Fortinet black logo

Administration Guide

Reliable web filter statistics

Reliable web filter statistics

FortiOS provides command line tools to view the Web Filter statistics report. These command line tools currently fall into either proxy-based or flow-based Web Filter statistics commands.

Proxy-based Web Filter statistics report

  • The proxy-based Web Filter statistics command line tools are as follows. These commands are available in both global or per-VDOM command lines.
    #diagnose wad filter   <----define the interested objects for output
    (global) # diagnose wad ?
    console-log    Send WAD log messages to the console.
    debug          Debug setting.
    stats          Show statistics.
    filter         Filter for listing sessions or tunnels. <----use filter to filter-out interested object and output
    kxp            SSL KXP diagnostics.
    user           User diagnostics.
    memory         WAD memory diagnostics.
    restore        Restore configuration defaults.
    history        Statistics history.
    session        Session diagnostics.
    tunnel         Tunnel diagnostics.
    webcache       Web cache statistics.
    worker         Worker diagnostics.
    csvc           Cache service diagnostics.
     
    #diagnose wad stat filter list/clear <----list/clear Web Filter/DLP statistics report
  • In the example below, there are two VDOMs using proxy-based policies which have Web Filter profiles enabled. The command line can be used to view the proxy-based Web Filter statistics report.
    (global) # diagnose wad filter ?
    list                    Display current filter.
    clear                   Erase current filter settings.
    src                     Source address range to filter by.
    dst                     Destination address range to filter by.
    sport                   Source port range to filter by.
    dport                   Destination port range to filter by.
    vd                      Virtual Domain Name.  <----filter for per-vdom or global statistics report
    explicit-policy         Index of explicit-policy. -1 matches all.
    firewall-policy         Index of firewall-policy. -1 matches all.
    drop-unknown-session    Enable drop message unknown sessions.
    negate                  Negate the specified filter parameter.
    protocol                Select protocols to filter by.
     
    FGT_600D-ICAP-NAT (global) # diagnose wad filter vd 
    <vdom>    Virtual Domain Name.
    ALL     all vdoms
    root    vdom
    vdom1   vdom
    
    FGT_600D-ICAP-NAT (global) # diagnose wad filter vd root  <----filter-out root vdom statistics  
    Drop_unknown_session is enabled.
    
    FGT_600D-ICAP-NAT (global) # diagnose wad stats filter list
    filtering of vdom root  <----Displayed the WF statistics for root vdom
      dlp          = 0      <----Number of Reuqest that DLP Sensor processed;
      content-type = 0      <----Number of Reuqest that matching content-type filter;
      urls:
        examined = 6  <----Number of Request that Proxy Web-Filter(all wad daemons) examined;
        allowed = 3   <----Number of Request that be allowed in the examined requests;
        blocked = 0   <----Number of Request that be blocked in the examined requests;
        logged = 0    <----Number of Request that be logged in the examined requests;
        overridden = 0 <----Number of Request that be overrided to another Web Filter profile in the examined requests;
    
    FGT_600D-ICAP-NAT (global) # diagnose wad filter vd vdom1  <----filter-out vdom1 statistics
    
    FGT_600D-ICAP-NAT (global) # diagnose wad stats filter list
    filtering of vdom vdom1  <----Displayed the WF statistics for vdom1
      dlp          = 0
      content-type = 0
      urls:
        examined = 13
        allowed = 2
        blocked = 9
        logged = 8
        overridden = 0
    
    FGT_600D-ICAP-NAT (global) # diagnose wad filter vd ALL 
    
    FGT_600D-ICAP-NAT (global) # diagnose wad stats filter list
    filtering of all accessible vdoms  <----global statistics is sum of two VDOMs
      dlp          = 0
      content-type = 0
      urls:
        examined = 19
        allowed = 5
        blocked = 9
        logged = 8
        overridden = 0

Flow-based Web Filter statistics report

  • The command to check the flow-based Web Filter statistics is:

    # diag webfilter stats list <vdom/global>

    This command is available in both VDOM and global command lines.

  • In the example below, the VDOM is using flow-based policies which have Web Filter profiles enabled.
    FGT # diag webfilter stats list root
    Proxy/flow URL filter stats:
    request:   9474 <----Number of Requests that Flow Web-Filter(all ips engines) received;
    blocked:   8606 <----Number of Request that Flow Web-Filter blocked;
    allowed:   868 <----Number of Request that Flow Web-Filter allowed;
    overridden:0 <----Number of Request that be overrided to another Web Filter profile in the examined requests;
    logged:    8606 <----Number of Request that be logged in the examined requests;
    pending:   0 <----Number of Requests that under processing at that moment;

Reliable web filter statistics

FortiOS provides command line tools to view the Web Filter statistics report. These command line tools currently fall into either proxy-based or flow-based Web Filter statistics commands.

