We will investigate in Websense why such URL address is getting blocked, even though the URL address is not in any of the denied list with Websense
Problem: WebSense is blocking the current URL (http://www.dogoodgiveblood.org/), which is not suppose to be, and we are asked to figured out why?
Trouble shooting steps:
Log in to the Websense server, and open Websense Enterprise manager.Click on Server, Settings, Click on logging/Events
On the Log Server (point it to server itself, if it is not) we are doing this to perform a test, to find out why Websense is blocking this URL address.
Now let's take a look at two services on the Websense servers
Websense Filtering Service
Filters and logs Internet and protocol traffic.
C:\Program Files\Websense\bin\EIMServer.exe -scm
Now drill down to this directory on you Websense server from DOS command prompt
In the bin directory we will execute exe program called "testlogserver" with a switch –onlyIP as below
C:\Program Files\Websense\bin>testlogserver -onlyip 10.160.10.131
The IP address in this example is belong to the workstation where I will be opening internet browser and hit the URL in this example (http://www.dogoodgiveblood.org/),
I am basically telling Websense if you see any traffic being generated from this IP capture it.
As soon as I hit the above website I am capturing below data on the DOS screen
Using version 3
time=Fri Jun 22 17:33:49 2007 version=3
server=10.248.2.1 source=10.162.18.131 dest=22.214.171.124
category= 14 (GAMES)
disposition= 1025 (CATEGORY BLOCKED)
app type= ""
user= "LDAP://10.160.9.86 OU=Mail Test,OU=Service Accounts,OU=NHQ Region
bytes sent=0 bytes received=0 duration=0
As you see Websense is making mistake and categorizing this URL as game, if you are asking why, which I asked the WebSense support they said, they make mistakes time to time, this is why we have recategorized option in WebSense application server, which is the option to recategorize this URL correctly.( adding into a allowed category)