You can use "%h" as the user name on MWG, and create a log source for each web gateway on the web reporter, each using a MWG hostname as the user name. The %h will be translated into the appliance hostname during the push.
See https://kc.mcafee.com/corporate/index?page=content&id=KB76899 for more details and setup instructions.
the web link you provided is not opening with me, is it working with you ? Please let me know
When ever I click the link, I get below message:
You do not have access to this pagePlease double check the URL or bookmark.
You will be redirected to the ServerPortal Home page in 10 seconds. If your page does not automatically refresh, please follow the link below:
although I've support account with McAfee, any ideas ?
Looks like the forum is mangling the link. Try copying and pasting the text displayed. I only have my phone at the moment, otherwise I would fix the link it tries to use. Basically make sure the ampersand is in the link properly, not using the html escaping.
Thanks for your response, later 'malware-alerts' provided with same link and it worked. I just only got chance today to do the change in MWG servers as given in that link, now I will monitor how it goes, it reads two log sources or not.
I will post back with update.
Since yesterday after I changed the settings as below in MWG, then today I checked in reporter, Administration> setup > Log sources> Jobs, I don't see any log processing jobs, any advise to trouble shoot this ? Till yesterday it was showing log processing for LogSource from MWG1 before making change but today nothing.
1 of 1 people found this helpful
In the "Troubleshooting" section of MWG:
- Select "Log Files" from the left pane
- Select "Debug" from the right pane (where all the folders are)
- Look for the file "mwg-logmanager.out.log'"
This will give you somewhere to start your troubleshooting.
Did you configure usernames for the log sources on web reporter to match the hostnames of the web gateways?
I admit, while it is mentioned, the KB doesn't make that part very clear.
On the dashboard of MWG's I am getting error saying can not push /opt/mwg/log/user-defined-logs/access(filenumber) to https://10.1.99.46:9112/logloader
this message is same for MWG1 and MWG2
Yes, I configured usernames for the log soruces on web reporter to match host names of web gateways, any suggestions ?