Fastvue
Try for free
Reporter for SonicWall

Installation guide

Fastvue Reporter can be up and running in as little as five minutes following this simple installation guide.

WindowsLinux

Minimum Server Requirements

Download Fastvue Reporter and install on a machine (or virtual machine) that meets our recommended requirements below.

What are the supported Windows Operating Systems?

Fastvue Reporter is designed for 64 bit Windows Server Operating Systems running Windows Server 2012 R2, or above.

Fastvue does not support Windows Desktop operating systems such as Windows 10 or 11 due to conflicts with other applications and ports.

What are the RAM and CPU requirements?

The CPU and RAM requirements vary based on the amount of log file data you’re importing, the number of reports being generated, and the alerts you’ve configured.

Here are some rough guidelines based on the number of people in your network:

Network SizeRecommended Server Specification
Up to 100 Users4 CPUs/Cores, 8 GB RAM
100 – 500 Users4 CPUs/Cores, 12 GB RAM
500 – 2000 Users 4 CPUs/Cores, 16 GB RAM
2000 – 3000 Users8 CPUs/Cores, 32 GB RAM
3000+ Users16 CPUs/Cores, 64 GB RAM

This is a rough guide only, and we recommend installing on a Virtual Machine so you can scale these resources up or down as required.

What are the data storage requirements?

Recommended disk space

Every organization is different, and it only takes a particularly chatty application to drastically change the log data generated between two similarly sized networks.

Fastvue Reporter's default data retention policy is 90 days, or 90% of the available drive space at the time of installation, whichever comes first.

When setting up a new server, as a very rough rule of thumb, allocate enough disk space to store 15 MB per user per day, and use an environment where this disk can be easily adjusted in the future.

Install the free 14-day trial and let the software run for a few days. Then head to Settings > Data Storage. Here you will see how much data has been imported per day, along with a Daily Average figure.

Go to Settings > Data Storage > Settings and try increasing the number of days from the default 90, to the number of days you want to store. You'll notice the estimate underneath the edit box changes to show you the amount of hard drive space you need to allow for based on the Daily Average seen so far.

Likewise, you can change the Size policy to see the number of days the set amount of hard drive space will accommodate.

Use SSDs if possible

Fastvue Reporter uses Elasticsearch as its database. This is I/O intensive and has considerable performance benefits when running on SSD disks. Fastvue recommends SSD disks to avoid performance-related issues, especially when monitoring medium to large networks.

We don't advise installing to a network drive due to latency issues affecting the stability of our very frequent read-write operations.

Don't install to a mapped network drive, or use a mapped network drive as Fastvue Reporter’s data path, as the assigned drive letters won't exist in the system context – only the user context. If you must use a network drive, specify a UNC path such as \servername-or-ip\fastvue. But keep in mind the performance issues mentioned above, and you'll have to configure ‘full’ permissions for the Fastvue Server’s local system account.

Installation

Note: In order to import data and run reports as fast as possible, Fastvue Reporter can be resource intensive. We do not recommend installing Fastvue Reporter on a server that provides a critical services such as a Domain Controller, DNS server, or DFS server. We recommend installing on a dedicated VM (virtual machine) so you can scale the resources appropriately.

To install Fastvue Reporter:

  1. Double-click the downloaded setup exe on a machine that meets the above requirements.
  2. The installer automatically installs and configures the required pre-requisites which include .Net 4.6 and IIS (Web Server and Application Server roles). It will also install Open JDK and Elasticsearch in its own self-managed directory.
  3. Once the pre-requisites have been installed, proceed through the installation wizard. It will ask you for:
    • Installation folder
      Only application files are installed to this folder and it does not require much disk space. The default is C:\Program Files\Fastvue\{Product Name}.
    • Website and Virtual Directory
      This is the website and sub-folder (virtual directory) within IIS to install the Fastvue Reporter website into. The default is Default Web Site.

      If you have other websites installed on your server, it is a good idea to either create a new website in IIS first and install to that, or use the 'sub-directory' option and enter a name such as ‘fastvue’ or ‘reports’. This creates a contained 'virtual directory' in IIS under the main website which you can access using http://yourserver/fastvue (for example).
    • Data Location
      This is the location where all imported data, configuration and report files are stored. Specify a location with plenty of disk space. The default is C:\ProgramData\Fastvue\{Product Name}.
  4. Navigate to the Fastvue Reporter web interface in your web browser. If you are on the server you installed, this will be http://localhost or http://localhost/sub-folder-name if you specified a sub-folder in step 3 above (replace sub-folder-name with the actual name you specified). You can also replace localhost with the server's name or IP address to access the web interface from a different machine.

Upgrading

To upgrade an earlier version of Fastvue Reporter, simply run the new installer over the top of your existing installation. The installer will pick up your existing settings, so just click next throughout the wizard without making any changes. Once installed, browse to the site and clear the browser cache by hitting ctrl + F5 (cmd + R on Mac).

Note that it can take a few minutes for data to start importing again after upgrades and restarts of the Fastvue Reporter service. You can check the database initialisation progress in Settings | Diagnostic | Database.

