Reporting Installation Guide

(1)

Reporting Installation Guide

v 6 . 3 . 1 W e b s e n s e E n t e r p r i s e^® W e b s e n s e^® W e b S e c u r i t y S u i t e^{T M}

(2)

10240 Sorrento Valley Rd., San Diego, CA 92121, USA Published April 17, 2007

Printed in the United States of America and Ireland

The products and/or methods of use described in this document are covered by U.S. Patent Numbers 6,606,659 and 6,947,985 and other patents pending.

This document may not, in whole or in part, be copied, photocopied, reproduced, translated, or reduced to any electronic medium or machine-readable form without prior consent in writing from Websense Inc.

Every effort has been made to ensure the accuracy of this manual. However, Websense Inc., makes no warranties with respect to this documentation and disclaims any implied warranties of merchantability and fitness for a particular purpose.

Websense Inc. shall not be liable for any error or for incidental or consequential damages in connection with the furnishing, performance, or use of this manual or the examples herein. The information in this documentation is subject to change without notice.

Trademarks

Websense and Websense Enterprise are registered trademarks of Websense, Inc. in the United States and certain international markets. Websense has numerous other unregistered trademarks in the United States and internationally. All other trademarks are the property of their respective owners.

Microsoft, Windows, Windows NT, Windows Server, and Active Directory are either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries.

Sun, Solaris, UltraSPARC, Sun Java System, and all Sun Java System based trademarks and logos are trademarks or registered trademarks of Sun Microsystems, Inc., in the United States and other countries.

Netscape is a registered trademark of Netscape Communications Corporation in the U.S. and other countries. Netscape Navigator and Netscape Communicator are also trademarks of Netscape Communications Corporation and may be registered outside the U.S.

eDirectory and Novell Directory Services are a registered trademarks of Novell, Inc., in the U.S. and other countries.

Adobe, Acrobat, and Acrobat Reader are either registered trademarks or trademarks of Adobe Systems Incorporated in the United States and/or other countries.

Pentium is a registered trademark of Intel Corporation.

Red Hat is a registered trademark of Red Hat, Inc., in the United States and other countries. Linux is a trademark of Linus Torvalds, in the United States and other countries.

This product includes software distributed by the Apache Software Foundation (http://www.apache.org).

Other product names mentioned in this manual may be trademarks or registered trademarks of their respective companies and are the sole property of their respective manufacturers.

(3)

Websense Enterprise Reporting Installation Guide 3

Log Server: Required for any Websense Enterprise Reporting component to work. Log Server creates the Log Database to which it sends internet activity, categories, protocols, and Risk Class names. Environments with a high volume of internet activity should consider placing Log Server on a separate machine. Log Server processing can consume considerable system resources, and could slow performance of other programs.

Log Database: Created and powered by Microsoft SQL Server or MSDE.

The term Log Database encompasses the Catalog Database, which is created at installation and database partitions for reporting. Thus, the Log Database receives and stores internet activity data.

Reporter: Client-based application that produces reports that can be generated automatically, and sent via email or printed. Reporter can be installed on multiple machines, each connected to the same Log Database.

This approach enables multiple managers, for example, to create reports from the same data and generate reports from different machines, at different times.

Websense Enterprise Explorer with Database Administration: Web- based application that produces a variety of easy-to-understand summary and detail reports.

Database Administration is located on the Reporting Tools Portal page and manages databases over time with scheduled rollover and automatic creation of database partitions. Default settings can be modified by the

(7)

Websense Enterprise Reporting Installation Guide 7 Chapter 1: Preinstallation Information

Web server - either Apache or Microsoft IIS (Apache is included in the installation package).

Web browser - Microsoft Internet Explorer v5.5 or later (not included in installation).

Database Engine. Generally the database engine should run on a separate machine from other Reporting components. Websense recommends that SQL Server 2000/2005 run on its own machine. The installation program places the database on the database engine machine. In environments with a low volume of internet activity, MSDE can run on the same machine with other Reporting components.

Policy Server. The Policy Server service must be running for the Log Server service to start. To maximize performance, do not install the Log Server or database engine on the Policy Server machine.

Online Help

Select the Help option within the program to display detailed information about using the product.

IMPORTANT

Install Log Server and the database before installing any other Reporting components, unless all components are being installed on one machine.

IMPORTANT

If Microsoft^® Internet Explorer is your browser, the default settings may block operation of the Help system. If a security alert appears, select Allow Blocked Content to display the Help.

If corporate security standards permit, you can permanently disable the warning message in Internet Explorer. Go to Tools >

Internet Options > Advanced tab > Security, and check Allow active content to run in files on My Computer.

(8)

Technical Support

Websense, Inc., is committed to customer satisfaction. Go to the Websense Technical Support website any time for the latest release information, a Knowledge Base, product documentation, or to create a support request.

www.websense.com/global/en/SupportAndKB/

The response time during business hours is approximately 4 hours. Response to after-hours requests occurs the next business day.

Telephone assistance is also available. For quick and efficient answers to telephone requests, Websense Technical support needs key information about your system.

Please be ready with the following:

Websense subscription key

Access to Websense Manager

Access to the machine running Filtering Service, the reporting components, and the database engine (MSDE or SQL)

Permission to access the Websense Log Database

Familiarity with your network’s architecture, or access to a person who has this knowledge

Specifications of the machines running Filtering Service and Websense Manager

A list of other applications running on the Filtering Service machine For severe problems, additional information may be needed.

