cancel
Showing results for 
Search instead for 
Did you mean: 
smalldog
Level 12

Report users blocked

Jump to solution

Hi All, i view and create report with usernames. I can see users that allow but when i click on actions that blocked, the reporter don't show users that blocked access internet (see attach). Anyone here can help me, thanks!

0 Kudos
1 Solution

Accepted Solutions
asabban
Level 17

Re: Report users blocked

Jump to solution

Hello,

logging the Username of blocked requests should not be a problem at all. I think this is something that is done by the majority of the Web Reporter Users, since User names are very useful when you want to check for blocked requests. If it works in Web Reporter depends entirely on the Access.logs. They obviously have to contain the Username. Additionally there is a numeric block reason that Web Gateway logs, which is - as far as I know - the trigger for Web Reporter to show a request as allowed or forbidden.

Requests not having a Username in the Log files can have various reasons. Most likely the authentication has been disabled for those requests because they are done by a client that is not able to authenticate, or they have a status code of 407 which means that the proxy is in the middle of authenticating, and does not (yet) know the Username.

When I look at the above Log file it is very intreresting that all entries without a User name seem to point to some kinds of automatic update services. They are sometimes not able to perform proper authentication, but I would need more data to clarify. If you need someone to deeply look into your configuration, it may be helpful to file an SR with Support and send us some data.

I hope this gives you some idea anyways.

Best,

Andre

0 Kudos
12 Replies
asabban
Level 17

Re: Report users blocked

Jump to solution

Hello,

I am not sure if we are really seeing an issue here. It seems that there are only two requests that are reported as blocked by Web Reporter, one by User Admin and one by a blank User. It would probably be a good start to look into the access.logs for that period of time and see what was going on but - as far as I can tell from the Screenshots - it seems that Users are there, but there are only very few blocked requests.

Are you able to provide a bit more details maybe?

Thank you!

Andre

0 Kudos
smalldog
Level 12

Re: Report users blocked

Jump to solution

Thanks Andre, i want to creat reports to show users who blocked access internet. In web reporter 5.2 can i do that?

One more questions: in report show some users and ipaddress but some lines just show ip address, not username. Can you explain me?

Message was edited by: smalldog on 5/31/11 2:39:26 AM CDT

Message was edited by: smalldog on 5/31/11 2:40:37 AM CDT
0 Kudos
asabban
Level 17

Re: Report users blocked

Jump to solution

Hello,

logging the Username of blocked requests should not be a problem at all. I think this is something that is done by the majority of the Web Reporter Users, since User names are very useful when you want to check for blocked requests. If it works in Web Reporter depends entirely on the Access.logs. They obviously have to contain the Username. Additionally there is a numeric block reason that Web Gateway logs, which is - as far as I know - the trigger for Web Reporter to show a request as allowed or forbidden.

Requests not having a Username in the Log files can have various reasons. Most likely the authentication has been disabled for those requests because they are done by a client that is not able to authenticate, or they have a status code of 407 which means that the proxy is in the middle of authenticating, and does not (yet) know the Username.

When I look at the above Log file it is very intreresting that all entries without a User name seem to point to some kinds of automatic update services. They are sometimes not able to perform proper authentication, but I would need more data to clarify. If you need someone to deeply look into your configuration, it may be helpful to file an SR with Support and send us some data.

I hope this gives you some idea anyways.

Best,

Andre

0 Kudos
smalldog
Level 12

Re: Report users blocked

Jump to solution

Hi Andre, In my report (users allowed) have some users that blocked but still show on that (see attach). And Bytes - Allowed show some MB. Maybe the report error?

0 Kudos
asabban
Level 17

Re: Report users blocked

Jump to solution

Hello,

do you think we can see a the complete access.log line? I assume that we maybe do not log all the necessary fields to allow Web Reporter to determine whether to report the request as "Allow" or "Block". If you are logging on Web Gateway, it would be helpful if you can give me the first line (e.g. the column description) and the complete line which shows the blocked request.

This is my only idea so far.

Best,

Andre

0 Kudos
sroering
Level 13

Re: Report users blocked

Jump to solution

Here is some additional information regarding the log file structure and Web Reporter. If you are using MWG 7, then the process for modifying the log file structure is different, but Web Reporters perspective is the same. 

https://kc.mcafee.com/corporate/index?page=content&id=KB69392

0 Kudos
smalldog
Level 12

Re: Report users blocked

Jump to solution

Thanks for helping me, i just want to know.In my reports that create report for users allowed but still show users blocked and some users blocked still have some MBs allowed.. (see attach file).

0 Kudos
sroering
Level 13

Re: Report users blocked

Jump to solution

I'm sorry, but I don't understand the problem because I don't know your expected result.  I don't see any blocks in that report.  Could you please attach a copy of the header from your MWG access log that asabban requested earlier.  This would let us know what information you are sending to Web Reporter.

Keep in mind that Web Reporter can only show data that was sent to it. If you do not have the correct information in your logs, it will not be in your reports.

0 Kudos
smalldog
Level 12

Re: Report users blocked

Jump to solution

Thanks for helping, see attach file for access log. My purpose: create two reports that show users allowed and other show users blocked. My problems: in users allowed report that also show some users blocked??? some lines show users that blocked with ipaddress and some lines just show ip address (for example: trucntt49939..)... I don't know why. I just want to show users allowed. Can you help me ..?

Message was edited by: smalldog on 6/2/11 9:17:39 PM CDT
0 Kudos