Automated / Silent Deployment

If you need to deploy or upgrade Fastvue Reporter silently or to multiple servers in an automated way, please see our comprehensive Reporter 4.0 PowerShell script.

Configure SonicWall to send Syslog data to Fastvue Reporter

Now that you have installed Fastvue Reporter for SonicWall, configure your SonicWall firewall(s) to send Network and Web Traffic events via Syslog to the Fastvue Reporter server.

The process varies slightly depending on your SonicOS version.

SonicOS 7.0 and above

  1. Go to Device | Log | Syslog | Syslog Settings. Click the Enhanced Syslog Fields Settings button and toggle all the available fields to On.

  2. Go to Device | Log | Syslog | Syslog Servers, add your Fastvue server as a syslog server, ensuring you use the Enhanced Syslog format. Adding Fastvue Reporter as a Syslog Server in SonicOS 7.0

  3. Go to Device | Log | Settings and expand the Log | Syslog section. Make sure the Logging Level at the top of the page is set to Inform. SonicWall SonicOS 7 Logging Level Inform

  4. Expand the Log | Syslog section. Toggle the Syslog column for the Syslog Website Accessed event to On and set the priority to Inform. Logging internet usage and website activity in SonicWall SonicOS 7.0

  5. Expand Security Services | Content Filter and toggle the Syslog column for the Website Accessed & Website Blocked events to On, again making sure the priority is Inform. Logging blocked and allowed websites in SonicWall SonicOS 7.0

  6. Expand Network | Network Access and toggle the Syslog option for the Connection Closed, Web Request Receiver and Web Request Drop event to On, again making sure the priority is Inform Logging network activity in SonicWall SonicOS 7.0

  7. Ensure you have SonicWall’s Content Filtering Services (CFS) enabled and active in Policy | Settings | CFS.

  8. Ensure you have SonicWall's Client DPI-SSL enabled in Policy | DPI SSL | Client SSL (requires the distribution of certificates). Without it, only domain names are logged, not full URLs. This limits reporting capabilities and reduces the effectiveness of features like Site Clean, not to mention your SonicWall will be less effective protecting endpoints from threats served over HTTPS (most of the web).

If you can't use DPI-SSL, enable HTTPS Content Filtering at Objects | Profile Objects | < edit each rule > | Advanced | Enable HTTPS Content Filtering. This logs HTTPS domain names but doesn't address the reporting limitations of lacking Client DPI-SSL. If Client DPI-SSL is active, there's no need for HTTPS Content Filtering.

  1. Disable CFS Fast Scan so that SonicWall logs every URL, not just the first URL in a session. To do this, go to the diag page in your SonicWall's web interface (https://[ip-address]/sonicui/7/m/diag), and disable the CFS Fast Scan option.

  2. See our guide on The Best SonicWall Configuration for Detailed Logging and Reporting for more information including logging usernames, host name resolution, and the importance of blocking QUIC.

SonicOS 6.5 and above

  1. Go to Manage | Log Settings | Syslog and set the Syslog Format to Enhanced Syslog

  2. Click the Enhanced Syslog Fields Settings button and check all the available fields.

  3. Under the Syslog Servers section, add your Fastvue server as a syslog server. Adding Fastvue Reporter as a Syslog Server in SonicWall SonicOS 6.5

  4. Go to Manage | Log Settings | Base Setup and make sure the Logging Level at the top of the screen is set to Inform.

  5. Expand the Log | Syslog section. Check the Syslog column for the Syslog Website Accessed events. Set the priority to Informational.

  6. Expand Security Services | Content Filter and check the Syslog column for Website Accessed & Website Blocked events, again making sure the priority is Informational Logging internet usage and website activity in SonicWall SonicOS 6.5

  7. Expand Network | Network Access and check the Syslog option for Connection Closed, Web Request Receiver and Web Request Drop events, again making sure the priority is Informational Logging network activity in SonicWall SonicOS 6.5

  8. Ensure you have SonicWall’s Content Filtering Services (CFS) enabled and active in Security Services | Content Filter. Enabling SonicWall Content Filtering Services (CFS) in SonicOS 6.5

  9. Ensure you have SonicWall's Client DPI-SSL (requires the distribution of certificates). Without it, only domain names are logged, not full URLs. This limits reporting capabilities and reduces the effectiveness of features like Site Clean, not to mention your SonicWall will be less effective protecting endpoints from threats served over HTTPS (most of the web).

If you can't use DPI-SSL, enable HTTPS Content Filtering at Objects | Profile Objects | < edit each rule > | Advanced | Enable HTTPS Content Filtering. This logs HTTPS domain names but doesn't address the reporting limitations of lacking Client DPI-SSL. If Client DPI-SSL is active, there's no need for HTTPS Content Filtering.

