Lesson 12: Real-Time Monitor

New User Quick Start | Web Security Solutions | Version 7.7.x


Learn how to use Real-Time Monitor to track current Internet filtering activity in your network. Apply filters to focus on traffic with specific characteristics.

Real-Time Monitor provides a simple view into current Internet filtering activity in your network. You control how often the data is refreshed and how much data is available at a time, and you can apply filters to focus on specific clients, sites, or types of requests (blocked or permitted).

Unlike other reporting tools, Real-Time Monitor shows only current data.

The data come directly from Usage Monitor, which tracks client access to sites and protocols for use in alerting.

Each record is captured by the Real-Time Monitor database for display. The database contains a limited (configurable) number of records.

When the Real-Time Monitor database is full, each new record overwrites an older record. Older information is no longer available in the monitor. (Because this information is also captured by Log Server and stored in the Log Database, it can be accessed via other reporting tools, like investigative reports.)

Real-Time Monitor shows activity for one Policy Server at a time. Policy Server is a component responsible for coordinating multiple other Websense Web Security components.If your organization is large or distributed, multiple Policy Server instances may be deployed to help balance filtering load.

TRITON - Web Security also connects to one Policy Server at a time, and Real-Time Monitor connects to that same Policy Server at launch. As long as Real-Time Monitor is displayed in the TRITON content pane, it changes its Policy Server connection each time TRITON - Web Security changes its connection.

When Real-Time Monitor is open in full screen mode, it remains connected to a single Policy Server, regardless of whether TRITON - Web Security connects to a different Policy Server.

As a result, multiple Real-Time Monitor instances can be run in full screen mode on the same machine, with each connected to a different Policy Server. The Policy Server IP address is displayed in the Real-Time Monitor title bar. So if you are a network security administrator, you can monitor your entire Websense Web Security installation by opening a Real-Time Monitor instance for each Policy Server deployed in your network.

Exercise 1: Real-Time Monitor basics

To launch Real-Time Monitor, go to the Reporting > Real-Time Monitor page in TRITON - Web Security.

Click Start to populate the page with data. The page shows recent Internet requests, including:

The IP address or name of the user who made the request. If user-based filtering is used in your network, and the IP address is shown, mouse over an entry to see the user name.

The URL requested. If the URL is truncated, mouse over an entry to see the full URL.

Whether or not the requested site was recategorized as a result of Content Gateway scanning.

An icon indicates that scanning resulted in dynamic recategorization of the site; no icon indicates that the Master Database or administrator-defined custom category was used. Mouse over the icon to see the original category.

The Category assigned to the site. The actual category used to filter the request is shown, whether that is the Master Database category, the custom URL category, or the category dynamically assigned as a result of scanning.

The Action (permitted or blocked) applied to the request.

The Time the request was passed to Real-Time Monitor. Because Real-Time Monitor receives request information from Usage Monitor in real time, rather than reading the request from the Log Database, the request time shown here may not match the request time that appears in investigative and presentation reports.

To review current data, click Pause to prevent the page from continuing to refresh. When you are ready to start monitoring new information, click Start again.

Depending on your current settings, Real-Time Monitor holds a set number of records (250, 500, or 1000), and will always display the latest set of available records. When you pause display of new records to review current data, this can mean that the hundreds or thousands of requests that occur while the display is paused will never be displayed in the monitor. (The requests are, however, stored in the Log Database, and will appear in investigative and presentation reports.)

If you are a delegated administrator or reporting administrator, you have completed this tutorial. See Where Do I Go Next? for pointers to possible next steps.

If you are a Super Administrator, continue with Lesson 13: Improving Websense software.