Standard telephone assistance is available during normal business hours Monday through Friday at the following numbers:

San Diego, California, USA: +1 858.458.2940

London, England: +44 (0) 1932 796244

Customers in Japan should contact their distributor for the most rapid service.

(9)

Installation Checklist

This checklist is designed to help you before and during your Websense Enterprise Reporting installation. Print this checklist for reference as you prepare for and perform the Reporting installation, especially if you are deploying components to different machines.

1. Keep in mind

If the Enterprise Reporting components are installed on Windows Vista and you want to connect to a Log Database through an ODBC

connection to run reports, the domain controller must be on Windows 2000 or later.

Real-Time Analyzer (RTA) lets you drill down into internet access reports and view internet usage trends. For system requirements, see the Websense Deployment Guide. For installation information, see the appropriate Websense Installation Guide for your system.

The following services (components of Websense Enterprise) must be running during the Reporting installation.

Filtering Service Policy Server User Service

If you change default port numbers when installing Websense Enterprise, write them down. You may need the information when installing Reporting. ____________________________

If your web browser has strict settings for pop-up blocking, it may restrict or prevent the use of some Reporting features or components.

If you are running a Windows 2003 operating system: You must apply the Microsoft Windows 2003 Service Pack 1 (SP1) before downloading the Websense Language Pack during your Websense non-English installation.

Be sure a printer driver (appropriate for the operating system) is installed on the machine running Websense Enterprise Reporter before attempting to generate Reporter reports.

(10)

If you install Log Server on the same machine as Microsoft SQL Server and later upgrade SQL Server, the changes may prevent Log Server from starting. Run the Reporting installation again and choose the Repair option to restore normal Log Server operation.

2. Understand how to use Websense Setup

Websense products are installed from Websense Setup, which is downloaded from the Websense website at www.websense.com (located on the Downloads page), or launched from the Websense Installation CD. You will run Setup to install any of these products or their components.

Each of these products includes several modules, which also contain separate components. Setup can be used to install modules or single components on separate machines.

This checklist is meant to be used at each appropriate machine for installation.

3. Determine how you want to deploy Reporting components

The various components of Websense Enterprise Reporting may be installed on the same or different machines, depending on the network and the Database Engine used.

Install Log Server, the database, and the Database Engine before the other Reporting components. All components can be installed at the same time.

IMPORTANT

For performance reasons: Websense recommends that you do not install Websense Enterprise, Websense Enterprise Reporting, and Websense Enterprise Client Policy Manager on the same machine.

Note

Log Server, the database, and the Database Engine are required to use any other Reporting module or component.

(11)

For information on how to best deploy the products, modules, and components, see the Websense Deployment Guide. The link at the top of Setup Manager opens the most current version of the Websense Deployment Guide.

4. Verify that you have the appropriate minimum software and

hardware

Websense Enterprise components can be installed together on one machine, or distributed across multiple machines, depending on the operating systems and the size of the network.

Websense Enterprise v6.3.x: All the Reporting modules and their components rely on Websense Enterprise, so install Websense Enterprise before Websense Enterprise Reporting.

For complete and detailed information on general deployment recommendations, see the Websense Deployment Guide.

Database Engine:

______________________________________________________

Reporter:

_______________________________________________________

Log Server:

_______________________________________________________

Explorer with Database Administration:

_______________________________________________________

5. Select the appropriate components for this machine

Based on how you have chosen to deploy Websense Enterprise Reporting components, select or de-select each component by checking or unchecking the check box associated with each component listed.

Websense Enterprise Reporter: Client-based application that communicates with Websense Enterprise and manages information about internet activity.

Log Server: Required to receive, store, and report on internet activity.

Database: Required storage for data about internet activity.

(12)

Database Engine: Obtain and install either Microsoft SQL Server or MSDE.

If you use Microsoft SQL Server 2000 or 2005, you must perform the installation steps in a specific sequence to avoid installation problems.

See Installing with SQL Server 2000/2005, page 28.

Microsoft SQL Database Engine (MSDE) is not installed with Reporting. To use MSDE, you can obtain English or foreign language versions from Websense. Links appear during the installation procedure if Setup detects no supported database engine. When you download MSDE from these links, the Reporting installation procedure stops. You must set up MSDE first, and then rerun the Reporting setup.exe installation program.

Websense Enterprise Explorer with Database Administration: Web- based application that produces a variety of easy-to-use summary and flexible detail reports that can be designed and run by business managers and human resource professionals.

As part of the Explorer Web-based application, Database

Administration assists in managing the size of the database partitions, rolling over databases, and creating new ones.

Web server: Either Apache or Microsoft IIS (Apache is included in the installation package).

Web browser: Microsoft Internet Explorer v5.5 or later (not included in the installation).

6. Verify and record the Policy Server location

Verify and record the IP address or machine name where Policy Server is installed during the Websense Enterprise installation.

______________

Provide the port number Policy Server uses to communicate. The default port number is 55806. Select a different port number for Policy Server if the default port is not available ______________

7. If Microsoft IIS is used

(13)

Microsoft IIS: If a website has been created for another Websense product, the installer will use that website. If not, you will be required to set up a new website or use an existing website. In this case, use the Microsoft Windows Internet Services Manager.

8. Provide database engine location and decide how to connect to

the database

Record the IP address (preferred) or name of machine running the database engine (Microsoft SQL Server 2000/2005 or MSDE).

