I'm using McAfee Web Gateway 6.8.7
It seems that the reputation filter is logging in the /var/log/messages file.
Is there a way to make it log in to a dedicated file, posibly in the web gui.
I know that I can read the data from the messages file in to another file. But I think it is a bit foolish to spam the messages with the reputation filter logs.
This is actually controlled by a setting in the GUI, you can find this under URL Filter > Web Reputation, if this is set to "Block & Log Reputation" then it will log to the /var/log/messages.
Putting this to a dedicated log on 6.x isnt the easiest, but you can just log "rep_level" in the access log, and it will be available there.
Let me know if this helps!
Thanks for the answer.
Basically I knew these options. I was just wondering if there were a way to get a dedicated file.
I might try the access log approach, although if it will log all the access events then the log will get huge very fast.
Actually the only reason I need the rep-logs is to weed out some of the false positives it is giving us.
And I can always grep and feed the events from the messages log.