cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Highlighted
Level 8
Report Inappropriate Content
Message 1 of 4

Web Reporter & Multiple appliances

Hi,

I have a single MWG7.3 and WR5.2 in my environement and I'm now going to be adding more appliances. I've found references to the following documents for setting up WR with mutiple appliances however FTP is disabled so I cannot check.

Are they all the same document?  I've managed to download the doc in this post which looks promising but want ot be sure I have up2date info

https://community.mcafee.com/message/234311#234311

Also, if I have configured SYSLOG to push to SIEM, do I also need to create additional log rules for each appliance here?

thanks

3 Replies
Highlighted

Re: Web Reporter & Multiple appliances

This document is a little dated for 7.0.

I'm not sure exactly which version this was added, but you don't need to do the same with current versions.

If you have multiple machines in a central management cluster, you can use the %h variable on the Destination and Host Autopushing parameters to provide unique values per appliance's host name.

So if I setup Web Reporter to accept incoming log file files from 3 appliances: mwg7-1, mwg7-2 and mwg7-3 and those are the host names of each appliance, I can substitute %h for the username:

Capture.png

If I wanted to push the access log from each MWG to a different FTP directory, i would do something like this:

Capture2.png

You will need to make sure all the passwords are the same for each appliance because the shared configuration in a cluster gets replicated and the password cannot be substituted.

As for Syslog, i don't know which SIEM you use, but most syslog servers identify the sources by the IP address of the sender. you may not need to have a seperate log source in your case.

Spelling on 2/5/13 12:11:26 PM EST
Highlighted
Level 8
Report Inappropriate Content
Message 3 of 4

Re: Web Reporter & Multiple appliances

Cool that makes life easier!  Will try it tomorrow.

Highlighted
Level 8
Report Inappropriate Content
Message 4 of 4

Re: Web Reporter & Multiple appliances

All seems to be ok.  The live one is pushing logs correctly and the new appliance isn't busy enough yet.  Should see some action overnight.

You Deserve an Award
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community