______________

When the database engine (Microsoft SQL Server 2000/2005 or MSDE) is located on a remote machine, the default location for installing the database file is C:\Program Files\Microsoft SQL

Server\Mssql\Data, which works properly unless SQL Server 2000/

2005 or MSDE was installed with an instance name. If this is the case, enter the name of an existing directory on the remote machine where the database should be installed. ______________________

Make note if a Trusted Connection is being used.

____________________________

Enter the user name and password that will be used to access the database. _________________________________________

For MSDE, use the “sa” user name (default name for the system administrator).

Provide membership for the public and SQLAgentUserRole roles in the Microsoft SQL Server 2005 ‘msdb’ database. See Configuring

Microsoft SQL Server 2005 user roles, page 29.

Note

Websense, Inc., recommends avoiding Trusted Connections when connecting to an MSDE database.

(14)

9. Determine where to install the database

Log Server and the database engine on the same machine: Click Browse to select a folder on the local machine for installing the database.

Log Server and the database engine on different machines: Enter the path for installing the database. This must be a local drive on the SQL Server machine, and the directory must already exist on that machine.

____________________________________________________

Make sure there is enough free disk space (at least 3 GB for SQL Server users and 500 MB for MSDE users) on the specified drive for each database. Also refer to your Microsoft documentation. Keep in mind that depending on the number of users in your enterprise and your network setup, your database may grow rapidly. For recommendations, see the Websense Deployment Guide.

10. Choose whether to minimize your database size

Reporter can report a separate internet access for each web page generated by a URL request (visit) or for each separate file that a page request generates (hits).

Accept the default to “log web page by Visits” to report by Visits for a smaller database and faster reporting.

Choose to report by Hits to record an entry for every file requested, including graphic images and advertisements.

Choose to Consolidate Log Records to minimize your database size by combining multiple visits by the same user to the same internet domain.

IMPORTANT

You need to create a path to the database before installing Reporting. A problem can occur during installation if the path is nonexistent, and Log Server and SQL Server are on different machines.

(15)

11. Determine where to locate the installation files

Accept the default location

C:\Program Files\Websense Choose another location

_______________________________________________________

12. Choose whether to enable WebCatcher

Yes. You can help improve the quality of the Websense Master Database by enabling WebCatcher to send unrecognized and security URLs to Websense, Inc., for analysis and categorization. No user-identifying information is ever sent to Websense.

You must have Internet Explorer v5.5 or later installed to enable WebCatcher to use HTTP “post” to send files to Websense.

Save a copy of the data that is sent to Websense.

Maximum upload file size (KB -- default size 4096 KB) _______

Minimum daily start time. ________

No. Do not send unrecognized URLs to Websense. This disables WebCatcher.

13. When upgrading

Websense recommends that you upgrade all the Reporting modules and components at the same time.

When Websense Enterprise Reporting has been previously installed with a Language Pack, upgrading to v6.3.x resets the language to English. The v6.3.x Language Pack must be downloaded during your Websense non-English installation.

The Windows Event Viewer must not be running during an upgrade or when repairing an existing installation. If the Event Viewer is open during an upgrade, the installer will crash. If you attempt to repair your Websense system when the Event Viewer is open, the repair will fail, even though the installer appears to finish normally.

(16)

14. When migrating a database

The Migrate Utility installs with the Log Server and is used to migrate databases for Reporter from v5.5.x to v6.2. Once the information has been migrated to v6.2, Reporter v6.3.x can use it to generate reports.

Explorer users can connect to the old database schema to run reports on older data in the v6.1.x and v6.2 databases.

IMPORTANT

Do not log to a migrated database. You should use migrated databases only for reporting.

(17)

C

HAPTER

2 System Requirements

To provide you with the most accurate information possible, Websense provides hardware recommendations based on the potential number of seats within a corporation. Current information for software requirements and hardware recommendations is available in the Websense Deployment Guide.

All Websense product documents are available at www.websense.com. Go to Support and Knowledge Base, and then navigate to Product Documentation.

The following are component-specific requirements before you install Websense Enterprise Reporting components.

Websense Enterprise Explorer

Your company may encrypt web traffic containing sensitive

information (HTTPS) or not. Explorer runs over HTTP or HTTPS, if your web server supports this type of traffic.

The web server portion can be installed on any machine that can connect to the database.

Windows authentication is supported when the web server is Microsoft IIS.

You must use Internet Explorer v5.5 or later to run Websense Enterprise Explorer.

Websense Enterprise Reporter

You must have a print driver installed and selected as a default, appropriate to the operating system you use.

For information on using a database engine for Reporting, see the following:

Selecting a database engine, page 18

Database engine system requirements, page 18

SQL Server/MSDE installation error messages, page 19

Installing with MSDE 2000, page 27

Installing with SQL Server 2000/2005, page 28

(18)

Chapter 2: System Requirements

Selecting a database engine

The descriptions below provide an overview of Microsoft SQL Server Desktop Engine 2000 (MSDE) and Microsoft SQL Server 2000/2005 (SQL Server), either of which can be used by Websense Reporting.

MSDE: the database size will not go beyond approximately 1.5 GB.

Upon reaching this maximum size, the database is automatically rolled over, and a new database partition is created. Reports may be generated from any database partition or partitions.

MSDE works best for smaller networks and organizations of less than 500 users that either have a low volume of internet access or that plan to generate reports and then archive the database on a weekly or monthly basis. MSDE should be installed via the link provided during the Reporting installation program.

SQL Server 2000/2005: Works best for larger networks and those organizations with a high volume of internet usage. Also, SQL Server performs better than the MSDE for reporting over long periods of time, such as several weeks or months.

