We are using cloud security with cisco asa firewall. Our users are getting randomly error message like this.
When we checked couldn't find any blocked category message.So it is very difficult to troubleshoot.
Any idea why it is happening?
Thanks
Sissac
We have a site that is using an older version of Websense 6.3.3. We cannot upgrade it at this time. The issue is, Facebook is blocked when typing the http address in the URL area it will be blocked, BUT if it is searched via google it will present an HTTPS link and Websense cannot block it, How can I correct this?
Does Websense endpoint client fully supports all listed browsers below?
Has anyone ever had a chance to think or test this ;)
Hello!
Got "More than 100 files in the Log Server cache directory" alert in my console!
Don't know what to do with it. Nothing helps. 
Tricks from below KB's articles doesn't help:
1. http://www.websense.com/content/support/library/web/v77/triton_web_help/ts_ls_cachefiles.aspx
2.http://www.websense.com/support/article/t-kbarticle/BCP-files-are-not-written-to-the-SQL-database
Well... actions from articles helps, but only for 10 minutes and then alert appears again.
My SQL version is: SQL server 2008 R2
Any suggestions?
Thanks in advance!
Can you tell me when Websense Email Security V6.1 goes End of Life please.
I am on Web Filtering 7.6. Based on what I found on the forum, I have created a user defined category and placed an expression in the catergory to allow a specific Youtube channel to my users. Also, I opened up the YT protocol.
The result is that you can get to the page and everything looks great, but when you click play on a video, it just says an error occured. Please try again later. Below is what I see in testlogserver. Any help getting this fixed would be appreciated.
C:\Program Files (x86)\Websense\Web Security\bin>testlogserver -onlyip 10.0.130.
141
TestLogServer version 7.6.0
Accepting connections on port 55805...
Core code has connected.
Using version 5
time= Wed Aug 17 16:04:21 2011 version= 5
server= 10.0.80.116 source= 10.0.130.141 dest= 74.125.67.136
URL= http://www.youtube.com/user/TheRxMedic
protocol= 1 - http port= 80 networkDirection= Inbound
method=
contentType =
category= 1906 - unknown
categoryReason= 0 - CatNone
disposition= 1028 - Custom URL - Category Permitted
roleId= 0
bytes sent= 1194 bytes received= 19376
duration= 9000 ms scan duration= 0 ms
policyName=
time= Wed Aug 17 16:04:30 2011 version= 5
server= 10.0.80.116 source= 10.0.130.141 dest= 74.125.67.136
URL= http://www.youtube.com/crossdomain.xml
protocol= 1 - http port= 80 networkDirection= Inbound
method=
contentType =
category= 109 - STREAMING MEDIA
categoryReason= 0 - CatNone
disposition= 1025 - Category Blocked
roleId= 0
bytes sent= 550 bytes received= 259
duration= 0 ms scan duration= 0 ms
policyName=
time= Wed Aug 17 16:04:30 2011 version= 5
server= 10.0.80.116 source= 10.0.130.141 dest= 173.227.93.86
URL= YouTube://173.227.93.86:80
protocol= 120 - YouTube port= 80 networkDirection= Inbound
method=
contentType =
category= 1801 - PROTOCOL CATEGORY
categoryReason= 0 - CatNone
disposition= 1050 - Protocol Not Blocked
roleId= 0
bytes sent= 973 bytes received= 259
duration= 0 ms scan duration= 0 ms
policyName=
time= Wed Aug 17 16:04:30 2011 version= 5
server= 10.0.80.116 source= 10.0.130.141 dest= 74.125.67.139
URL= http://s.youtube.com/crossdomain.xml
protocol= 1 - http port= 80 networkDirection= Inbound
method=
contentType =
category= 109 - STREAMING MEDIA
categoryReason= 0 - CatNone
disposition= 1025 - Category Blocked
roleId= 0
bytes sent= 548 bytes received= 258
duration= 0 ms scan duration= 0 ms
policyName=
time= Wed Aug 17 16:04:30 2011 version= 5
server= 10.0.80.116 source= 10.0.130.141 dest= 208.117.238.150
URL= http://tc.v3.cache1.c.youtube.com/videoplayback?id=1812805d1f5af0ef&sparams
=id%2Cexpire%2Cip%2Cipbits%2Citag%2Calgorithm%2Cburst%2Cfactor%2Coc%3AU0hQSFZOVF
9FSkNOMF9OSFhF&burst=40&fexp=906335%2C903104%2C910104&itag=34&signature=CA1779D2
A077B4C6060F5749548301558FE66804.A7872B1D05896F36B986B4FC21E02F1D3EFE5BDA&ip=0.0
