3 Replies Latest reply on Jan 30, 2015 9:37 AM by mike18

    How to check smartfilter audit in Mcafee S5032

    mike18

      Hi Everyone,

       

      We have smartfilter enabled for http/https.

      Need to know how can i test if Smartfilter is auditing or not?

       

      For Access control rules we can see the -----view audit and we have option to see if traffic hits the rule or not.

      Do we have same option for smart filter also?

       

      Regards

      Mike

        • 1. Re: How to check smartfilter audit in Mcafee S5032
          PhilM

          Using your grant number, you should be able to go to the download section of the McAfee web site and download McAfee Web Reporter. This application can be used with most McAfee products that have SmartFilter or TrustedSource/GTI URL filtering built into them.

           

          From the SmartFilter configuration screens with the Firewall Administration GUI, you can point the Firewall at the IP address of the Windows machine running Web Reporter and then in Web Reporter configure it to expect a data stream from the Firewall.

           

          Before long you should then have live data arriving at Web Reporter and you can then generate reports on web usage and what is being blocked.

           

          -Phil.

          • 2. Re: How to check smartfilter audit in Mcafee S5032
            vkleineh

            Hi Mike,

             

            First, make sure you enable SF auditing:

             

            In version 8.x:

            Policy - Application Defenses - SmartFilter - Audit (tab) - Checkbox "Enable SmartFilter auditing"

             

            When you enable this checkbox, SmartFilter audit events are written to the following log files on the firewall:

            /var/log/audit.raw

            /var/log/SF.log

             

            In Audit Viewing, you can search for "smartfilter" in the advanced Expresssion to see what filters are available.

             

            - Volker

            • 3. Re: How to check smartfilter audit in Mcafee S5032
              mike18

              Many thanks Volker