If a copy of SQL Server already exists on your network, Websense recommends using this solution; otherwise SQL Server must be purchased separately.

If you use SQL Server 2000, be aware that you must install using the Connectivity Only option on each machine running Reporting components.

Database engine system requirements

IMPORTANT

The database engine must be installed before you install Websense Reporting components.

(19)

Websense Enterprise Reporting Installation Guide 19 Chapter 2: System Requirements

Websense recommends using MSDE in organizations with less internet activity, and SQL Server in organizations with higher volume.

SQL Server/MSDE installation error messages

When installing Reporting tools, a pre-installation script runs to check your SQL Server configuration. The script runs before installation files are transferred. If any configuration issue is found, the installer presents an error message that describes the problem.

You can avoid having to stop and restart your Reporting installation if you configure SQL Server before you install the Reporting tools.

MSDE v2000 (can be downloaded during

installation)

Microsoft SQL Server v2000 (SP 4 or higher) and SQL Server v2005 (SP1)

Operating System

Microsoft Windows 2000, Professional, Server, or Advanced Server (Service Pack 1)

Microsoft Windows XP Professional

Microsoft Windows 2003

Microsoft Windows 2000, Server, or Advanced Server (Service Pack 1)

Windows 2003 Enterprise and Standard editions

RAM For details, see the Websense Deployment Guide. The document is available at www.websense.com. Go to Support and Knowledge Base, and then navigate to Product Documentation.

Processor

Web browser Microsoft Internet Explorer v5.5 or later

Microsoft Internet Explorer v5.5 or later

Disk space 3 GB recommended (per database)

Refer to Microsoft documentation

(20)

The following topics describe the issues that may cause the Reporting installation to fail, and provide information for correcting the possible problems in advance.

Database version error messages

Websense Reporting tools must have access to MSDE 2000 or SQL Server 2000/2005. If you have an older version of MSDE or SQL Server, upgrade before you install Websense Reporting tools.

MSDE is free, and access to a downloadable version is available via a link in the Websense installation wizard, if a database engine is not found.

SQL Server is available from Microsoft. Check the Microsoft website for purchase information.

For installation and upgrade details, see the Microsoft documentation.

If you try to install Websense with an MSDE or SQL Server version that is not supported, an error message appears. The installer will terminate and will not access or install Reporting files and components.

Collation and case-sensitivity error messages

Websense Reporting tools use case-insensitive collation functions for database searches to provide highly accurate reports. If your SQL Server 2000/2005 instance uses case-sensitive collation, you cannot install Websense Reporting files and components. This occurs most often if one or more other applications are using that instance of SQL Server.

To address the issue, install another SQL Server instance set to use the default case-insensitive settings. During installation, the Collation Settings dialog box provides options from which you are able to select the correct collation setting.

You can check the case setting of SQL Server via SQL Enterprise Manager, although you cannot change the setting.

1. Make sure you have administrator access to SQL Server.

2. From the Windows Start menu, select: Programs > Microsoft SQL Server > Enterprise Manager. SQL Enterprise Manager opens.

(21)

a. Microsoft SQL Servers b. SQL Server Group

4. Right-click the server icon for the machine where the SQL instance you want to use is installed, and then select Properties from the drop-down menu.

5. Select the General tab and look for the text Server collation. An example appears next.

SQL_LATIN1_General_CP1_CS_AS

In this string, the text in highlighted position indicates case sensitivity.

There are two possible entries.

CS indicates the collation setting is case-sensitive.

CI indicates the collation setting is case-insensitive.

6. Click OK to close the Properties dialog box.

Host machine and MSDE/SQL Server names error messages

If the name of the host machine changed after MSDE/SQL Server was installed, the host and MSDE/SQL Server names will not match. If the machine and the MSDE/SQL Server names do not match, an error message appears, and Websense reporting components and files are not installed.

You must follow the next procedure to change the MSDE/SQL Server name without corrupting the database. For both database engines, use the osql utility to run the necessary commands.

1. Go to the machine where the MSDE/SQL Server instance runs that you want to connect to for Websense Reporting tools.

2. Check the machine name. Right-click My Computer on the desktop, and then select Properties from the drop-down menu.

a. When the Properties dialog box opens, click the Network Identification or Computer Name tab.

b. Check Full Computer Name, and write the name down. You will need this name later.

c. Click OK to close the Properties dialog box.

3. From the Windows Start menu, select: Control Panel > Administrative Tools > Services to verify that the MSDE/SQL Server instance is running.

(22)

4. From the Windows Start menu, select: Programs > Accessories >

Command Prompt. A Command Prompt window opens.

5. To connect to the named instance of MSDE/SQL Server using Windows Authentication, type the following command, and then press <Enter>.

osql -E -S servername\instancename In the above command:

for servername, substitute the actual name of the MSDE/SQL Server.

for instancename, substitute the actual name of the MSDE/SQL Server instance.

6. Verify the entry in the Command Prompt window is 1>. This shows you are connected to the MSDE/SQL server.

7. View the currently-installed server name by entering the next commands.

Press <Enter> at the end of each command.

1> EXEC sp_helpserver 2> GO

8. Enter the next commands to remove the named instance of MSDE/SQL Server. Press <Enter> at the end of each command.

1> sp_dropserver N'old_SQL_name' 2> GO

In the above command, replace old_SQL_name with the existing MSDE/

SQL Server name.

9. Check the results. An entry of 0 in the Command Prompt window indicates success.

10. Enter the next commands to add a new named instance of the MSDE/SQL Server. Press <Enter> at the end of each command.

