Reporting components

Component Description
Log Server

Logs Internet request data, including:

  • The request source
  • The category or protocol associated with the request
  • Whether the request was permitted or blocked
  • Whether keyword blocking, file type blocking, quota allocations, bandwidth levels, or password protection were applied

Log Server is a Windows-only component that must be installed to enable most web protection reporting features.

After installing Log Server, configure Filtering Service to pass logging data to the correct location (see Configuring how requests are logged).
Log Database Stores Internet request data collected by Log Server for use by web protection reporting tools.
Real-Time Monitor

Displays current Internet activity, including:

  • Request source (user name or IP address)
  • URL (full or domain only)
  • Category (Forcepoint URL Database, custom URL, or dynamic, based on Content Gateway analysis)
  • Whether the request was permitted or blocked
  • Time of the request

Real-Time Monitor is made up of 3 services:

  • Websense RTM Client
  • Websense RTM Server
  • Websense RTM Database

See Real-Time Monitor.
Logging and SIEM

The Message Broker Handler, the Event Message Broker, the Bridge Service, the SIEM Connector, Cloud App Service, and Multiplexer work together to gather and forward logging data from Filtering Service to:

  • A specified SIEM solution
  • Log Server
  • The Log Database