scheduled jobs list.
Viewing the scheduled jobs list
Administrator Help | Forcepoint Email Security | Version 8.5.x
The page Presentation Reports > Job Queue lists the scheduled jobs created for presentation reports. The list gives the status for each job, as well as basic information about the job, such as how frequently it runs. From this page, you can add and delete scheduled jobs, temporarily suspend a job, and more.
You can search for a particular job by entering a search term in the Job name entry field at the top of the page. Click Go to begin the search.
Click Clear to remove the current search term, and then either perform a different search or click Refresh at the bottom of the page to display the complete list of reports.
The list provides the following information for each job:
Data Item
Description
Job Name
The name assigned when the job was created.
Status
Indicates whether the job is
?
running
?
scheduled (waiting for the next scheduled run time)
?
completed successfully
?
failed
?
misfired (did not run at the last scheduled time due to a problem such as low memory or server shutdown)
State
One of the following:
?
Enabled indicates a job that runs according to the established recurrence pattern.
?
Disabled indicates a job that is inactive, and does not run.
Recurrence
The recurrence pattern (Once, Daily, Weekly, or Monthly) set for this job.
History
Click the Details link to open the Job History page for the selected job. See Viewing job history.
Next Scheduled
Date and time for the next run.
Owner
The user name of the administrator who scheduled the job.
Use the options on the Job Queue page to manage the jobs. Some of the buttons require that you first mark the check box beside the name of each job to be included.
Action
Description
Job name link
Opens the Scheduler page, where you can edit the job definition. See Scheduling a presentation report.
Run Now
Starts running any job that has been selected in the list immediately. This is in addition to regularly scheduled job runs.
Add Job
Opens the Scheduler page where you can define a new job. See Scheduling a presentation report.
Delete
Deletes from the Job Queue any job that has been selected in the list. After a job has been deleted, it cannot be restored.
To temporarily stop running a particular job, use the Disable button.
Enable
Reactivates a disabled job that has been selected in the list. The job begins running according to the established schedule.
Disable
Discontinues running an enabled job that is selected in the list. Use this option to temporarily suspend a job that you may want to restore in the future.
Refresh
Updates the page with the latest data
Viewing job history
Administrator Help | Forcepoint Email Security | Version 8.5.x
Click the Details link in the History column and use the page Presentation Reports > Job Queue > Job History to view information about recent attempts to run the selected job. The page lists each report separately, providing the following information:
Data Item
Description
Report Name
Title printed on the report
Start Date
Date and time the report started running
End Date
Date and time the report was completed
Status
Indicator of whether the report completed or failed
Message
Relevant information about the job, such as whether the report was successfully distributed
Reviewing scheduled presentation reports
Administrator Help | Forcepoint Email Security | Version 8.5.x
Use the page Presentation Reports > Review Reports to find, access, and delete scheduled reports. By default, reports are listed from newest to oldest.
To view any report in the list, click the report name.
?
If the report is a single PDF or XLS file, you may be given the option to save or open the report. This depends on your browser security settings and the plug-ins installed on your machine.
?
If the report is very large, it may have been saved as multiple PDF or XLS files and stored in a ZIP file. The file is compressed using ZIP format. Save the ZIP file, then extract the PDF or XLS files it contains to view the report content.
?
Hover the mouse pointer over the report icon next to the report name to see if the report is one or multiple files.
To limit the list to reports that will be deleted soon, mark the Show only reports due to be purged check box. When this option is selected, the report search functions are not available. The length of time that reports are stored is configured on the Settings > Reporting > Preferences page (see Configuring reporting preferences).
To search the report list, first select an entry from the Filter by pull-down menu, and then enter all or part of a job name or date. The search is case-sensitive. You can search by:
?
The report or job name
?
The date the report was created (Creation Date)
?
The name of the administrator that scheduled the report (Requester)
?
The date the report is due to be deleted (Purge Date)
Click Go to begin the search.
Click Clear to remove the current search term, and then either perform a different search or click Refresh to display the complete list of reports.
If a recently completed report does not appear on the Review Reports page, you can also click Refresh to update the page with the latest data.
To delete a report, mark the check box beside the report name and click Delete.
To see the status of a scheduled report job, click Job Queue at the top of the page. See Viewing the scheduled jobs list for more information about using the job queue.
To schedule a new report job, click Scheduler (see Scheduling a presentation report).
 

Go to the table of contents Go to the previous page Go to the next page View or print as PDF
Copyright 2018 Forcepoint. All rights reserved.