.0.0&factor=1.25&algorithm=throttle-factor&ipbits=0&key=yt1&expire=1313636400&sv
er=3&playretry=1
protocol= 1 - http port= 80 networkDirection= Inbound
method=
contentType =
category= 109 - STREAMING MEDIA
categoryReason= 0 - CatNone
disposition= 1025 - Category Blocked
roleId= 0
bytes sent= 986 bytes received= 259
duration= 0 ms scan duration= 0 ms
policyName=
time= Wed Aug 17 16:08:46 2011 version= 5
server= 10.0.80.116 source= 10.0.130.141 dest= 74.125.67.190
URL= http://youtube.com/
protocol= 1 - http port= 80 networkDirection= Inbound
method=
contentType =
category= 109 - STREAMING MEDIA
categoryReason= 0 - CatNone
disposition= 1025 - Category Blocked
roleId= 0
bytes sent= 575 bytes received= 258
duration= 0 ms scan duration= 0 ms
policyName=
time= Wed Aug 17 16:08:42 2011 version= 5
server= 10.0.80.116 source= 10.0.130.141 dest= 74.125.67.147
URL= http://www.google.com/
protocol= 1 - http port= 80 networkDirection= Inbound
method=
contentType =
category= 76 - SEARCH ENGINES AND PORTALS
categoryReason= 0 - CatNone
disposition= 1026 - Category Not Blocked
roleId= 0
bytes sent= 1073 bytes received= 17995
duration= 1000 ms scan duration= 0 ms
policyName=
time= Wed Aug 17 16:08:43 2011 version= 5
server= 10.0.80.116 source= 10.0.130.141 dest= 74.125.67.147
URL= http://www.google.com/client_204?&biw=1280&bih=817&ei=yh9MTpPQG5Catwel3OmKB
g
protocol= 1 - http port= 80 networkDirection= Inbound
method=
contentType =
category= 76 - SEARCH ENGINES AND PORTALS
categoryReason= 0 - CatNone
disposition= 1026 - Category Not Blocked
roleId= 0
bytes sent= 740 bytes received= 223
duration= 0 ms scan duration= 0 ms
policyName=
time= Wed Aug 17 16:08:43 2011 version= 5
server= 10.0.80.116 source= 10.0.130.141 dest= 74.125.67.147
URL= http://www.google.com/csi?v=3&s=webhp&action=&e=25657,28936,29774,30053,303
16,30542,31935,32035,32083&ei=yh9MTpPQG5Catwel3OmKBg&expi=25657,28936,29774,3005
3,30316,30542,31935,32035,32083&imc=5&imn=5&imp=5&rt=xjsls.78,prt.140,ol.218,iml
.172,xjses.390,xjsee.547,xjs.672
protocol= 1 - http port= 80 networkDirection= Inbound
method=
contentType =
category= 76 - SEARCH ENGINES AND PORTALS
categoryReason= 0 - CatNone
disposition= 1026 - Category Not Blocked
roleId= 0
bytes sent= 991 bytes received= 269
duration= 6000 ms scan duration= 0 ms
policyName=
Allow us to configure cache duration for the pac file when using the Websense Web Security Endpoint. This would improve performance of the browser when a user is working outside of the office.
Normal 0 false false false EN-US X-NONE X-NONE
My customer wants to host the PAC file on a web server in their DMZ, so it is visible both internally and externally. We are using split-horizon DNS with a domain name owned by the customer. This functions well, and we have a working PAC file.
The problem we have is when using the Websense endpoint, it ignores the location of the PAC file that we specify, and points all browsers to the Websense-hosted PAC file (eg http://hybrid-web.global.blackspider.com:8082/proxy.pac?p=xxxxxxx).
The Websense-hosted PAC file is not visible from the customer's internal networks, and will prevent the endpoint devices from roaming freely between internal and external networks. Their security policy forbids granting all internal clients to access the Websense-hosted PAC file through the firewall (for obvious reasons).
Is there any way of forcing the Websense endpoint to use a PAC file that is not hosted by Websense?
Hi there,
I try to make the Mobile Security work on my own phone using the cloud security, but for some reason when I'm at the point of installing the profile, it tells "A transaction with the server at "https://mobile.websense.net/cgi-py/device.py" has failed with the status "500"."
Actually I have no idea what does it mean in my case... Have anyone met with this before?
Miklos
We’re using Triton Version 7.6 and I’m trying to exclude servers and printers from using Websense licenses. I have followed the notes on adding them to the Network Agent ‘Monitor List Exceptions’ but they are still taking up licenses. Is there any way around this?
