This article applies to:
- WebMarshal 6.1 and above
- HTTPS Content Inspection enabled
Question:
- How do I exclude inspected HTTPS connections and content from WebMarshal logging and reporting?
- Security concern about reporting information on HTTPS connections
Procedure:
By default WebMarshal logging (both database and traffic/WELF logging) includes information about inspected HTTPS content. You may want to exclude this information from logging while still logging information about HTTP content.
To exclude HTTPS content from logging, create the following three rules at the top level of each rule type (not in a rule container):
HTTPS Rules
Exclude HTTPS rules from logging
When a web request is received
For any user
And where addressed to any URL
Exclude the site from reporting (do not log browsing)
And continue processing rules
Standard Rules
Exclude inspected HTTPS Content from logging by Standard rules
When a web request is received
For any user
And where addressed to any URL
Where the content is inspected HTTPS content
Exclude the site from reporting (do not log browsing)
And continue processing rules
Content Analysis Rules
Exclude inspected HTTPS content from logging by Content Analysis rules
When a web request is received
For any user
And where addressed to any URL
Where the content is inspected HTTPS content
Exclude the site from reporting (do not log browsing)
And continue processing rules
Notes:
- You must create all three rules to completely exclude HTTPS content from logging.
- Be sure that these rules are created at the top level of each rule type.
- To log information selectively (by site or user), include other conditions in the rules.
- Traces of activity could still be found in the WebMarshal service text logs. However at the default logging level the information included in the service logs will not include secure content.