All Barracuda Web Filters, all firmware versions
The web log, as expected, will reference any location of a category when it is seen in more than one place. The content filter page and if used within a custom category. Just because the reference is listed here for investigative purposes does not constitute the request was blocked by all of the listed details, it is only for the policy you chose to block that request.
Upon creating any custom category with domains or categories, this is now included to be seen as a possible policy check. It does not mean that it was the determining factor for a block or allow to the policy directly.
Upon viewing the web log you will see the column “reason” showing (content filter=nothing matched previous to this page but a block setting used or blacklist/whitelist= hit the domains blocking/allowing and so forth.) details showing the policy was hit by this and may show (as an example) kohls.com = shopping, HR allowed, students denylist. This means that it was referenced only in these 3 listings. If a student shows as blocked/allowed, then they should have hit a rule against them first or possibly the content filter page as a last catch, It is not that they were blocked/allowed because of the HR rule in the details, it is just a reference point to know towards what policy settings it can be matched, that may be a concern requiring to modiy if not an expected policy path.
see policy flow here at our tech library site BLOCK/ACCEPT Order of Precedence to see how each page, in order, gets filtered until a match happens.
When allowed and should be blocked, there may be an issue with custom categories in general and they may need to have exceptions rules fixed or deleted and custom categories deleted and recreated to clear up the concerns.
You may reference Solution# 3303 to help understanding the flow of precedence with a custom category being used also.
Link To This Page: