Session Browser?

[rich.hansen]

Just looked at Monitor->Session Browser. This is cool! Why is it not documented anywhere? Is it new and I just missed something?

[nrice · Accepted solution]

It is a new feature in 3.1.0 and as you noted, apparently didn't make it into the documentation.  We'll have to fix that.

[bhavin_bhatt]

Hi there

could you please tell us what kind of information one could use out of this, i has the session flows, but why dont we see every session flow ... i aam basically trying to download something from the browser, but cannot, i cant see any denies/blocks in ur logs or traffic logs or data filtering logs...but when i look in session browser i see that flow ther, what can i deduce from this...sorry for asking a silly question, just struggling a littel with this,

Kind regards

Bhav

[James]

Hi Bhav,

The session browser will show all sessions.

If you see a session there and nothing in the logs - this could be for two reasons, in general:

1.  You have an implicit deny rule at the end, which does not log

2.  You do not have log at session start and the session has not ended yet for it to be logged

So if it is one - then maybe you need to work out why it is being blocked.  For this you could temporarily log blocked sessions by adding a new rule in to do this and log.  Or if it is two, then wait for the session to finish.

Thanks

James

[bhavin_bhatt]

Hi James,

Thanks for the reply. I am afraid my case relates to number two. The issue i am having is that i am alerting on everything. And i still see this in a hung stage in the session browser, no trace in the url filtering or data filtering logs.

Cannot seem to find any other places to look for this. The session browser only gives session details and nothing else.

Regards

Bhav

[bpappas]

@Bhav:

If you are logging on session end then you have to wait for the session to end before you will see it in the traffic, threat, URL or data filtering logs.

if a session ends up in a hung state then it stands to reason that you would not see it in the logs yet.

-Benjamin