Log Sessions

A session is a user's activity at a specified site or with a specified application. The session starts when a user connects to an application or to a site. The Security Gateway includes all the activity that the user does in the session in one session log (in contrast to the firewall log which shows top sources, destinations, and services).

To search for log sessions:

In the Logs tab of the Logs & Monitor view, search for type:Session

To see details of the log session:

In the Logs tab of the Logs & Monitor view, select a session log.

In the bottom pane of the Logs tab, click the tabs to see details of the session log:

• Connections - Shows all the connections in the session. These show if Per connection is selected in the Track option of the rule.
• URLs - Shows all the URLs in the session. These show if Extended Log is selected in the Track option of the rule.
• Files - Shows all the files uploaded or downloaded in the session. These show if Extended Log is selected in the Track option of the rule, or if a Data Type was matched on the connection.

To see the session log for a connection that is part of a session:

1. In the Logs tab of the Logs & Monitor view, double-click on the log record of a connection that is part of a session.
2. In the Log Details, click the session icon (in the top-right corner) to search for the session log in a new tab.

To configure the session timeout:

By default, after a session continues for three hours, the Security Gateway starts a new session log. You can change this in SmartConsole from the Manage & Settings view, in Blades > Application and URL Filtering > Advanced Settings > General > Connection unification.