I am using Content Reporter to pull the logs from our Web Gateway device. The issue I am having is that the user name field is stored as <domain>\<UserID> and I would like to just return the <UserID> without the domain. Is there a way to accomplish this? Thanks in advance for your input.
Hello again bjurgens,
I don't believe removing the domain prefix is possible within Content Reporter without some java trickery, I think the best path would be to remove it from the log files. This can be done on McAfee Web Gateway by modifying a setting in the global.conf file. As discussed in the blockpage thread you can use the Secure Admin shell to make this change to avoid having to restart/stop the MWG service.
From the admin shell you can use the following command:
set global.LogFiles.PrefixNTLMUserNameWithDomain 0
Alternativley you must stop the service, modify line containing 'PrefixNTLMUserNameWithDomain' the global.conf file, and change the value from 1 to 0 and start the service back up.