Checking counters in WebGateway

[User48864082]

In the WebGateway UI we can go to the dashboards and display charts for various activity, How can we check this activity, but in a numerical form? I am especially interested in the counters for blocked URLs.

[fw_mon]

Hello @User48864082 

you can access most counters using Statistics.Counter.Get and Statistics.Counter.GetCurrent properties.

Another option is to use SNMP, check MIBs under Configuration > SNMP

[User48864082]

Well unfortunately I don't have Splunk at my disposal.

This ia maybe a "stupid" question but, as for Statistics.Counter.Get where can I use it? In the rules in actions I see Statistics.Counter.Increment but not Get. I have access to the GUI and cli of the appliance.

[fw_mon · Accepted solution]

you can access counters via the rule and write them to log or include in a block page.

Create this rule in Error Handler under Default > Monitoring:

Name: Get HTTPS Counters
Rule Criteria: Incident.ID equals 5
Action: Continue
Events:
Set User-Defined.logLine = DateTime.ToISOString
+ " "
+ Number.ToString (Statistics.Counter.GetCurrent ("HttpsRequests"))
FileSystemLogging.WriteLogEntry (User-Defined.logLine)

In statistics.log you'll see req/s every minute:

In statistics.log you'll see req/min every minute:

2023-01-16 13:52:11 350
2023-01-16 13:53:11 342
2023-01-16 13:54:11 371

If you need req/sec then divide the number by 60.

Here you'll find a list of all available counters (many of them aren't documented):

proxy-test.com/README.html#list_of_counters

[User48864082]

Thanks for your reply, I got inspired by it and added 2 log lines to my access denied log.

String.ReplaceIfEquals(Number.ToString(Statistics.Counter.Get ("BlockedByURLFilter")), "", "-")
""|""
Number.ToString(Statistics.Counter.Get ("BlockedByURLFilter"))
""

Then I made some requests that I know for sure got blocked:

[16/Jan/2023:17:48:16] "hostX" "-" Y.Y.Y.Y 89.187.129.29 "some_site.zz" 403 "-" 117 0 "GET http://some_site.zz/ HTTP/1.1" "Potential Criminal Activities, Messaging, Phishing, Spam URLs" "High Risk" 127 "Special URL Filtering Group/Block URLs Whose Category Is in Category Blocklist for Special Group" 10 "Blocked by URL filtering" false "-" false "Unverified" "-" "-" "curl/7.85.0" "0"|"0"

But still got 0, I just wanted the total counter value.

[fw_mon]

make sure your BlockedByURLFilter get incremented each type a request is blocked, it must be an event in each URL blocking rule that increment the counter. See default MWG rules for an example.

also check that you referencing the same Statistics Settings (ex. Default)

You may have your reasons, but is usually not a best idea to write counters to the access.log because you're mixing info about this particular request with a general statistics.

[User48864082]

yep checked that also, here is a screenshot from the rule tracing I did. I also checked the rules and the counter should be incremented.

[fw_mon]

show ruletracing for the logging part

[User48864082]

After some break I rechecked everything and one thing was wrong the statistics setting has to be set to Default, now it works correctly. As for my reasons, they are business related....

Thanks for the help.