Proxy-based Web Filter statistics report

  • The proxy-based Web Filter statistics command line tools are as follows. These commands are available in both global or per-VDOM command lines.
    #diagnose wad filter   <----define the interested objects for output
    (global) # diagnose wad ?
    console-log    Send WAD log messages to the console.
    debug          Debug setting.
    stats          Show statistics.
    filter         Filter for listing sessions or tunnels. <----use filter to filter-out interested object and output
    kxp            SSL KXP diagnostics.
    user           User diagnostics.
    memory         WAD memory diagnostics.
    restore        Restore configuration defaults.
    history        Statistics history.
    session        Session diagnostics.
    tunnel         Tunnel diagnostics.
    webcache       Web cache statistics.
    worker         Worker diagnostics.
    csvc           Cache service diagnostics.
     
    #diagnose wad stat filter list/clear <----list/clear Web Filter/DLP statistics report
  • In the example below, there are two VDOMs using proxy-based policies which have Web Filter profiles enabled. The command line can be used to view the proxy-based Web Filter statistics report.
    (global) # diagnose wad filter ?
    list                    Display current filter.
    clear                   Erase current filter settings.
    src                     Source address range to filter by.
    dst                     Destination address range to filter by.
    sport                   Source port range to filter by.
    dport                   Destination port range to filter by.
    vd                      Virtual Domain Name.  <----filter for per-vdom or global statistics report
    explicit-policy         Index of explicit-policy. -1 matches all.
    firewall-policy         Index of firewall-policy. -1 matches all.
    drop-unknown-session    Enable drop message unknown sessions.
    negate                  Negate the specified filter parameter.
    protocol                Select protocols to filter by.
     
    FGT_600D-ICAP-NAT (global) # diagnose wad filter vd 
    <vdom>    Virtual Domain Name.
    ALL     all vdoms
    root    vdom
    vdom1   vdom
    
    FGT_600D-ICAP-NAT (global) # diagnose wad filter vd root  <----filter-out root vdom statistics  
    Drop_unknown_session is enabled.
    
    FGT_600D-ICAP-NAT (global) # diagnose wad stats filter list
    filtering of vdom root  <----Displayed the WF statistics for root vdom
      dlp          = 0      <----Number of Reuqest that DLP Sensor processed;
      content-type = 0      <----Number of Reuqest that matching content-type filter;
      urls:
        examined = 6  <----Number of Request that Proxy Web-Filter(all wad daemons) examined;
        allowed = 3   <----Number of Request that be allowed in the examined requests;
        blocked = 0   <----Number of Request that be blocked in the examined requests;
        logged = 0    <----Number of Request that be logged in the examined requests;
        overridden = 0 <----Number of Request that be overrided to another Web Filter profile in the examined requests;
    
    FGT_600D-ICAP-NAT (global) # diagnose wad filter vd vdom1  <----filter-out vdom1 statistics
    
    FGT_600D-ICAP-NAT (global) # diagnose wad stats filter list
    filtering of vdom vdom1  <----Displayed the WF statistics for vdom1
      dlp          = 0
      content-type = 0
      urls:
        examined = 13
        allowed = 2
        blocked = 9
        logged = 8
        overridden = 0
    
    FGT_600D-ICAP-NAT (global) # diagnose wad filter vd ALL 
    
    FGT_600D-ICAP-NAT (global) # diagnose wad stats filter list
    filtering of all accessible vdoms  <----global statistics is sum of two VDOMs
      dlp          = 0
      content-type = 0
      urls:
        examined = 19
        allowed = 5
        blocked = 9
        logged = 8
        overridden = 0

Flow-based Web Filter statistics report

  • The command to check the flow-based Web Filter statistics is:

    # diag webfilter stats list <vdom/global>

    This command is available in both VDOM and global command lines.

  • In the example below, the VDOM is using flow-based policies which have Web Filter profiles enabled.
    FGT # diag webfilter stats list root
    Proxy/flow URL filter stats:
    request:   9474 <----Number of Requests that Flow Web-Filter(all ips engines) received;
    blocked:   8606 <----Number of Request that Flow Web-Filter blocked;
    allowed:   868 <----Number of Request that Flow Web-Filter allowed;
    overridden:0 <----Number of Request that be overrided to another Web Filter profile in the examined requests;
    logged:    8606 <----Number of Request that be logged in the examined requests;
    pending:   0 <----Number of Requests that under processing at that moment;