WebReporter questions

[apellepa]

We have created custom block reasons in WebGateway block pages and during processing logs in WebReporter get too many warnings in log. Such this

2013-10-01 15:23:03,667 WARN  [securecomputing.smartfilter.logparsing.parsers.util.ParsingUtils] unmatched block reason number: 6

It is possible to specifiy our custom block reasons in WebReporter to avoid this warnings ?

[sroering]

Web Reporter uses block_res to populate the action (block, allow, warn, etc) and the reason (due to malware, due to category, etc.).  Because of this, the block res needs to be in the specific set of default values used by Web Gateway.  However, this is the mapping range that you can use for your own custom block codes.  You should not that there is no range for "allow" since allow is either 0 or "no value".

MWG (6 & 7) Action | WR Action | WR Action Range

Coaching                  |   Warn       | 200 - 299          

Coaching Redirect   |  Bypass     | 300 - 399

Override Redirect     | Override    | 400 - 499

[apellepa]

Thanks

What range used for block reasons ?

[sroering]

Are you asking if there is a range for "block"?

I did a quick test using these values and they were all block (500, 550, 670, 2000, 3430).  So I would assume anything not in our ranges (including the large set of values under 100) would be considered a block.  Basically any high number above 499 should be a block action.