Fastvue TMG Reporter analyzes the information in Forefront TMG's web proxy and firewall log files. If usernames and sitenames are logged, then they will appear in TMG Reporter.
If you are not seeing Usernames or Sitenames in TMG Reporter, this means that Forefront TMG is not logging values for these fields.
Usernames not logged?
Usernames will only be logged if your users are authenticating against the TMG proxy.
For web traffic, check that your 'allow' Web rules are requiring authentication. That is, instead of allow 'All Users', set it to 'Authenticated Users'.
For non-Web traffic, the firewall client needs to be installed on your client computers. Once authenticated, their usernames will be logged.
You can also configure TMG to require all users to authenticate:
- Open the Microsoft Forefront TMG Management console.
- Click on the ‘Networking’ node in the left pane and select the ‘Networks’ tab in the right pane.
- Right click on the ‘Internal’ network and select ‘Properties’.
- Select the ‘Web Proxy’ tab and click on the ‘Authentication…’ button.
- Select the ‘Require all users to authenticate’ checkbox.
- Click ‘OK’ to save changes.
- Repeat the same procedure for ‘Local Host’ in the Networks Tab.
Sitenames not logged?
There are a couple of known reasons why Forefront TMG may not log site names. In these cases, Forefront TMG will log the destination IP instead of the actual URL.
These reasons are:
- If the Proxy clients are SecureNAT
- If the Firewall Clients cannot use the "automatic configuration" setting
If either of these are the case, you might like to checkout the loghostname product by Collective Software to improve the information in the log. Note, if you use this option, you may need to change your Proxy log format to Text (W3C) as the LogHostName product does not appear to affect the default SQL Express logs. See Site names still not showing after setting up loghostname.
Here are some more resources on these topics. The first link refers to ISA server, but the steps and general theory is the same for TMG: