cancel
Showing results for 
Search instead for 
Did you mean: 

Web Gateway Cloud Service: Cloud Log Puller for Windows (Powershell Script)

Introduction

If you need to pull logs out of the Web Gateway Cloud Service here is a script which can be used to do just that.

 

# Collect logs from last 4 hours

.\CloudLogPullerLatest.ps1 -CustomerID XXXXXXXXXX -User EPO_CLOUD_USER -Hours 4

 

# Collect logs from last 7 days in chunks of 5 minutes (300 seconds) and Ignore Certificate Warnings

.\CloudLogPullerLatest.ps1 -CustomerID XXXXXXXXXX -User EPO_CLOUD_USER -Days 7 -Interval 300 -IgnoreCerts

 

Features

  • Interval based collection (useful for when there is a large amount of data over a certain time period)
  • Collect over last X days, hours, minutes
  • Error handling
  • Logging
  • Checks for updates to script

 

Download URL: https://technicalmarketing.mcafee.com/scripts/CloudLogPullerLatest.ps1

 

Screenshot of success:

 

Screenshot of failure:

 

Troubleshooting

The script generates a log file which can be used to understand the problem. If you have any issues start a Community thread.

 

NOTE: This tool is not supported by McAfee Technical Support in any way. Do not contact them for help with problems.

 

For assistance, questions, comments, improvements and problems with this program, please contact: Jon Scholten

Labels (1)
Comments

What do you think about these errors

[04/Jan/18 16:16:25 -0700] MFE-CheckForUpdates: ERROR: Not sure what happened here...

  1. System.Management.Automation.CommandNotFoundException: The term 'Invoke-WebRequest' is not recognized as the name of a c

mdlet, function, script file, or operable program. Check the spelling of the name, or if a path was included, verify tha

t the path is correct and try again.

[04/Jan/18 16:16:25 -0700] MFE-DownloadLogs: ERROR: Not sure what happened here...

  1. System.Management.Automation.CommandNotFoundException: The term 'Invoke-RestMethod' is not recognized as the name of a c

mdlet, function, script file, or operable program. Check the spelling of the name, or if a path was included, verify tha

t the path is correct and try again.

I cannot download the powershell script  from the link... Could you fix it?

Unfortunately the script doesn't work for me. Here is the extract from the logfile

 

[05.Mrz.18 13:36:38 +0100] MFE-Startup: INFO: Starting up Cloud Log Puller version 0.6
[05.Mrz.18 13:36:38 +0100] MFE-GetAccountCredentials: INFO: Customer ID: 9999999
[05.Mrz.18 13:36:38 +0100] MFE-GetAccountCredentials: INFO: Username: xxxxxxxxxxxxx
[05.Mrz.18 13:36:38 +0100] MFE-GetAccountCredentials: INFO: Duration: 14400
[05.Mrz.18 13:36:38 +0100] MFE-GetAccountCredentials: INFO: Interval: 600
[05.Mrz.18 13:36:38 +0100] MFE-CheckForUpdates: INFO: Checking for updates at ftp://custftp2.nai.com...
[05.Mrz.18 13:36:39 +0100] MFE-CheckForUpdates: INFO: You are up to date (Your Version: 0.6)
[05.Mrz.18 13:36:39 +0100] MFE-IgnoreCertWarnings: Ignoring certificate warnings
[05.Mrz.18 13:36:39 +0100] MFE-DownloadLogs: WARN: Start collect -0000 to -0000
[05.Mrz.18 13:36:39 +0100] MFE-DownloadLogs: INFO: Collecting logs -0000 to -0000
[05.Mrz.18 13:36:41 +0100] MFE-DownloadLogs: INFO: Collecting logs -0000 to -0000
[05.Mrz.18 13:36:41 +0100] MFE-DownloadLogs: INFO: Collecting logs -0000 to -0000
[05.Mrz.18 13:36:42 +0100] MFE-DownloadLogs: INFO: Collecting logs -0000 to -0000
[05.Mrz.18 13:36:42 +0100] MFE-DownloadLogs: INFO: Collecting logs -0000 to -0000
[05.Mrz.18 13:36:43 +0100] MFE-DownloadLogs: INFO: Collecting logs -0000 to -0000
[05.Mrz.18 13:36:43 +0100] MFE-DownloadLogs: INFO: Collecting logs -0000 to -0000
[05.Mrz.18 13:36:44 +0100] MFE-DownloadLogs: INFO: Collecting logs -0000 to -0000
[05.Mrz.18 13:36:44 +0100] MFE-DownloadLogs: INFO: Collecting logs -0000 to -0000
[05.Mrz.18 13:36:45 +0100] MFE-DownloadLogs: INFO: Collecting logs -0000 to -0000
[05.Mrz.18 13:36:45 +0100] MFE-DownloadLogs: INFO: Collecting logs -0000 to -0000
[05.Mrz.18 13:36:46 +0100] MFE-DownloadLogs: INFO: Collecting logs -0000 to -0000
[05.Mrz.18 13:36:46 +0100] MFE-DownloadLogs: INFO: Collecting logs -0000 to -0000
[05.Mrz.18 13:36:47 +0100] MFE-DownloadLogs: INFO: Collecting logs -0000 to -0000
[05.Mrz.18 13:36:47 +0100] MFE-DownloadLogs: INFO: Collecting logs -0000 to -0000
[05.Mrz.18 13:36:48 +0100] MFE-DownloadLogs: INFO: Collecting logs -0000 to -0000
[05.Mrz.18 13:36:48 +0100] MFE-DownloadLogs: INFO: Collecting logs -0000 to -0000
[05.Mrz.18 13:36:49 +0100] MFE-DownloadLogs: INFO: Collecting logs -0000 to -0000
[05.Mrz.18 13:36:49 +0100] MFE-DownloadLogs: INFO: Collecting logs -0000 to -0000
[05.Mrz.18 13:36:50 +0100] MFE-DownloadLogs: INFO: Collecting logs -0000 to -0000
[05.Mrz.18 13:36:50 +0100] MFE-DownloadLogs: INFO: Collecting logs -0000 to -0000
[05.Mrz.18 13:36:51 +0100] MFE-DownloadLogs: INFO: Collecting logs -0000 to -0000
[05.Mrz.18 13:36:51 +0100] MFE-DownloadLogs: INFO: Collecting logs -0000 to -0000
[05.Mrz.18 13:36:51 +0100] MFE-DownloadLogs: INFO: Collecting logs -0000 to -0000
[05.Mrz.18 13:36:52 +0100] MFE-DownloadLogs: WARN: Finished collecting logs
[05.Mrz.18 13:36:52 +0100] MFE-DeleteEmptyFiles: WARN: Deleting Empty Log Files

I think I found the error:

in MFE-GetEpoch the time must be devided by 100000 otherwise since the function returns ms instead of sec.

Function MFE-GetEpoch
{
$ED=[Math]::Floor([decimal](Get-Date(Get-Date).ToUniversalTime()-uformat "%s") / 100000)
return $ED
}

 

 

 

Contributors
Version history
Revision #:
3 of 3
Last update:
‎04-03-2018 12:58 PM
Updated by:
 

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community