Web Control Report Error

[polcalweng 0]

I am trying to create a report for Web Control. I am having an issue when selecting Web Control - Action Performed, I keep on getting <Error Request Timeout 90000 ms exceeded>. Is this a network-related issue?

 

[Marcos 5,092]

What Web Control rules did you create with higher than informative severity? Couldn't it be that too many data is reported to the ESET PROTECT server which causes a load and time outs while generating reports?

[polcalweng 0]

I created one for Allowed Sites which is set to Warning and the Blocked Sites Severity is set to None. What's the best practice on setting this up?

[Marcos 5,092]

That's not good. Creating a rule to log all opened urls may results in huge logs, causing the EP Server to get overloaded and stop doing basic operations. You may even encounter issues logging to the web console. I'd recommend removing the rule asap.

[polcalweng 0]

I changed the Allowed sites policy Logging Severity to NONE and Blocked sites to Warning. Is that okay?

[Marcos 5,092]

While that will prevent Web Control data about visited websites from being reported to the ESET PROTECT server, the rule will continue to create huge records locally which will not only consume disk space but may also negatively affect performance.

[polcalweng 0]

So what's the best practice setup to avoid that?

[Marcos 5,092]

5 hours ago, polcalweng said:

So what's the best practice setup to avoid that?

Don't create a permissive Web Control rule for all visited websites. Create only block rules for desired categories or URLs. If necessary to create an exception, create a permissive rule for a particular URL and put  it above the block rule(s).

[polcalweng 0]

I only created an Allowed sites URL-based rule for sites that falls under the Block Category and placed it above the Blocked Category-based rule. That way, those sites will still be accessible even if that particular category block rule is still in effect. Will this setup be an issue?

[Marcos 5,092]

You did it correctly, there should be no issues.

[polcalweng 0]

Thanks for usual help, Marcos. By the way, I'm getting this error when creating a filter on Web Control Report. Is this due to the previous setup of the Web Control Policy? Is there a way to resolve this?

 

[Marcos 5,092]

The data already exists in the database and will be cleaned after 1 month. You'll need to delete the records from the db directly, I assume that @MartinKwill be able to provide details since I currently cannot access my EP db.

[MartinK 378]

I would recommend to check size of database table tblf_webcontrolagregated_event to confirm that issue with report filters is caused by amount of data collected, and not some other issue. If so, solution might be increasing performance parameters of your DB server (if possible) or removal of data, but is not recommended in case there are not more significant impacts.
Also what are the performance characteristics of your DB server? And what type of DB server (MySQL or MS SQL Server) is actually used?

[MartinK 378]

Also if possible, please provide us details of your use-case, so that we can possibly focus more on this scenario. We are mostly interested why are you collecting such data, what is the expected output and what would you do with reports generated in console (i.e. postprocessing) - especially in what granularity you are analyzing them, whether you are just checking some statistics or you are interested in per-request granularity, etc....