1> sp_addserver N'new_SQL_name' 2> GO

In the above command, replace new_SQL_name with the name of the host machine, which you discovered in step 2 of this procedure.

(23)

1> EXEC sp_helpserver 2> GO

13. Type EXIT to close the osql utility.

14. If you use SQL Server as your database engine, you can also use SQL Enterprise Manager to verify that the name change has been accepted.

15. Restart the machine where MSDE/SQL Server runs.

16. Run the Websense Reporting tool installer again.

The next Microsoft topics can provide additional information.

Transact-SQL Reference

Command Prompt Utilities

Microsoft documents are available at http://msdn.microsoft.com/.

Database creation error messages

To install Websense Reporting files and components, you must have access rights that allow you to create databases. This is associated with a fixed server role. You need to create the DBCreator role to gain access to the ‘create databases rights.’ See the following:

Using SQL Enterprise Manager to set database creation rights, page 23

Using osql utility to set database creation rights, page 24

Using SQL Enterprise Manager to set database creation rights

3. Go to the navigation pane and expand the following trees, in the order listed.

c. The machine entry that identifies the machine where SQL Server runs.

d. Security

(24)

4. Under Security, locate and then double-click Server Roles. The Server Roles pane opens with the full names of the available server roles.

5. Right-click Database Creators, and then select Properties from the drop-down menu. The Servers Role Properties- dbcreator dialog box opens.

6. Click Add. The Add Members dialog box opens, and shows all existing logons for SQL Server.

7. Highlight the logon to which you are adding database creation rights, and then click OK. The Add Members dialog box closes.

8. In the Servers Role Properties- dbcreator dialog box, verify that you have selected the correct logon, and then click OK.

9. Select Console > Exit to close SQL Enterprise Manager.

Using osql utility to set database creation rights

If you use MSDE 2000 as your database engine, complete the next procedure to add the dbcreator role using osql, the MSDE user interface.

1. Go to the machine where the MSDE 2000 instance runs where you want to connect to the Websense Reporting tools.

2. From the Windows Start menu, select: Control Panel > Administrative Tools > Services to verify that the MSDE 2000 instance is running.

4. To connect to the named instance of MSDE 2000 using Windows Authentication, type the following command, and then press <Enter>.

for servername, substitute the actual name of the MSDE Server.

for instancename, substitute the actual name of the MSDE instance.

5. Verify the entry in the Command Prompt window is 1>. This shows you are connected to the MSDE server.

6. Enter the next command to grant rights for database creation, and then press <Enter>.

(25)

2> GO

In the above command, replace user_logon with the SQL or Windows user logon to whom you are assigning database creation rights.

7. Check the results. An entry of 0 in the Command Prompt window indicates success.

8. Type EXIT to close the osql utility.

9. Run the Websense Reporting tool installer again.

Table creation error messages

You must have SQL Server logon rights role that allows you to create tables.

If this role is not already set, you need to set the table creation rights. See the following:

Using SQL Enterprise Manager to set table creation rights, page 25

Using osql utility to set table creation rights, page 26

Using SQL Enterprise Manager to set table creation rights

3. Go to the navigation pane and expand the following trees, in the order listed.

c. The machine entry that identifies the machine where SQL Server runs.

d. Databases

4. Under Databases, locate the Websense database name, and then right- click.

5. From the drop-down menu, select Properties. The Properties dialog box for that database opens.

6. Select the Permissions tab. When the pane comes to the top, it contains a list of the user logons to set permissions.

7. Locate the logon entry for the added table creation rights.

(26)

8. In the Create Tables column, mark the checkbox that appears for the logon role you are modifying.

9. Click OK to close the Properties dialog box.

10. Select Console > Exit to close SQL Enterprise Manager.

Using osql utility to set table creation rights

If you use MSDE as your database engine, complete the next procedure to set table creation rights using osql, the MSDE user interface.

1. Go to the machine where the MSDE 2000 instance runs that you want to connect to for Websense reporting tools.

2. From the Windows Start menu, select: Control Panel > Administrative Tools > Services to verify that the MSDE 2000 instance is running.

4. To connect to the named instance of MSDE 2000 using Windows Authentication, type the following command, and then press <Enter>.

for servername, substitute the actual name of the MSDE server.

for instancename, substitute the actual name of the MSDE instance.

5. Verify the prompt in the Command Prompt window is 1>. This shows you are now connected to the MSDE server.

6. Enter the next commands to grant rights for table creation. At the end of each line, press <Enter>.

GRANT CREATE TABLE TO user

In the above command, replace user with the SQL or Windows user logon to whom you are assigning table creation rights.

8. Type EXIT, and then press <Enter> to close the osql utility.

9. Run the Websense reporting tool installer again.

(27)

Installing with MSDE 2000

MSDE should be installed from the link available during the Reporting installation. The program is free. The standard MSDE installation requires a special setup to work with Websense Reporting if you are going to use a remote installation of the database engine. This setup is automatically downloaded from this link.

1. Log on as a user with local administrator privileges to the database machine.

2. Close any open applications, including the Windows Control Panel.

3. Download Websense Setup from the Websense website or launch it from the Websense Installation CD. Unzip the installation files.

4. Websense Setup launches automatically. Follow the instructions on each screen until you come to the options about installing Websense Enterprise or Client Policy Manager.

