Viewing incidents

Use the Configure > SSL > Incidents > Incident List page to see a report of those times when clients received an access denial message.

A separate Incident List is kept for every node in a cluster. Incidents that are added or modified by the administrator, are copied around the cluster (synchronized). Unexpected incidents that, by default, result in an access denial message, are not synchronized in the cluster.

You can use the fields in this report to specify how Content Gateway treats requested access to a site in the future.

To view a specific incident in the local list, enter the ID number or URL and click Search Node.

If the node is part of a cluster and you want see all instances of the ID or URL, in all lists, click Search Cluster.

After viewing a search, to restore the complete local list, click Show All in Node.

When the list is very large, Show All displays only the first 2,500-3,000 records. Use the scroll bar to scroll through the list. Use the '>' and '<' buttons to view the next or previous page.

The incident report

You can sort on any column by clicking on the small triangle next to the column heading.

The incident report contains these fields:

Field

Description

Node

The name of the Content Gateway node on which the list entry is located.

Assigned by the system, this is the incident ID number, also called the Ticket ID. The HelpDesk can ask the user for the Ticket ID in the error message and quickly retrieve it from the URL Incident List.

The end user sees the Ticket ID and a denial message.

Status

Determines how Content Gateway will treat this website in the future. Four conditions are possible:

Allow

Users can access the site even if the certificate is not valid. Traffic is decrypted, and certificate checking is disabled.

Blacklisted

The site is completely blocked. Users cannot access this site even if the Verification Bypass is configured.

Block

If certificate verification fails, access to the website is blocked, unless Verification Bypass is configured, in which case the block page includes a "Visit site anyway" button. See Bypassing verification.

Tunnel

The site is tunneled. Traffic is not decrypted and Content Gateway does not check the certificate. Tunneling can be used to bypass inspection of trusted sites and improve performance.

Note: Tunnel by URL does not work with all transparent proxy traffic. See Adding websites to the Incident List.

You can change the status of a site via the drop-down box in the Action column.

Type

Indicates whether the site was added based on its URL or its certificate. It is recommended that you add sites to the Incident List by certificate. See Adding websites to the Incident List.

URL

The URL of a site whose certificate could not be validated.

Message

Enables you to edit the error message. See Changing the text of a message for information on customizing error messages. The pencil and the magnifying glass each represent links. See Viewing incident details for details on these links.

Action

Enables you to change the status of an incident. Also allows you to delete the incident. See Deleting an incident.