Skip navigation
McAfee Secure sites help keep you safe from identity theft, credit card fraud, spyware, spam, viruses and online scams
525 Views 6 Replies Latest reply: Aug 27, 2013 3:14 PM by scottp RSS
scottp Newcomer 8 posts since
Apr 23, 2012
Currently Being Moderated

Aug 23, 2013 1:40 PM

Report for user agents failing to run and doing something I've not seen

Trying to create a report for user agent strings in web reporter.  I've tried each useragent field possible and they are all failing.  I'm not including other fields.  And I've tried for a day of data which is never an issue for other reports.  Any ideas why?

 

Since the user agent is sent to our logging solution via the same log files it is included.

 

 

User Agents

Line Agent ID Browser Name and Version Browser Name

Communications link failure

The last packet successfully received from the server was 28 milliseconds ago. The last packet sent successfully to the server was 1,451,354 milliseconds ago.

sql: SELECT scr_dim_agent.agent_id_string AS COL1, scr_dim_agent.agent_id_group_1 AS COL2, scr_dim_agent.agent_id_group_2 AS COL3

FROM scr_dim_agent scr_dim_agent, scr_fct_exact_access scr_fct_exact_access, scr_dim_ipaddress scr_dim_ipaddress, scr_dim_user scr_dim_user, scr_dim_site_request

scr_dim_site_request, scr_dim_action_request scr_dim_action_request, scr_dim_action scr_dim_action, scr_dim_log_source scr_dim_log_source, scr_dim_site scr_dim_site

WHERE scr_dim_agent.agent_id = scr_fct_exact_access.agent_id AND scr_dim_ipaddress.ip_id = scr_fct_exact_access.user_ip_id AND scr_dim_user.user_id =

scr_fct_exact_access.user_id AND scr_dim_site_request.site_request_id = scr_fct_exact_access.site_request_id AND scr_dim_action_request.action_request_id =

scr_fct_exact_access.action_request_id AND scr_dim_action_request.action_id = scr_dim_action.action_id AND scr_dim_log_source.log_source_id =

scr_fct_exact_access.log_source_id AND NOT( scr_fct_exact_access.seconds_since_epoch<1377129600) AND NOT( scr_fct_exact_access.seconds_since_epoch>1377215999) AND

NOT( scr_dim_site.site_name LIKE '%.site1.com') AND NOT( scr_dim_site.site_name LIKE '%.site2.com') AND scr_dim_site.site_id = scr_dim_site_request.site_id AND (

CASE WHEN scr_dim_action.action_id = 6 THEN 0 ELSE scr_dim_action.action_id END='0' )

ORDER BY COL1 ASC

 

 

Message was edited by: scottp on 8/23/13 1:34:11 PM CDT

 

Message was edited by: scottp on 8/23/13 1:40:57 PM CDT
  • sroering McAfee SME 459 posts since
    Feb 10, 2011

    Does this only happen when you include the user agent field to your query or does it happen for all reports, etc?  

    What are the exact steps to reproduce the issue?

  • sroering McAfee SME 459 posts since
    Feb 10, 2011

    Basically, your first post shows an error with the SQL query.  I took this as the text of the report body.  When that occurs, it simply means the report failed, for some reason.  I'm trying to understand what may have caused that since it isn't a common scenario.  You haven't given me alot of details yet.  you said that you are using an older version, but you didn't say which version.  

     

    The thread you said "It is possible I'm seeing a similar issue" isn't related to your problem.

     

    User agent has been a part of Web Reporter as long as the user-defined columns, so I don't know why you would try to use user-defined (custom) columns.  So you should try to use custom columns for user agent data.

     

    The error you seem to be getting could happen if there is a problem with the query, but I verified that it is syntatically correct.  The server.log may contain more information regarding what caused the error.  I think that the "Communications link failure" error is just the output of the exception handeling, and not the original cause of the error.

     

     

    Could you please

    1) Confirm which version of Web Reporter you are using.

    2) Answer my previous 2 questions more clearly.

    3) Recreate the error and post the more complete message from the bottom of server_err.log

  • sroering McAfee SME 459 posts since
    Feb 10, 2011

    Based on your feedback and the version you are running, this may be a bug.  I haven't see an issue like this in a very long time and version 5.1.1 is quite dated.

     

     

    I cannot think of a scenario where changing the date range for the report would cause the error you got.  Looking at the server.log should provide more information.

More Like This

  • Retrieving data ...

Bookmarked By (0)

Legend

  • Correct Answers - 5 points
  • Helpful Answers - 3 points