5. Click Websense Enterprise and Next.

6. Select Websense Enterprise Reporting, and then click Next.

7. Follow the instructions on each screen until you come to an option to download a free copy of MSDE.

8. Select the appropriate language version, then follow the instructions.

9. Restart your machine after MSDE has finished the installation.

Note

If replacing a previous installation of MSDE and upgrading from an English to a non-English language version of MSDE 2000, you need to uninstall the English version of MSDE before installing the non-English version of MSDE.

IMPORTANT

You must restart the machine before installing any other Reporting components.

(28)

10. If the installation was successful, MSDE becomes active. MSDE must be running when you install the Log Server.

Installing with SQL Server 2000/2005

Microsoft SQL Server must be purchased separately. If it has not been installed in your network, see Microsoft documentation for system requirements and installation instructions. Generally, follow these steps.

1. Install SQL Server 2000/2005 according to Microsoft instructions, if it has not already been installed.

2. Make sure SQL Server is running.

3. Make sure SQL Server Agent is running.

4. Obtain the SQL Server logon ID and password for a SQL Server Administrator, or for an account that has rights to create, modify and delete databases and tables. You need this logon ID and password when you install Reporting components.

5. Restart the SQL Server machine after installation, and then install Log Server on an appropriate machine, as described in the next section.

6. Make sure the Log Server machine and each Reporting machine can recognize and communicate with SQL Server 2000/2005. This can be done by running the SQL Server 2000/2005 installation program on each appropriate machine and selecting Connectivity Only when asked what components to install.

7. You must restart the machine after installing the connectivity option. See Microsoft SQL Server documentation for details.

Note

You must restart the machine after installing Microsoft SQL Server 2000/2005 and before installing Log Server.

(29)

Configuring Microsoft SQL Server 2005 user roles

Microsoft SQL Server 2005 has defined new SQL Agent roles that govern accessibility of the job framework.

Do the following to create the DBCreator role and provide membership for the public and SQLAgentUserRole roles in the ‘msdb’ database.

1. Go to the Windows Start menu and select Programs > Microsoft SQL Server 2005 > Microsoft SQL Server Management Studio.

2. Select the Object Explorer tree.

3. Select Security > Logins.

4. Select the login account to be used during the installation.

5. Right-click the login account and select Properties for this user.

6. Select User Mapping and do the following:

a. Select msdb in database mapping.

b. Grant membership to the public role.

c. Grant membership to the SQLAgentUserRole role.

d. Click OK to save.

7. Select Server Roles, and then select DBCreator. The DBCreator role is created.

8. Click OK to save.

You should have the necessary permissions to successfully install the Websense Enterprise Reporting tools.

Note

The SQL user account must also be a member of the DBCreator fixed server role.

(30)

C

HAPTER

3 Selecting the Web Server and

Setting Up Users

Websense Enterprise Explorer is a web-based application. You must use either Microsoft IIS or Apache as the web server.

Your installation choices and security procedures vary, based on whether your web server is Microsoft IIS or Apache. For technical support on the

installation or operation of either of these web servers, contact Microsoft or Apache directly.

If both web servers are installed on the machine where you are installing Reporting, choose which web server you want to use.

This chapter contains the following topics.

Explorer with Microsoft IIS Web Server, page 31

Using Reporter, page 32

Identifying users for Reporting tools and utilities, page 32

Accessing Reporting tools, page 32

(31)

Websense Enterprise Reporting Installation Guide 31 Chapter 3: Selecting the Web Server and Setting Up Users

Explorer with Microsoft IIS Web Server

If you are using IIS, you need to know the name of the IIS website before you begin the installation. Enter the name of an existing website from IIS Manager in which the virtual directory is to be created. To create a new website or view existing websites, use the Windows Internet Services Manager.

From the Windows Start menu, select Programs > Administrative Tools >

Internet Services Manager.

Explorer access requirements for the Temp directory

Employees who have access to Explorer reports also need to have ‘modify access rights’ to the system Temp directory. For most servers, these rights are granted. For custom or secure server configurations, you may need to modify access rights before employees can access Explorer reports.

The system Temp directory is defined by the configurable environment variable %temp%, identified by default as C:\Windows\Temp.

Verifying the Temp directory location

Follow the next procedure to verify the location of the ^Temp directory.

1. Log on to the machine where Websense Enterprise Explorer is installed.

2. Locate and right-click My Computer.

3. Select Properties from the drop-down menu.

4. Click the Advanced tab.

5. Check the System variables list for the Temp entry. Usually, the value is C:\Windows\Temp.

Verifying Temp directory access

Once you verify the location of the system Temp directory, you need to verify and possibly modify access to the directory at the machine where Explorer is installed.

1. Locate the ^Temp directory. By default, the directory is:

C:\Windows\Temp.

2. Right-click the ^Temp folder, and then select Properties.

(32)

Chapter 3: Selecting the Web Server and Setting Up Users

3. Verify that all users and Groups that should have access to Explorer reports are listed.

4. Click Modify for each associated user or group that will be allowed to access Explorer reports. Other boxes are automatically checked, based on your selection.

5. When you are done selecting all users or groups, click OK.

Using Reporter

To generate reports in Reporter, you must log on as a local administrator with privileges to the database machine.

Identifying users for Reporting tools and utilities

As a Reporting administrator, default access to Websense Reporting tools uses the same user ID and password used to log on to Websense Manager. The default user account to log on to the Websense Reporting Tools Portal is WebsenseAdministrator.

To identify other users for all Reporting tools, you must be in Websense Manager, and then select the Report Administrators option in the navigation pane. For complete configuration details, see the Websense Administrator’s Guide.

Accessing Reporting tools

To access Websense Reporter: From the Windows Start menu, select Program Files > Websense > Websense Reporter.

