Showing results for 
Search instead for 
Did you mean: 

WebReporter log parsing errors

Under Administartion / Tools / Logging, I noticed this entry in the "Log Parsing" log file.  Anybody else seeing this?

2011-01-13 00:00:00,846 ERROR [securecomputing.smartfilter.logparsing.LogAudit] (LogAudit[1101]) invalid line at linenumber 3

3 Replies

Re: WebReporter log parsing errors

Just the one line?

Sometimes the URL is too long to get imported by Web Reporter and fails.

Look at line 3 of the original log file and see if it's an enormous URL length.

Re: WebReporter log parsing errors

It's happening a lot.  After looking at the raw log, I think I see the problem now.  The URL is very short, but it's missing the method.

The URL portion only has the URL, no POST, or GET or CONNECT or any other method preceeding it.

"DRAKED" 0 " " "Shareware/Freeware" "Minimal Risk" "" 0 "" "" "10"

In the Log Handler, this function is returning "" instead of the method:

String.ReplaceIfEquals (Number.ToString (Response.StatusCode), "", "-")

Re: WebReporter log parsing errors

The minimum requirements for McAfee Web Gateway (WebWasher) access logs are a timestamp, client IP, and properly formatted URL.  For example:

#time_stamp client_ip  "req_line"

[08/Feb/2011:11:22:33 +0600] "GET HTTP/1.1"

Common problems with the req_line are:

  1. Missing GET/CONNECT/POST/ etc.
  2. Missing ftp://  http://  https:// etc.
  3. Missing the host name  "GET /index.html HTTP/1.1"
  4. Improperly quoted header/records.

It's possible that you could be encountering any combination of these.  To see which fields require quotes, please refer to the second table in KB69392.  It's written specifically for MWG 6.8.x, but the formatting applies to MWG 7 too.

ePO Support Center Plug-in
Check out the new ePO Support Center. Simply access the ePO Software Manager and follow the instructions in the Product Guide for the most commonly used utilities, top known issues announcements, search the knowledgebase for product documentation, and server status and statistics – all from within ePO.