Web sessions write their events in RDP Proxy > Events, with the other access events.
The events also reach the Artica SIEM when the RDS Proxy is connected to it.
¶ Events of a session
| Reason | Label | Subject |
|---|---|---|
web_visit | Web page visited | target | address of the page |
web_blocked | Web page blocked | target | refused address. Resources (images, scripts) are written once per host and per session |
web_popup | Web pop-up closed | target |
web_copy | Text copied from a web page | target | number of characters |
web_paste | Text pasted into a web page | target | number of characters |
web_login | Automatic web login | target | account | site | form or http |
web_login_failed | Automatic web login failed | target | account | site | rejected or ambiguous |
¶ Refused sessions
| Reason | Cause | What to do |
|---|---|---|
web_engine_missing | The RDS Proxy engine has no web capability. | Upgrade the RDS Proxy engine to 12.3.22 or later. |
web_netns_unavailable | The network namespace of the policy does not exist. | Check that the namespace exists and is enabled. |
web_proxy_unavailable | The upstream proxy of the policy is disabled or unreadable. | Enable the proxy, or set its password again. |
web_login_unavailable | Automatic sign-in is configured but cannot be done (subject engine or vault). | Upgrade to 12.3.23 and authenticator 1.8.0, or set the password of the target again. |
¶ Troubleshooting
| Symptom | Check |
|---|---|
| Parts of the page are missing | Look for web_blocked events: add the hosts the application needs to the allowed sites. |
| Page blocked by the access policy at the first page | The application redirects to another host. Add it to the allowed sites. |
| Certificate error page | Add the certificate of the application to the trusted certificates. |
| The page cannot reach an internal address | The filtering proxy refuses the addresses of the bastion. Use a network namespace for applications reached through the bastion itself. |
| Ctrl+V pastes nothing | Check the copy and paste rights of the policy and the version of the engine. |
| Automatic sign-in does nothing | Check that the login site is the exact site of the Login Page Address, and that the form has one password field. |
| Web targets cannot be created | Open the WebView tab: a component is missing. |