To access Log Server Configuration: From the Windows Start menu, select Program Files > Websense > Utilities > LogServer Setup.

To access the Migrate Utility: From the Windows Start menu, select Program Files > Websense > Utilities > Migrate Utility.

To access Real-Time Analyzer, Websense Enterprise Explorer, or

(33)

Websense Enterprise Reporting Installation Guide 33 Chapter 3: Selecting the Web Server and Setting Up Users

Program Files > Websense > Web Reporting Tools. The Reporting Tool Portal opens.

(34)

C

HAPTER

4 Running the Installer

Downloading and unzipping the installation files, page 34

How to use Websense Setup, page 34

Installing the Websense Language Pack, page 35

Installation concerns, page 38

Connecting to a database, page 40

Downloading and unzipping the installation files

Websense Enterprise installation files are downloaded from the Websense website at www.websense.com, located on the Downloads page, or launched from the Websense Installation CD. Once you access the installation files:

1. Accept the default location to unzip the installation files, or browse to a different location.

2. Click Extract to unzip the installation files. All the installation files are unzipped and Websense Setup opens.

How to use Websense Setup

Websense Setup installs:

Websense Enterprise

Websense Enterprise Reporting

(35)

Websense Enterprise Reporting Installation Guide 35 Chapter 4: Running the Installer

Websense Client Policy Manager™

1. Run Websense Setup to install Websense Enterprise.

2. Run Setup again to install Websense Enterprise Reporting. Follow the onscreen instructions.

Installing the Websense Language Pack

The Websense Language Pack for v6.3.x adds localized resources to the Websense Reporting components. Download the Language Pack during the installation of your Websense non-English installation.

Each non-English installer package includes a Language Pack that converts your Websense system to that language. The Language Pack installer

launches automatically following completion of the main Websense installer.

Follow on-screen instructions to complete the installation of the Language Pack.

IMPORTANT

For performance reasons, Websense recommends that these three products not be installed on the same machine.

Each product includes several modules that contain separate components. This Install Manager can be used to install modules or single components on separate machines.

For specific information on how to best deploy the products, modules, and components, see the Websense Deployment Guide.

The link at the top of the Websense Install Manager opens the current version of the Websense Deployment Guide.

Note

All the Reporting modules and their components rely on Websense Enterprise. They are always installed after Websense Enterprise.

For details about configuring Websense Enterprise Reporting, see the Websense Deployment Guide.

(36)

Chapter 4: Running the Installer

Languages available with the Language Pack

What’s translated?

If you install the Language Pack, non-English languages are supported differently for each product. See the list below to determine what is translated.

For a list of the languages included in the Language Pack, see Languages available with the Language Pack.

Websense Enterprise Explorer for Windows, Real-Time Analyzer, Database Administration tool, and Reporting Tools Portal: User Interface is available in English and also translated into 9 other languages.

The documentation is available in English and translated into Japanese.

Log Server configuration: User Interface and documentation are available in English and translated into Japanese.

Websense Enterprise Reporter: User Interface and documentation are available in English.

Reporter report templates are translated, except for the Italian and Brazilian/Portuguese languages. These reports are available in English.

Language Code

Chinese (Simplified) zh_CN Chinese (Traditional) zh_TW

English en

French fr

German de

Italian it

Japanese ja

Korean ko

Portuguese (Brazil) pt_BR

Spanish es

(37)

Websense Enterprise Reporter

The Language Pack copies localized reports into a new directory that is created for the language selected. The English language versions of the reports remain in the system.

The configuration file is edited, and certain English text is replaced with text localized for the language of the installation you have selected.

Websense Enterprise Explorer for Windows

The Language Pack provides a fully localized start page for Explorer and translates the entire user interface, including the category list displayed.

Installing an English version following a non-English version

If you have installed a non-English version of Websense Enterprise and Reporting and want to go back to the English version:

1. Download the English version of the installation package.

2. Run setup.exe. This offers an option to switch to English, which comes up before the add/remove/repair components.

Note

Websense Enterprise Reporter does not localize reports for the Italian and Brazilian/Portuguese languages. These reports are available in the English language.

(38)

Installation concerns

Your installation options and procedures vary, based on locations, web server, modules, and components that are being installed.

Follow the on-screen instructions and provide the information requested.

MSDE and SQL Server installation and configuration error

messages

The Websense installation wizard runs a script to check for installation and configuration problems with MSDE 2000 and SQL Server 2000/2005. If the script encounters any problem, an error message appears. The error messages are documented in SQL Server/MSDE installation error messages, page 19, and include details about what you must do to resolve the errors.

Database engine location

Enter the IP address where MSDE/SQL Server is installed. Websense, Inc., recommends that you do not use a Trusted Connection if you run MSDE.

Contact your database administrator for assistance.

Note

The name of the database for this version is wslogdb63. Every time the database rolls over, a new database partition is created, and a number is appended to the end (for example, wslogdb63_1). This number increments each time.

Be sure you do not have an existing database with this name, otherwise the installation will fail. For troubleshooting, see SQL Server/MSDE installation error messages, page 19.

You can run reports on previous versions of the database schema after migrating them to the current version. See Upgrading and Migrating, page 43.

(39)

privileges to create, modify, and delete databases in MSDE/SQL Server, as well as local administrator privileges for that machine. After installation, be sure to assign the appropriate logon ID and password to the Log Server service, as described in Upgrading and Migrating.

If you installed SQL Server 2000/2005 with an instance name other than MSSQLServer, the default, you must enter the IP address of the SQL Server machine, followed by the instance name (see the following example).

