Have you considered pushing the access log to WR instead? It's much more efficient that way.
The only difference between what the above guide dictates and what I'd recommend is you setup a separate log source on WR using each proxy's hostname. to accept incoming connections and set the password tot he same value for all the log source sources.
And in the access.log Autopush-setting, use %h as the logon name.
So for example, I have 2 proxies called mwg7-1 and mwg7-2.
Create a log source for each one:
And set the access.log setting on MWG to:
On the proxies, %h is substituted for the name of the proxy when the logs are pushed.
Hi, thanks, yes pushing works just fine, already using it, but that's not what I'm trying to do Let's call it curiosity, but I was trying to configure the pulling of logs directly from reporter.
Which version of MWG are you using right now? There is an issue for MWG 18.104.22.168 and higher. You can check your server.log and if you see this message:
ERROR [securecomputing.smartfilter.common.core.util.httputil.SfHttpClient] IOException:
javax.net.ssl.SSLException: java.lang.RuntimeException: Could not generate DH keypair
If you see this message this article should help to solve this: McAfee KnowledgeBase - Could not generate DH keypair (Web Reporter fails to collect logs from Web Gateway 22.214.171.124 and la…
Thanks, that was exactly the issue...
Running MWG 126.96.36.199 and can see that error in Web Reporter server.log. Following the KB the log pulling works as it should.