URL Logs

URL logs provide statistics on requested URLs. You can view URL logs to check why access to some URLs is allowed, blocked or allowed with an alert record.

Context

The FW is deployed between an intranet and the Internet. If the URL that a user accesses matches a whitelist, blacklist, or URL category with the action of alert or block in the URL filtering profile, the FW generates a URL log.

Before viewing URL logs, ensure that you have configured the URL filtering function on the FW.

To view URL remote query logs, ensure that the URL remote query license has been installed on the FW and the URL remote query component package has been dynamically loaded.

Before querying URL logs on the USG6510E/6510E-POE/6530E, run the log type url enable command to enable the URL log function.

Procedure

Choose Monitor > Logs > URL Logs to view URL logs.
Choose Customize and select/deselect conditions for URL log display.
Optional: Click to export URL logs in CSV format to the management PC.
Click Add Filter and select search conditions to filter logs.
If the device has no disk, click Advanced Search to filter logs.
Optional: You can click to save the current log query conditions as a log query template for future use.
The next time you want to use these query conditions, you only need to click to select the template name and click OK. Then the system queries logs based on the template conditions. The device administrator can click Template Distribution to view the number of templates created by each user. In addition, you can click to delete a log query template.

Only the user that creates a log query template can view or use this template.

Each log page supports a maximum of 10 log query templates, and a device supports a maximum of 1000 log query templates.

Log Sample

The following figure shows the URL logs generated within a specific time range:

The following table lists the fields in a URL log.

Field	Description
View	Click . In View URL Log Details, the details of each field in a URL log are displayed. In View URL Log Details, click the Source Region/Destination Region/Source Address/Destination Address/Source User/Application/URL Category/Security Policy/Profile field value. You can view and operate existing field settings. Based on the Referer field in the URL column of View URL Log Details, you can view the domain name from which the URL is redirected. For example, if Referer is www.example.com, the URL is redirected from www.example.com; if Referer is the domain name in the referer field of a URL request and referer field of the URL request is empty, Referer is displayed none.
Time	Time when a URL log is generated
URL Categories	Matched URL category
URL	Requested URL
Filtering Type	URL filtering type: Blacklist Whitelist User-Defined Predefined Malicious Category Exception Packet Unknown Category Safe search Restrict google account
Source Zone	Source security zone of traffic
Destination Zone	Destination security zone of traffic
Source Region	Source region of the traffic
Destination Region	Destination region of the traffic
Source Address	Source IP address of traffic
Destination Address	Destination IP address of traffic
Source User	User who generates traffic
Source Port	Source port of traffic
Destination Port	Destination port of traffic
Application	Application type of traffic
Action	Action defined in the URL filtering profile that traffic matches
Security Policy	Security policy that traffic matches
Profile	Security profile that traffic matches
Virtual System	Virtual system that generates the traffic

During URL log analysis, you can click Advanced Search and choose Whitelist, Blacklist, User-Defined, Predefined, Exception Packet, Malicious Category, or Unknown Category in Filtering Type to query the logs of URL filtering results, including the URLs accessed by each user, matched security policies, and the URL filtering configuration file. You can configure measures accordingly as follows:

**Table 1** URL log field settings
Field	Setting
Source Address/Destination Address	Click the Source Address/Destination Address field value of a specific URL log. Add Blacklist Entry is displayed. The parameters in Add Blacklist Entry are as follows: Type: The source/destination address is automatically blacklisted. Source IP/Destination IP: The source/destination IP address is automatically blacklisted. Protocol: The protocol type is automatically blacklisted. Source Port/Destination Port: The source/destination port is automatically blacklisted. Timeout: You can use either of the following methods to set a timeout period for a blacklist entry: Select Unlimited to permanently blacklist the source/destination address. Enter a timeout period.
Source Region/Destination Region	Click the Source Region/Destination Region of the URL logs to be controlled, access Edit Region, and change the region configuration as required.
Source User	Click the Source User field value of a specific URL log. Modify User is displayed. You can modify the user configurations as required.
Application	Click the Application field value of a specific URL log. Application Details is displayed. You can view application details and configure port mappings.
URL Category	Click the URL Category field value of a specific URL log. Modify URL Category is displayed. You can modify URL category configurations.
Security Policy	Click the Security Policy field value of a specific URL log. Modify Security Policy is displayed. You can change the settings of the source address, destination address, user, application, time range, action, and security profile.
Profile	Click the Profile field value of a specific URL log. Modify URL Filtering Profile is displayed. Reconfigure the URL filtering profile as desired. For example: If some work-related websites are frequently requested, modify the URL filtering profile to add these work-related websites to the whitelist. If some non-work-related websites are frequently requested, modify the URL filtering profile to add these work-related websites to the blacklist. If users need to access websites a certain URL category for work-related reasons but the action for this URL category is block, modify the URL filtering profile and set the action for the URL category to alert or permit.