cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
nashcoop
Reliable Contributor
Reliable Contributor
Report Inappropriate Content
Message 1 of 3

WGCS log source error: Failed - Couldn't Initialize

Jump to solution

I already have an open SR for this issue (4-21629121741) so for the McAfee pros you can reference that and the plethora of information I've added to it over the past few days.  The CSR log source in EPO for WGCS keeps failing with the error "Failed - Couldn't Initialize."  The error in the server_err.log file is: ERROR [com.mcafee.mesa.common.core.util.httputil.SfHttpClient] I/O Exception.: java.net.SocketTimeoutException: Read timed out

ERROR [com.mcafee.mesa.logparsing.LogAudit] (WebSaasGetter) Failed to retrieve log files from Saas Web Protection server: 'https://msg.mcafeesaas.com:443/mwg/api/reporting/forensic/'.

I have run into this issue a couple of times over the past two years.  Sometimes creating a new WGCS log source fixes the issue, but this time around it isn't a permanent fix.  This time when I created a new log source it would process 500 - 1 GB logs every few minutes for a few hours before erroring out again, and then I would create a new log source and the process would repeat again.  Now when I create a new log source I get the error after about 20 minutes following the successful processing of a few logs.  The SaaSHttpTimeout is already configured to 4 in the server.properties.log file.  Again, I encourage you to review the ticket which I opened last Thursday morning 1/21.  I'm still waiting for tech support to provide me any assistance, so I appreciate it if anybody can provide any tips that might help resolve this while I wait. 

1 Solution

Accepted Solutions
nashcoop
Reliable Contributor
Reliable Contributor
Report Inappropriate Content
Message 3 of 3

Re: WGCS log source error: Failed - Couldn't Initialize

Jump to solution

Thanks.  I was able to get this resolved with the help of McAfee tech support.  We've had this issue three times in our environment which has coincided with when we've upgraded CSR.  The first time it occurred there wasn't any KB available and it took a little time working with support to get it fixed, but after the second time we ran into the problem tech support referenced the KB below.  I keep it bookmarked since the problem happens infrequently enough that I needed it to jog my memory when we more recently upgraded CSR.

https://kc.mcafee.com/corporate/index?page=content&id=KB89493

View solution in original post

2 Replies
AaronT
Reliable Contributor
Reliable Contributor
Report Inappropriate Content
Message 2 of 3

Re: WGCS log source error: Failed - Couldn't Initialize

Jump to solution

We also have large WGCS files.  We made three changes to help us through these errors.  In server.properties, set SaasDataBatchSize to 10 (or 5) and SaasHttpTimeout to 20.  

SaasDataBatchSize is the number of minutes to get in each batch.  The smaller the value, the smaller the file.  We tell CSR to get data in 10 (or 5) minutes "batches" each time.  Don't worry, it will repeat the call until all the old logs are downloaded. (minimum batch size is 5 minutes, the maximum is 60

SaasHttPTimeout is the time before the connection is forced closed.  We chose 20 minutes to ensure we had plenty of time to download the files, which accounted for any hiccups in the network.  This is overkill, but it helped stop the error, (minimum is 1 minute, the maximum is 60 minutes)

We also had to change the idle timeout on the proxy settings for this connection from CSR.  We found that even though we set the SaasHttpTimeout, the connection still failed.  We set the timeout in the proxy to match the timeout in server.properties (20 minutes / 1200 seconds).  It's also worth confirming the firewalls (and other network infrastructure) won't timeout the connection along the way.

 

Hopefully this helps you like it helped us!

 

nashcoop
Reliable Contributor
Reliable Contributor
Report Inappropriate Content
Message 3 of 3

Re: WGCS log source error: Failed - Couldn't Initialize

Jump to solution

Thanks.  I was able to get this resolved with the help of McAfee tech support.  We've had this issue three times in our environment which has coincided with when we've upgraded CSR.  The first time it occurred there wasn't any KB available and it took a little time working with support to get it fixed, but after the second time we ran into the problem tech support referenced the KB below.  I keep it bookmarked since the problem happens infrequently enough that I needed it to jog my memory when we more recently upgraded CSR.

https://kc.mcafee.com/corporate/index?page=content&id=KB89493

View solution in original post

You Deserve an Award
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community