Chapter 18 Troubleshooting : ­Troubleshooting tools : FortiGuard troubleshooting : FortiGuard URL rating
  
FortiGuard URL rating
The following commands can be used to troubleshoot issues with FortiGuard URL ratings:
diag debug enable
diag debug application urlfilter -1
Sample output:
id=93000 msg="pid=57 urlfilter_main-723 in main.c received pkt:count=91, a=/tmp/.thttp.socket/21" id=22009 msg="received a request /tmp/.thttp.socket, addr_len=21: d= ="www.goodorg.org:80, id=12853, vfid=0, type=0, client=192.168.3.90, url=/" id=99501 user="N/A" src=192.168.3.90 sport=1321 dst=<dest_ip> dport=80 service="http" cat=43 cat_desc=“Organisation" hostname="www.goodorg.org" url="/" status=blocked msg="URL belongs to a denied category in policy"
Sample output:
id=22009 msg="received a request /tmp/.thttp.socket, addr_len=21: d=pt.dnstest.google.com:80, id=300, vfid=0, type=0, client=192.168.3.12, url=/gen_204"
id=93003 user="N/A" src=192.168.3.12 sport=21715 dst=<dest_ip> dport=80 service="http" cat=41 cat_desc="Search Engines" hostname="pt.dnstest.google.com" url="/gen_204" status=passthrough msg="URL belongs to an allowed category in the policy"
Table 110: Breakdown of sample output parts from URL rating command
 
id=93000
The process ID (PID) is listed along with the function in the file running (main.c). Then it lists the number of packets received and the associated socket where the packets came from.
 
msg="pid=57 urlfilter_main-723 in main.c received pkt:count=91, a=/tmp/.thttp.socket/21"
id=22009
Received a request on a particular socket (/tmp/.thttp.socket). The website to be rated is “www.goodorg.org:80” and the client browser that wants the verification is 192.169.3.90.
 
msg="received a request /tmp/.thttp.socket, addr_len=21: d= ="www.goodorg.org:80, id=12853, vfid=0, type=0, client=192.168.3.90, url=/"
id=99501
No user associated with this source address (192.168.3.90) and port (1321). The destination IP is unknown and the port is the standard HTTP port 80, which is confirmed by service=http.
The cat keyword gives the category of the URL being checked, which turns out to be an organization. This is confirmed by the hostname of “goodorg.org”.
The status is stated as blocked with the reason stated as “URL belongs to a denied category in policy”.
 
user="N/A" src=192.168.3.90 sport=1321 dst=<dest_ip> dport=80 service="http" cat=43 cat_desc=“Organisation" hostname="www.goodorg.org" url="/" status=blocked msg="URL belongs to a denied category in policy"