Events and troubleshooting of RDS Proxy web targets
Events written by web sessions, refusal reasons and how to troubleshoot a web target.
Web sessions write their events in RDP Proxy > Events, with the other access events.
The events also reach the Artica SIEM when the RDS Proxy is connected to it.
Visits, a blocked page, a rejected automatic sign-in and the charter acceptances of the user jsmith.
Events of a session
| Reason | Label | Subject |
|---|---|---|
web_visit |
Web page visited | target | address of the page |
web_blocked |
Web page blocked | target | refused address. Resources (images, scripts) are written once per host and per session |
web_popup |
Web pop-up closed | target |
web_copy |
Text copied from a web page | target | number of characters |
web_paste |
Text pasted into a web page | target | number of characters |
web_login |
Automatic web login | target | account | site | form or http |
web_login_failed |
Automatic web login failed | target | account | site | rejected or ambiguous |
Refused sessions
| Reason | Cause | What to do |
|---|---|---|
web_engine_missing |
The RDS Proxy engine has no web capability. | Upgrade the RDS Proxy engine to 12.3.22 or later. |
web_netns_unavailable |
The network namespace of the policy does not exist. | Check that the namespace exists and is enabled. |
web_proxy_unavailable |
The upstream proxy of the policy is disabled or unreadable. | Enable the proxy, or set its password again. |
web_login_unavailable |
Automatic sign-in is configured but cannot be done (subject engine or vault). |
Upgrade to 12.3.23 and authenticator 1.8.0, or set the password of the target again. |
Troubleshooting
| Symptom | Check |
|---|---|
| Parts of the page are missing | Look for web_blocked events: add the hosts the application needs to the allowed sites. |
| Page blocked by the access policy at the first page | The application redirects to another host. Add it to the allowed sites. |
| Certificate error page | Add the certificate of the application to the trusted certificates. |
| The page cannot reach an internal address | The filtering proxy refuses the addresses of the bastion. Use a network namespace for applications reached through the bastion itself. |
| Ctrl+V pastes nothing | Check the copy and paste rights of the policy and the version of the engine. |
| Automatic sign-in does nothing | Check that the login site is the exact site of the Login Page Address, and that the form has one password field. |
| Web targets cannot be created | Open the WebView tab: a component is missing. |