Make sure Filtering Service is sending data

Before you begin

Log Server receives Internet usage data from Filtering Service. If there are problems with Filtering Service, data is not sent, and log records cannot be created.

Steps

  1. Make sure that Filtering Service is running.
    • Windows: Use the Services tool to verify that Websense Filtering Service is Started.
    • Linux: Use the /opt/Websense/WebsenseDaemonControl command to make sure that Filtering Service is running.
  2. Go to the Settings > General > Logging page in the Web Security module of the Forcepoint Security Manager and click Check Status to verify that Log Server is listening at the specified IP address or hostname, and on the specified port.
    If the status check fails:
    • Verify the Log Server IP address or hostname and port values. The values on the Settings > General > Logging page must match those on the Settings > Reporting > Log Server page.
    • Make sure no firewall is blocking the port (55805, by default).
    • Open a Windows Command Prompt or PowerShell on the Log Server machine and run the following command to verify that Log Server is listening on the port:

      netstat -ban > port.txt

      Open port.txt and find LogServer.exe in the list. The logging port should be listed.

    • Use a utility like telnet or ping to verify that the Log Server and Filtering Service machines can communicate.
  3. Verify that Content Gateway, Network Agent, or a third-party integration product has been properly configured to communicate with Filtering Service, and that Internet traffic is being seen.
    If all of the following are true:
    1. You have either deployed Forcepoint Web Security or integrated Forcepoint URL Filtering with a third-party product.
    2. Users requests are being managed correctly.
    3. No records are being sent to Log Server.
    Stop Network Agent. If Log Server begins to receive Internet usage data, port spanning was not configured in your network, or port spanning was interrupted. See the Network Agent Quick Start paper for information about how to position Network Agent in your network.
  4. Make sure that Filtering Service is associated with a Policy Server that has its own Log Server instance (is configured for logging), and that data is not being diverted to the TestLogServer utility for troubleshooting purposes.
    • In Web Security module of the Forcepoint Security Manager, make sure the expected Policy Server IP address appears in the toolbar, and that there is no alert indicating that no Log Server is installed for the Policy Server.
    • If TestLogServer has been started, make sure it has been set up to forward records to Log Server. (See Using TestLogServe r for Troubleshooting for more information.)