If you look at the log parsing results in Web Reporter, you should notice that the number of error lines match the number of log lines (minus one for the header). So this essentially means Web Reporter accepted the header (it was a valid format), but the log lines didn't match the header pattern.
In Web Gateway, the header is configured separately from the log body so you need to be careful when modifying your web gateway logging rules. You may find this document helpful.
Post the log header and the logging rule config if you cannot find the problem on your own.
thanks for reply, actually I was using log format as 'web reporter 5.0 or higher' while the below was required, so this below change fixed my problem.
The correct Log Format setting is:
McAfee Web Gateway (Webwasher) - Auto Discover
But I have something to ask, may be you have answer for that, The web reporter shows wrong time on the UI and in reports, I double checked the time on system where reporter is installed is correct. When I access the reporter remotely using IE on my laptop for example, still the time remains wrong, any ideas how to fix this ?
Oops, I didn't notice the wrong log format.
The GUI and report results should use the server time. I'm unaware of any bugs since 5.2.1 either. Make sure you are on the latest version of Web Reporter. Then I'd recommend you submit a service request with support if you still see the same problem. Be sure to include a feedback (Administration -> Tools -> Backup) and note the time difference you see from server time and the GUI/reports.
Support Portal: https://mysupport.mcafee.com
Gold Support: 1.800.937.2237
Platinum Support: 1.866.452.9443
Worldwide Support: http://www.mcafee.com/us/about/contact-us.aspx#ht=tab-techsupport
Never mind. I see your support request (which was re-assigned to me). I'll update you as soon as possible.
Yes, we have gold support and I have service request to correct this time issue on our web reporter in progress on the portal site, I hope you will guide me to steps to correct the time on reporter.
5.2.1 is the version available for download as latest version of reporter, is there any other version after this ? because I could not get it on download link.