Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
jrpayne
New Contributor

FAZ Reporting

I am also very disappointed with my FAZ. The reporting is not useful. I have been trying forever to get answers about some of it. For example, we frequently get requests from managers for an employee' s web browsing history for the past month. I have that some of those reports appear to be incriminating when in fact they are not. Let' s say that I give a manger a report that says the user visited Facebook or made an attempt to go to Facebook when in fact, they may have browsed a site that had a link to some Facebook material. So now you have an employee that cant explain to their manager why that is on their report and managers that are not educated enough to know how that can happen. In my environment, there needs to be a way to differentiate between things like that. We are a county government and things like that can get a person disciplined or worse. The closest thing, I have ever seen to that was when in the reports, you could specify " Web Clicks Only" which was determined by the amount of time spent there. Now I guess there is nothing. If there is something like that, I would love to know about it.
1 REPLY 1
L_FTNT
Staff
Staff

What you mentioned is a known limitation. The ‘reqtype’ (value: direct or referral) field in Web Filter log has been designed for this purpose and it uses ‘referrer’ field in the HTTP header to differentiate the user initiated visits from the non-user initiated visits - this can provide better reports to some extent but it still does NOT provide very accurate reports. This is because the ' referrer' field in the HTTP header ALONE is not reliable for this purpose. This field is set by browser and different browsers may have slightly different ways to handle certain cases so this field may or may not be set. For example, flashplayer can automatically load some resources without user' s interaction - a chrome browser may not be able to set the referer field in the HTTP header but a IE browser can. Another example is that when the user is at www.cnn.com and if he clicks a link on the webpage to facebook, the browser will set the referer field: www.cnn.com for the visit to facebook so the facebook visit will not be counted as the user initiated visit. If you or anyone else has a better suggestion on how to improve this, I believe Fortient would definitely be interested in looking into it. LC
Ling Lu
Labels
Top Kudoed Authors