1 2 Previous Next 12 Replies Latest reply on Jun 6, 2011 9:59 PM by smalldog

    Report users blocked

    smalldog

      Hi All, i view and create report with usernames. I can see users that allow but when i click on actions that blocked, the reporter don't show users that blocked access internet (see attach). Anyone here can help me, thanks!

        • 1. Re: Report users blocked
          asabban

          Hello,

           

          I am not sure if we are really seeing an issue here. It seems that there are only two requests that are reported as blocked by Web Reporter, one by User Admin and one by a blank User. It would probably be a good start to look into the access.logs for that period of time and see what was going on but - as far as I can tell from the Screenshots - it seems that Users are there, but there are only very few blocked requests.

           

          Are you able to provide a bit more details maybe?

           

          Thank you!

          Andre

          • 2. Re: Report users blocked
            smalldog

            Thanks Andre, i want to creat reports to show users who blocked access internet. In web reporter 5.2 can i do that?

            One more questions: in report show some users and ipaddress but some lines just show ip address, not username. Can you explain me?

             

            Message was edited by: smalldog on 5/31/11 2:39:26 AM CDT

             

            Message was edited by: smalldog on 5/31/11 2:40:37 AM CDT
            • 3. Re: Report users blocked
              asabban

              Hello,

               

              logging the Username of blocked requests should not be a problem at all. I think this is something that is done by the majority of the Web Reporter Users, since User names are very useful when you want to check for blocked requests. If it works in Web Reporter depends entirely on the Access.logs. They obviously have to contain the Username. Additionally there is a numeric block reason that Web Gateway logs, which is - as far as I know - the trigger for Web Reporter to show a request as allowed or forbidden.

               

              Requests not having a Username in the Log files can have various reasons. Most likely the authentication has been disabled for those requests because they are done by a client that is not able to authenticate, or they have a status code of 407 which means that the proxy is in the middle of authenticating, and does not (yet) know the Username.

               

              When I look at the above Log file it is very intreresting that all entries without a User name seem to point to some kinds of automatic update services. They are sometimes not able to perform proper authentication, but I would need more data to clarify. If you need someone to deeply look into your configuration, it may be helpful to file an SR with Support and send us some data.

               

              I hope this gives you some idea anyways.

               

              Best,

              Andre

              • 4. Re: Report users blocked
                smalldog

                Hi Andre, In my report (users allowed) have some users that blocked but still show on that (see attach). And Bytes - Allowed show some MB. Maybe the report error?

                • 5. Re: Report users blocked
                  asabban

                  Hello,

                   

                  do you think we can see a the complete access.log line? I assume that we maybe do not log all the necessary fields to allow Web Reporter to determine whether to report the request as "Allow" or "Block". If you are logging on Web Gateway, it would be helpful if you can give me the first line (e.g. the column description) and the complete line which shows the blocked request.

                   

                  This is my only idea so far.

                   

                  Best,

                  Andre

                  • 6. Re: Report users blocked
                    sroering

                    Here is some additional information regarding the log file structure and Web Reporter. If you are using MWG 7, then the process for modifying the log file structure is different, but Web Reporters perspective is the same. 

                     

                    https://kc.mcafee.com/corporate/index?page=content&id=KB69392

                    • 7. Re: Report users blocked
                      smalldog

                      Thanks for helping me, i just want to know.In my reports that create report for users allowed but still show users blocked and some users blocked still have some MBs allowed.. (see attach file).

                      • 8. Re: Report users blocked
                        sroering

                        I'm sorry, but I don't understand the problem because I don't know your expected result.  I don't see any blocks in that report.  Could you please attach a copy of the header from your MWG access log that asabban requested earlier.  This would let us know what information you are sending to Web Reporter.

                         

                        Keep in mind that Web Reporter can only show data that was sent to it. If you do not have the correct information in your logs, it will not be in your reports.

                        • 9. Re: Report users blocked
                          smalldog

                          Thanks for helping, see attach file for access log. My purpose: create two reports that show users allowed and other show users blocked. My problems: in users allowed report that also show some users blocked??? some lines show users that blocked with ipaddress and some lines just show ip address (for example: trucntt49939..)... I don't know why. I just want to show users allowed. Can you help me ..?

                           

                          Message was edited by: smalldog on 6/2/11 9:17:39 PM CDT
                          1 2 Previous Next