  1. See our guide on The Best SonicWall Configuration for Detailed Logging and Reporting for more information including logging usernames, host name resolution, and the importance of blocking QUIC.
SonicOS 6.2.6.0 and above
  1. If you are running 6.2.6.0-20n, request hotfix 6.2.6.0-20n–HF176616-1n from SonicWall support to fix a critical logging bug. This fix will be included in 6.2.6.1 generally.
  2. Go to Log | Syslog and set the Syslog Format to Enhanced Syslog
  3. Under the Syslog Servers section, add your Fastvue server as a syslog server. Adding Fastvue Reporter as a Syslog Server in SonicWall SonicOS 6.2
  4. Go to Log | Settings and expand the Log | Syslog section. Check the Syslog option for the Syslog Website Accessed events. Set the priority to Informational.
  5. Still in Log | Settings, expand Security Services | Content Filter and check the Syslog option for Website Accessed & Website Blocked events, again making sure the priority is Informational Logging internet usage and website activity in SonicWall SonicOS 6.2
  6. Still in Log | Settings, expand Network | Network Access and check the Syslog option for Connection Closed, Web Request Receiver and Web Request Drop events, again making sure the priority is Informational Logging network activity in SonicWall SonicOS 6.2
  7. Ensure you have SonicWall’s Content Filtering Services (CFS) enabled and active in Security Services | Content Filter. Enabling Content Filtering Services (CFS) in SonicWall SonicOS 6.2

We also recommend enabling SonicWall’s DPI-SSL feature for reporting an alerting on HTTPS traffic such as Google Searches and YouTube videos. See our guide on The Best SonicWall Configuration for Detailed Logging and Reporting.

SonicOS 5.9 to 6.2.5
  1. Go to Log | Syslog and check the Override Syslog Settings with Reporting Software Settings checkbox and click Accept. This option fixes an issue where URL Categories are not logged for Allowed traffic. Read more.
  2. Under the Syslog Servers section, add your Fastvue server as a syslog server. Adding Fastvue Reporter as a Syslog Server in SonicWall SonicOS 5.9
  3. Go to Log | Settings and expand the Log | Syslog section. Check the Syslog option for the Syslog Website Accessed events. Set the priority to Informational.
  4. Expand Network | Network | Network Access and check the Syslog option for Website Blocked & Website Accessed events, again making sure the priority is Informational
  5. Ensure you have SonicWall’s Content Filtering Services (CFS) enabled and active in Security Services | Content Filter, either via App Rules or Zones and Interfaces, and that you have an App Rule or Zone configured to use CFS.

We also recommend enabling SonicWall’s DPI-SSL feature for reporting an alerting on HTTPS traffic such as Google Searches and YouTube videos. See our guide on The Best SonicWall Configuration for Detailed Logging and Reporting.

SonicOS 5.8 and below
  1. Go to Log | Syslog and ensure the Syslog Format is set to Default
  2. Under the Syslog Servers section, add your Fastvue server as a syslog server.
  3. Go to Log | Categories and ensure the logging level is set to Informational
  4. In the Categories section, check the Syslog checkbox for the Network Traffic events.
  5. Ensure you have SonicWall’s Content Filtering Services (CFS) enabled and active in Security Services | Content Filter, and that CFS is applied to one of your zones in Network | Zones.

We also recommend enabling SonicWall’s DPI-SSL feature for reporting an alerting on HTTPS traffic such as Google Searches and YouTube videos. See our guide on The Best SonicWall Configuration for Detailed Logging and Reporting.

The quality of reports is greatly improved by using certain features of your SonicWall, including:

  • Content Filtering Services (CFS)
  • DPI-SSL (Decryption Services)
  • Authentication (AD SSO)
  • Enabling Name Resolution
  • Logging Referrer URLs
  • Blocking QUIC

For more information, see our guide on The Best SonicWall Configuration for Detailed Logging and Reporting.

Add a Source

Add your firewall as a Source in Fastvue Reporter. This can be done on the start page that is presented after installation, or by going to Settings | Sources and clicking Add Source.

If your firewall is sending syslog data on port 514, click into the dropdown and wait a few seconds. The dropdown will populate with the name and/or IP of the device(s) sending syslog traffic to the Fastvue Server. Simply select your firewall from the list and click Add Source.

If your firewall is sending syslog data on a different port (such as 50514 if using the Linux / Docker version), Fastvue Reporter will not automatically display your firewall in the dropdown list. In this case, manually enter your firewall's IP and your selected syslog port into the options provided, then click Add Source.

Note: If entering your firewall and port manually, make sure the IP is the one your Fastvue Server is receiving syslog data from. This could be the IP of the internal LAN interface on your firewall, or if you have intermediate devices routing syslog traffic, it could be the interface IP of the last hop.

If you're unsure, you can a 'dummy' source with an invalid name (such as 'dummy') but specify the custom syslog port your firewall is sending syslog data on. Fastvue Reporter will then start listening on the port specified. You can then click Add Source again, and the dropdown list should populate with any device sending syslog data on your custom syslog port.

It may take 10-20 seconds before the first records are imported. You can watch the records and dates imported in Settings | Sources. Once records start importing, you can go to the Dashboard tab to see your network traffic.

Enjoy

Now you can try out the many features of Fastvue Reporter!