We currently have running a Web Gateway 188.8.131.52.0 and start to generate the Reports with the Web Report App, the problem is we can see the logs being pushed and parsed with 100% sucess, but no data at Quick View page. I read a related post about it and follow the instructions whithout sucess..
Solved! Go to Solution.
Problem I see is that "rep_level" is being logged twice. In the header, between req_line and user_agent, you should only have 4 fields. The header is fine, the body is still wrong, but I didn't catch it. What Eric is also correct, but good news is that we can remove that line.
Do you have a screenshot of one of the successful log parsing jobs? It may be that the job is successful but with 100% error lines. That would mean that the header does not match the log records.
If you are not getting 100% errors during log parsing, then make sure the buffer is empty. Administration -> Options -> Performance -> Database statistics. The records cached should be moving up and down if you are currently parsing logs, otherwise it should go to zero.
If the logs are successfully being parsed, and not stuck in the buffer, then they are in the database. Only remaining possibility is that your report is filtering them, such as wrong date, or user filter but no authenticated traffic in the logs, etc.
OK. Your data is in the database. At least I can tell that the file you showed is for June 25th. If your reports are empty, then you are filtering it somehow. Or perhaps you are running a report on detail data, but not keeping it. (check the processing tab on your log sources and see if "store detail data" option is enabled). Detail data is enabled by default.
Remove your filters and expand your date range if you are running on summary data or if you are keeping detail data.
What is the report you are running?
So that's your clue. Check the Gateway. We know you successfully recieved a log for June, today, so at some point you had logging working, and we know that the log file pushing is working.
Was the write to access log been disabled?
Did you configure a new access log on your policy settings, but not enable pushing for that access log?
What is the file rotation? Web Gateway only pushing a log after it is rotated. Maybe you have a 10GB access log that hasn't been rotated for 2 weeks, etc.
There are really a large number of possibilities, but all on the Gateway.
Great, just one question, do i need to disable the Global log for pushing?
At the moment i'm just pushing the Policy > Settings > Acess Log its ok?
You don't want to enable the global pushing since it would push audit logs, error logs, etc. Web Reporter would just fail all of the jobs since it can only parse access logs.
Did you find the reason current data wasn't geting sent to Web Reporter?
A couple of hints, go under the troubleshooting section, drill down to your access logs under the user-defined logs. Check that you have access logs for recent days. "accessYYMMDDHHmmSS"
You can also check the log manager logs to see if it has any information.
Other than that, just double check the log rotation/push settings under the profile settings. Post screenshots if you have questions.