Under Administartion / Tools / Logging, I noticed this entry in the "Log Parsing" log file. Anybody else seeing this?
2011-01-13 00:00:00,846 ERROR [securecomputing.smartfilter.logparsing.LogAudit] (LogAudit) invalid line at linenumber 3
Just the one line?
Sometimes the URL is too long to get imported by Web Reporter and fails.
Look at line 3 of the original log file and see if it's an enormous URL length.
It's happening a lot. After looking at the raw log, I think I see the problem now. The URL is very short, but it's missing the method.
The URL portion only has the URL, no POST, or GET or CONNECT or any other method preceeding it.
"DRAKED" 172.18.20.56 0 "https://tools.google.com/ " "Shareware/Freeware" "Minimal Risk" "" 0 "" "" "10"
In the Log Handler, this function is returning "" instead of the method:
String.ReplaceIfEquals (Number.ToString (Response.StatusCode), "", "-")
The minimum requirements for McAfee Web Gateway (WebWasher) access logs are a timestamp, client IP, and properly formatted URL. For example:
#time_stamp client_ip "req_line"
[08/Feb/2011:11:22:33 +0600] 22.214.171.124 "GET http://sample.url.com HTTP/1.1"
Common problems with the req_line are:
It's possible that you could be encountering any combination of these. To see which fields require quotes, please refer to the second table in KB69392. It's written specifically for MWG 6.8.x, but the formatting applies to MWG 7 too.