cancel
Showing results for 
Search instead for 
Did you mean: 

Web Gateway Cloud Service: Cloud Log Puller for Windows (Powershell Script)

Introduction

If you need to pull logs out of the Web Gateway Cloud Service here is a script which can be used to do just that.

 

# Collect logs from last 4 hours

.\CloudLogPullerLatest.ps1 -CustomerID XXXXXXXXXX -User EPO_CLOUD_USER -Hours 4

 

# Collect logs from last 7 days in chunks of 5 minutes (300 seconds) and Ignore Certificate Warnings

.\CloudLogPullerLatest.ps1 -CustomerID XXXXXXXXXX -User EPO_CLOUD_USER -Days 7 -Interval 300 -IgnoreCerts

 

Features

  • Interval based collection (useful for when there is a large amount of data over a certain time period)
  • Collect over last X days, hours, minutes
  • Error handling
  • Logging
  • Checks for updates to script

 

Download URL: https://technicalmarketing.mcafee.com/scripts/CloudLogPullerLatest.ps1

 

Screenshot of success:

 

Screenshot of failure:

 

Troubleshooting

The script generates a log file which can be used to understand the problem. If you have any issues start a Community thread.

 

NOTE: This tool is not supported by McAfee Technical Support in any way. Do not contact them for help with problems.

 

For assistance, questions, comments, improvements and problems with this program, please contact: Jon Scholten

Labels (1)
Comments

What do you think about these errors

[04/Jan/18 16:16:25 -0700] MFE-CheckForUpdates: ERROR: Not sure what happened here...

  1. System.Management.Automation.CommandNotFoundException: The term 'Invoke-WebRequest' is not recognized as the name of a c

mdlet, function, script file, or operable program. Check the spelling of the name, or if a path was included, verify tha

t the path is correct and try again.

[04/Jan/18 16:16:25 -0700] MFE-DownloadLogs: ERROR: Not sure what happened here...

  1. System.Management.Automation.CommandNotFoundException: The term 'Invoke-RestMethod' is not recognized as the name of a c

mdlet, function, script file, or operable program. Check the spelling of the name, or if a path was included, verify tha

t the path is correct and try again.

I cannot download the powershell script  from the link... Could you fix it?

Unfortunately the script doesn't work for me. Here is the extract from the logfile

 

[05.Mrz.18 13:36:38 +0100] MFE-Startup: INFO: Starting up Cloud Log Puller version 0.6
[05.Mrz.18 13:36:38 +0100] MFE-GetAccountCredentials: INFO: Customer ID: 9999999
[05.Mrz.18 13:36:38 +0100] MFE-GetAccountCredentials: INFO: Username: xxxxxxxxxxxxx
[05.Mrz.18 13:36:38 +0100] MFE-GetAccountCredentials: INFO: Duration: 14400
[05.Mrz.18 13:36:38 +0100] MFE-GetAccountCredentials: INFO: Interval: 600
[05.Mrz.18 13:36:38 +0100] MFE-CheckForUpdates: INFO: Checking for updates at ftp://custftp2.nai.com...
[05.Mrz.18 13:36:39 +0100] MFE-CheckForUpdates: INFO: You are up to date (Your Version: 0.6)
[05.Mrz.18 13:36:39 +0100] MFE-IgnoreCertWarnings: Ignoring certificate warnings
[05.Mrz.18 13:36:39 +0100] MFE-DownloadLogs: WARN: Start collect -0000 to -0000
[05.Mrz.18 13:36:39 +0100] MFE-DownloadLogs: INFO: Collecting logs -0000 to -0000
[05.Mrz.18 13:36:41 +0100] MFE-DownloadLogs: INFO: Collecting logs -0000 to -0000
[05.Mrz.18 13:36:41 +0100] MFE-DownloadLogs: INFO: Collecting logs -0000 to -0000
[05.Mrz.18 13:36:42 +0100] MFE-DownloadLogs: INFO: Collecting logs -0000 to -0000
[05.Mrz.18 13:36:42 +0100] MFE-DownloadLogs: INFO: Collecting logs -0000 to -0000
[05.Mrz.18 13:36:43 +0100] MFE-DownloadLogs: INFO: Collecting logs -0000 to -0000
[05.Mrz.18 13:36:43 +0100] MFE-DownloadLogs: INFO: Collecting logs -0000 to -0000
[05.Mrz.18 13:36:44 +0100] MFE-DownloadLogs: INFO: Collecting logs -0000 to -0000
[05.Mrz.18 13:36:44 +0100] MFE-DownloadLogs: INFO: Collecting logs -0000 to -0000
[05.Mrz.18 13:36:45 +0100] MFE-DownloadLogs: INFO: Collecting logs -0000 to -0000
[05.Mrz.18 13:36:45 +0100] MFE-DownloadLogs: INFO: Collecting logs -0000 to -0000
[05.Mrz.18 13:36:46 +0100] MFE-DownloadLogs: INFO: Collecting logs -0000 to -0000
[05.Mrz.18 13:36:46 +0100] MFE-DownloadLogs: INFO: Collecting logs -0000 to -0000
[05.Mrz.18 13:36:47 +0100] MFE-DownloadLogs: INFO: Collecting logs -0000 to -0000
[05.Mrz.18 13:36:47 +0100] MFE-DownloadLogs: INFO: Collecting logs -0000 to -0000
[05.Mrz.18 13:36:48 +0100] MFE-DownloadLogs: INFO: Collecting logs -0000 to -0000
[05.Mrz.18 13:36:48 +0100] MFE-DownloadLogs: INFO: Collecting logs -0000 to -0000
[05.Mrz.18 13:36:49 +0100] MFE-DownloadLogs: INFO: Collecting logs -0000 to -0000
[05.Mrz.18 13:36:49 +0100] MFE-DownloadLogs: INFO: Collecting logs -0000 to -0000
[05.Mrz.18 13:36:50 +0100] MFE-DownloadLogs: INFO: Collecting logs -0000 to -0000
[05.Mrz.18 13:36:50 +0100] MFE-DownloadLogs: INFO: Collecting logs -0000 to -0000
[05.Mrz.18 13:36:51 +0100] MFE-DownloadLogs: INFO: Collecting logs -0000 to -0000
[05.Mrz.18 13:36:51 +0100] MFE-DownloadLogs: INFO: Collecting logs -0000 to -0000
[05.Mrz.18 13:36:51 +0100] MFE-DownloadLogs: INFO: Collecting logs -0000 to -0000
[05.Mrz.18 13:36:52 +0100] MFE-DownloadLogs: WARN: Finished collecting logs
[05.Mrz.18 13:36:52 +0100] MFE-DeleteEmptyFiles: WARN: Deleting Empty Log Files

I think I found the error:

in MFE-GetEpoch the time must be devided by 100000 otherwise since the function returns ms instead of sec.

Function MFE-GetEpoch
{
$ED=[Math]::Floor([decimal](Get-Date(Get-Date).ToUniversalTime()-uformat "%s") / 100000)
return $ED
}

 

 

 

Contributors
Version history
Revision #:
3 of 3
Last update:
‎04-03-2018 12:58 PM
Updated by: