With regard to the best practice article “Configuring McAfee Web Reporter log source for McAfee Web Gateway”:
The error code 67 stands for mismatching passwords. Therefore, the access is denied.
Maybe the credentials got changed under “Policy” > “Settings” > “File System logging” and aren’t synchronized yet on all cluster members.
You could also have a look at global log file pushing under “Configuration” > “Appliances” > “Log File Manager” if auto pushing is enabled. If yes, disable this option since log file pushing would be configured separately under “Policy” > “Settings” > “File System logging”, e.g. "Access Log Configuration" or "Access Denied Log Configuration".
Further information under:
Please check this and keep us informed.
Backup and browsing reports are going to 2 different servers.
HTTP is used for webreporter which is working fine.
ftp is used for configuration/policy backup and is not working,
ftp send username and password unencrypted. You can create a TCP dump and check entered credentials and server response.
GUI -> Troubleshooting -> Packet Capture (Parameters: -npi any -s0)
you can use 'host' parameter for tcpdump to filter the communication. Exp. -npi any -s0 host x.x.x.x