epo 4.5 SA 3.5 Web Reporter 5.2

[article15]

hi

i would like to ask some questions about about these 3 lines...

Actually i am ok with Epo..but pretty new with Site advisor and Web reporter.

The only the think i need actually, i have 250 users in the office and need to follow their internet activity.

Was installed and configured web reporter as guieded but the problem is ad administration when i wantto update my defined directory Reporter says Expected 0 Users, found 0. Expected 0 groups, covered 0

other strange thing is i am able to see users roles when i try to test it inside the directory Reporter able to comminicate with ADS

Also i was assinged from Log sources Accept incoming log files

log format Siteadvisor Enterprise format.

Selected directory which has been dedicated on directory section..

Then i gave to site advisors event tracking domains and downloads allways..capture user name and http://webreporter:9111/reporter   user and password.

the from client tasks daily 2 times Report collection schedule....

But nada...not able to see URLs or usernames at main epo report...

Could some one pls tellme about what is wrong or missing?

Thnx

[article15]

Ok i was able connect them..now my webreporter able to take user names and thier url activity...the only thing i cant see how many bytes they were used...

any suggest?

[sroering · Accepted solution]

I checked the Web Reporter produce guilde and it seems that Site Advisor data does not have bytes.  So if it isn't in the log, Web Reporter will not have that information for reports. 

Top of page 51, in chapter 6.

https://kc.mcafee.com/resources/sites/MCAFEE/content/live/PRODUCT_DOCUMENTATION/23000/PD23111/en_US/...

[article15]

Thanks so much for helpful information.

but strange thing is at the same chart it says webreporter can do.am i rigth? any way to run from web reporter? but i didnt see any agent at my registration downloads.reports run perfectly actually but would be perfect also if i can see the bytes.. did i request too much

And for the last thing is there any option or way that i can hide siteadvisors IE flag from my clients?

Thnx

Secure McAfee

Web

Reporter 5.0.0

and higher - Text

Format

[YYYY:MM:DD hh:mm:ss

+/-hh:mm] proxyAddress

zone clientAddress

userName url

action:actionString

categories bytes

httpmethod httpstatus

contentType fileExtension

reputation actionReason

viruses

[2008:03:04 22:47:53 00:00] 172.17.68.177 -

10.49.112.227 jfourd http://www.msn.com

0:allowed Business,Computing/Internet 5997 GET

200 text/html - NEUTRAL - -

[sroering]

But that is for a different log source type.  Changing the type of log source in Web Reporter won't change the data.  As you can see, Site Advisor format doesn't have bytes.

Note: it appears that there is a mistake in that table.  There are some missing headers in the "Expected formats" column (someId, client_ip, media_type).

Just as a reference, I check some site advisor logs and none of them have bytes. Sorry, but the data simply isn't in the log structure.  You can submit a Product Enhancement Request here. (https://mcafee.acceptondemand.com/) Maybe it can be added in the future.  Here is some additional information for submitting Product Enhancement Requests.

https://kc.mcafee.com/corporate/index?page=content&id=KB60021

[sroering]

I got some additional information that is worth sharing.  The reason bytes are not in the log structure is due to Site Advisor logs the HTTP request, not the response.  It doesn't know the size of the content since it hasn't been downloaded yet. 

[article15]

thanks for the all useful and perfect helps...

best regards...