<IP address>\<instancename>

For example: 10.201.1.1\ReporterSql.

Enter a logon name and password for an account that has rights to create a database on the MSDE/SQL machine. The default logon name is sa. Click Next.

Minimizing database size

Reporter can report a separate internet access for each web page generated by a URL request (visit) or for each separate file that a page request generates (hits).

Choose Logging Web Page Visits for a smaller database and faster reporting.

If you deselect this option, the database will contain an entry for every single file requested, including graphic images and advertisements. This will create a much larger database and will cause reports to generate slowly.

You can also set Consolidating Log Records to minimize the database size by combining multiple visits by the same user to the same internet domain.

Database location

Specify the location for installing the database according to your network setup.

Log Server and the database engine on the same machine: Click Browse to select a folder on the local machine for installing the database.

(40)

Log Server and the database engine on different machines: Enter the path for installing the database. This must be a local drive on the SQL Server machine, and the directory must already exist on that machine.

Make sure there is enough free disk space (at least 3 GB) on the specified drive for the database. Keep in mind that depending on the number of users in your enterprise, and your network setup, your database may grow very rapidly.

Connecting to a database

Database Administration: Offers a better way to manage databases over time, along with a scheduled rollover and automatic creation of database partitions. The configuration of these settings is done through the Database Administration page in the Reporting Tools Portal. Default settings can be modified by the Administrator. When an incoming batch of records exceeds the size or time threshold, the database will

automatically create a new database partition and redirect the new records there. Similarly, if individual incoming records come in that are outside the date and time range specified for a partition, they will be inserted into the appropriate partition(s). Database partitions store data for ongoing reporting. The Log Server connects to the database. If the installer cannot find either the database or Log Server, then the installer asks for the database name, location, user name, and password in order to make a connection. The database and Log Server do not need to be installed on the same machine.

Explorer: If Log Server is installed at the same time that Explorer is IMPORTANT

You need to create a path to the database before installing Reporting. Otherwise, a problem can occur during installation if the path is nonexistent, and the Log Server and SQL Server are on different machines.

(41)

Reporter: If a database is installed at the same time that Reporter is installed, Reporter automatically connects to that database. If Reporter is installed separately, you need to connect Reporter to a database after the installation using the Reporter interface. For procedures on how to connect Reporter to a database, see the Websense Enterprise Reporting Administrator’s Guide.

After installation, Explorer and Reporter can make a connection to an older database in order to run reports on that database. However, if the database is from a previous version of Websense, you must migrate it to the new version before the Websense Reporting components can display any reports that show information from that database.

(42)

C

HAPTER

5 Removing Reporting

Components

To uninstall some or all of the Websense Enterprise Reporting components, remove them from your machine as described in the steps below.

1. Locate the setup.exe file that was unzipped with the Websense Enterprise Reporting package.

Alternatively, you can download Websense Setup from the Websense website or launch it from the Websense Installation CD.

2. Run the installer, and select Remove.

Alternately, to remove all components, you can use the Windows Add/

Remove option to remove some or all of the Websense Reporting components.

1. Open the Windows Control panel.

2. Double-click Add or Remove Programs.

3. Locate Websense in the list, and then click Change/Remove.

4. Follow instructions when the Websense uninstaller opens.

(43)

C

HAPTER

6 Upgrading and Migrating

Upgrading, page 43

Migrating a database, page 43

Upgrading from MSDE to Microsoft SQL Server, page 46

Upgrading

Migrating a database

There is no migration path from previous database schemas to the new v6.3.x database schema. However, the Migrate Utility will be available for Reporter

IMPORTANT

Websense, Inc., officially supports upgrades for Websense Enterprise v5.2 to v5.5.x and v5.5.x to v6.x. on a properly functioning system. If you are running earlier versions of Websense and want to upgrade to v6.x, contact Websense Technical Support.

The Windows Event Viewer must not be running during an upgrade or when repairing an existing installation. If the Event Viewer is open during an upgrade, the installer will fail. If you attempt to repair your Websense system when the Event Viewer is open, the repair will fail, even though the installer appears to finish normally.

(44)

Chapter 6: Upgrading and Migrating

so that the v5.5.x database schema can be migrated to the v6.2 database schema.

The Migrate Utility resides on the Log Server machine. It converts log information from Websense Reporter v5.5.x into a format compatible with Websense Enterprise Reporter v6.2. Once the information has been migrated to v6.2, Reporter v6.3.x can use it to generate reports. Explorer users can connect to the old database schema to run reports on older data in the v6.1.x and v6.2 databases.

When Migrate Utility controls are available

When connected to a v5.5.x database: Migrate is available, but Data Utilities are not available.

When connected to a v6.1.x database: Migrate is not available, but the Data Utilities are available.

When connected to a v6.3.x database: Migrate and Data Utilities are not available.

Migrating a v5.5.x database

To convert a Websense Reporter v5.5.x database to a Websense Enterprise Reporter v6.2 compatible format, use the following procedure.

1. Back up the existing database. For assistance, see the MSDE 2000 or SQL Server 2000/2005 documentation.

2. Disable consolidation on the Consolidation tab in the Log Server Configuration window, if it is enabled.

3. From the Windows Start menu, select Programs > Websense > Utilities

> Migrate Utility to open the Websense Migrate window.

4. Click Connect. The Select Data Source dialog box appears.

Note

Do not log to a migrated database. The migrated database will only be available for reporting purposes.

Reporting Installation Guide