cancel
Showing results for 
Search instead for 
Did you mean: 
mark.king
Level 7

WebReporter log parsing errors

Under Administartion / Tools / Logging, I noticed this entry in the "Log Parsing" log file.  Anybody else seeing this?

2011-01-13 00:00:00,846 ERROR [securecomputing.smartfilter.logparsing.LogAudit] (LogAudit[1101]) invalid line at linenumber 3

0 Kudos
3 Replies
eelsasser
Level 15

Re: WebReporter log parsing errors

Just the one line?

Sometimes the URL is too long to get imported by Web Reporter and fails.

Look at line 3 of the original log file and see if it's an enormous URL length.

0 Kudos
mark.king
Level 7

Re: WebReporter log parsing errors

It's happening a lot.  After looking at the raw log, I think I see the problem now.  The URL is very short, but it's missing the method.

The URL portion only has the URL, no POST, or GET or CONNECT or any other method preceeding it.

"DRAKED" 172.18.20.56 0 "https://tools.google.com/ " "Shareware/Freeware" "Minimal Risk" "" 0 "" "" "10"

In the Log Handler, this function is returning "" instead of the method:

String.ReplaceIfEquals (Number.ToString (Response.StatusCode), "", "-")

0 Kudos
sroering
Level 13

Re: WebReporter log parsing errors

The minimum requirements for McAfee Web Gateway (WebWasher) access logs are a timestamp, client IP, and properly formatted URL.  For example:

#time_stamp client_ip  "req_line"

[08/Feb/2011:11:22:33 +0600]  1.2.3.4 "GET http://sample.url.com HTTP/1.1"

Common problems with the req_line are:

  1. Missing GET/CONNECT/POST/ etc.
  2. Missing ftp://  http://  https:// etc.
  3. Missing the host name  "GET /index.html HTTP/1.1"
  4. Improperly quoted header/records.

It's possible that you could be encountering any combination of these.  To see which fields require quotes, please refer to the second table in KB69392.  It's written specifically for MWG 6.8.x, but the formatting applies to MWG 7 too.

https://kc.mcafee.com/corporate/index?page=content&id=KB69392

0 Kudos