I have installed Web Reporter on our server and it seems to work great. However, all the times being reported are 4 hours ahead of our time. I went into the administration panel and changed the settings in the logfile processing section to -4hrs and nothing changed. I also set it to TORONTO region, but the time is still being reported wrong.
I opened one of the log files and the time within the log file is 4 hours ahead of us. I then checked all the regions on the server and workstations and they are all set to EST region. I am not sure why the time in the logs are being set 4hrs ahead of our time zone.
Is there anyway to change this?
I had the same type of issu when we first deployed the appliance. Off the top of my head I cant remember what settings we had to adjust, we did have to contact mcafee support and they helped us resolve the issue.
Have you opened a service request yet? When I get a chance I will look through my logs and see if I can find the fix, however it was about a yaer ago.
I set the adjustment to -4 and that did not work. I also set the region to Toronto and it still doesn't work.
Form the help file:
Defines additional rules Web Reporter applies when processing the log files from the log source.
• Adjust the time in UTC-based logs using this locale — Specifies locale-based time when the log file does not contain time zone information; the following table summarizes options and additional considerations:
manual offsets Select from the list or use one of the following formats to type the value:
• GMT +hh:mm
• GMT -hh:mm
Regional offsets Select from the list or use one of the non-standard regions:
• AGT (Argentine Time)
• Brazil/West (Amazon Time)
Daylight Saving Time Log files generated during Daylight Saving Time (DST) and processed during Standard Time retain the correct time offset.
This option does not affect log files already containing time zone information.
How do I know if my logs contain the time zone? This might be the problem... here is an example of what is in our logs:
2010-10-07T12:39:21 18600 nw http://www.cnn.com/ 1 1 6 - A000476F783A5\Username A000476F783A5 6 1 1 1 1 6 xx.xx.xxx.xx -
NOTE: I removed the username and the IP address for security reasons.
This log came in at 8:39am EST yet the time shows 12:39 which I beleive is normal. But even with the offset set to -4, the times in reports are still UTC.
Any ideas?Message was edited by: krmason on 07/10/10 6:48:27 GMT-06:00 AM
No, the changes are never applied. However, I have been told that McAfee has released a patch that fixes the URL problem with SiteAdvisor. I will try to look for it.
I know this is an old thread, and hopefully krmason found an answer to his issue. I just had a similar issue broght to my attention. Initial investigation shows that SiteAdvisor is logging in UTC+0 only without any timezone indicator. Web Reporter is importing the data according to the time in the log file so reports always show UTC+0. In Web Reporter, the processing option to modify the locale doesn't seem to be working. I've filed a bug with Web Reporter enineering. SideAdvisor support is supposed to be checking with their engineering team to see if the clients should be logging the client's local UTC time or if UTC+0 is expected.
I will update this thread once new information is available.