Hi,
I am getting the error on the event log.
Faulting application name: UsageMonitor.exe, version: 7.6.2.1449, time stamp: 0x4e8a78a9
Faulting module name: MSVCR90.dll, version: 9.0.30729.4940, time stamp: 0x4ca2ef57
Exception code: 0x40000015
Fault offset: 0x0005beae
Faulting process id: 0x16c4
Faulting application start time: 0x01ce9840a0f7de21
Faulting application path: C:\Program Files (x86)\Websense\Web Security\bin\UsageMonitor.exe
Faulting module path: C:\Windows\WinSxS\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_50916076bcb9a742\MSVCR90.dll
Report Id: ded6f3df-0433-11e3-b4ea-00155d005400
Thanks for any help!
K.
The scan with endpoint discovery taking a long time, it possible to add these features:
I want to upgrade from Websense 7.1 to 7.7. The document at http://www.websense.com/support/article/kbarticle/upgrade-and-migration-to-v76 seemed clear enough.
I attempted to install 7.1 in a test environment and got an error. When I tried to uninstall it I got a, “No Java Runtime (JRE) was found on the system. When researching this error I remembered that 7.1 is not support on an x64 system.
How do I upgrade my Websense 7.1 running Windows 2008 x86, to Websense 7.7 running on Windows 2008 R2 x64?
Hello everyone,
In an environment with Websense Web security integrated with Cisco ASA, We are unable to see bandwidth reports.
Do you guys know if it's a normal behavior, I mean between Websense and ASA? I know that when We use a Forefront TMG integration We can see the bandwidth report without any problem
Thank you!
Hi,
I was wondering if there was a way to change the default timeout of 30 minutes to something more reasonable? 30 minutes is rediculous. It also times out the Investigative Reports when open in a new window causing me to lose what I had on the screen.
At least in Websense 6 you could change the timeout to something more reasonable.
Thank you,
Steve
How do 3rd part SIEMS providers sign up for notifications for changes to categories and log formats?
I also not noticed that SEIM severity is 1 or 7 (blocked or not blocked) this is not useful, for incident response purposes it would be helpful to know when high severity events occurred.
We upgraded from Citrix Presentation Manager 4.5 to XenApp 6.5 in the fall and from what I can tell, 7.5, 7.6 nor 7.7 -- none of these Websense Web Security products support integration with XenApp 6.5 only 5 and 6.0 Websense has always supported Citrix integration (for user based policy), and 6.5 has been out for over a year... I'm really disappointed that Websense has not provided support for it, unless I just don't see where /how ? How are others handling this issue? I suppose I could continue filtering with a general policy, but when human resources asks me for a report to show web browsing activity for an individual citrix user, I will be left explaining that I cannot provide it .... Is there an ETA for XenApp 6.5 integration support ? This is really important and may result in my searchign for another product/solution all together.. which would be a shame.
I am re-installing our Websense, after our config.xml got corrupted. I'm on a screen during TRITON Infrastructure Setup that is asking for:
"Specify user credentials to be used by TRITON Infrastructure and other TRITON Unified Security Center components when running services or logging on to other machines."
What level of rights do I absolutely need to assign to this accout? We don't like giving Domain Admin unless there's no other way.
Thanks,
Joe
Our install of 7.7 blew up on me. When we initially installed way back when, we were on Novell for our users and files. Since then, we've moved to a complete Active Directory environment. My thoughts are that since we blew up, it's a good time to start from scratch, including moving from SQL Express to SQL Standard. I've done a very little reading, and I've read posts saying not to go to 7.7.3, but those seemed a little old.
Has 7.7.3 been fixed, and is it the recommended version now, or should I install 7.7?
Also, I'm looking at re-installing our Content Gateway. We don't own Red Hat, but I was looking at downloading CentOS, since it's supposed to be pretty much the same thing. I've read the Websense is certified with 6.3, but has that been updated to 6.4, yet, or no?
Thanks,
Joe
For our new installation of web security 7.7.3, we need to be able to support over 3000 concurrent users surfing through (2) TMG 2010 servers. We are having a problem with CPU utilization on the remote SQL server at peak surfing times
The remote SQL serve is a VMware virtual server. Win 2008 R2 Std, 64 bit, with (3) 3.06 GHZ processors and (16) GB ram. SQL 2008 R2. This sql serve also does the back end for a couple of other apps
Does anybody have any numbers or recomendation on the CPU and RAM required for the remote sql serve in this situation? Does the server listed above seem under powered for this application? Thanks