Web Reporter 5.2.0 Product Guide

Product Guide
McAfee® Web Reporter 5.2.0
COPYRIGHT
Copyright © 2011 McAfee, Inc. All Rights Reserved.
No part of this publication may be reproduced, transmitted, transcribed, stored in a retrieval system, or translated into any language in any form or by
any means without the written permission of McAfee, Inc., or its suppliers or affiliate companies.
TRADEMARK ATTRIBUTIONS
AVERT, EPO, EPOLICY ORCHESTRATOR, FOUNDSTONE, GROUPSHIELD, INTRUSHIELD, LINUXSHIELD, MAX (MCAFEE SECURITYALLIANCE EXCHANGE),
MCAFEE, NETSHIELD, PORTALSHIELD, PREVENTSYS, SECURITYALLIANCE, SITEADVISOR, TOTAL PROTECTION, VIRUSSCAN, WEBSHIELD are registered
trademarks or trademarks of McAfee, Inc. and/or its affiliates in the US and/or other countries. McAfee Red in connection with security is distinctive of
McAfee brand products. All other registered and unregistered trademarks herein are the sole property of their respective owners.
LICENSE INFORMATION
License Agreement
NOTICE TO ALL USERS: CAREFULLY READ THE APPROPRIATE LEGAL AGREEMENT CORRESPONDING TO THE LICENSE YOU PURCHASED, WHICH SETS
FORTH THE GENERAL TERMS AND CONDITIONS FOR THE USE OF THE LICENSED SOFTWARE. IF YOU DO NOT KNOW WHICH TYPE OF LICENSE YOU
HAVE ACQUIRED, PLEASE CONSULT THE SALES AND OTHER RELATED LICENSE GRANT OR PURCHASE ORDER DOCUMENTS THAT ACCOMPANY YOUR
SOFTWARE PACKAGING OR THAT YOU HAVE RECEIVED SEPARATELY AS PART OF THE PURCHASE (AS A BOOKLET, A FILE ON THE PRODUCT CD, OR A
FILE AVAILABLE ON THE WEBSITE FROM WHICH YOU DOWNLOADED THE SOFTWARE PACKAGE). IF YOU DO NOT AGREE TO ALL OF THE TERMS SET
FORTH IN THE AGREEMENT, DO NOT INSTALL THE SOFTWARE. IF APPLICABLE, YOU MAY RETURN THE PRODUCT TO MCAFEE OR THE PLACE OF
PURCHASE FOR A FULL REFUND.
2
McAfee® Web Reporter 5.2.0 Product Guide
Contents
Preface
7
About this guide . . . . . . . . . . . . . . . .
Audience . . . . . . . . . . . . . . . .
Conventions . . . . . . . . . . . . . . .
What's in this guide . . . . . . . . . . . .
Finding product documentation . . . . . . . . . .
1
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
7
7
7
8
8
. .
. .
. .
. .
. .
. .
. .
. .
. .
. .
. .
. .
. . 9
. . 10
. . 10
. 11
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
. . 23
. . 23
. 24
. . 24
. .
. .
. .
. .
. .
. .
. .
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
McAfee Web Reporter Installation
13
Licensing
.
.
.
.
.
.
.
.
.
.
.
.
13
13
13
14
15
15
15
15
16
16
17
19
20
. 20
20
. 20
23
Activate premium features . . . . . . . . . . . .
Automatically activate license . . . . . . . .
Manually activate license . . . . . . . . . .
Disable premium features . . . . . . . . . . . .
4
.
.
.
.
.
9
. .
. .
. .
. .
Planning considerations . . . . . . . . . . . . . . . . . . . . . . .
Setup requirements . . . . . . . . . . . . . . . . . . . . . . . . .
System requirements . . . . . . . . . . . . . . . . . . . . .
License requirements . . . . . . . . . . . . . . . . . . . . .
Download the software . . . . . . . . . . . . . . . . . . . . . . .
Install the software . . . . . . . . . . . . . . . . . . . . . . . . .
Installation for Microsoft Windows operating systems . . . . . . . .
Installation for UNIX operating systems . . . . . . . . . . . . . .
Upgrade the software . . . . . . . . . . . . . . . . . . . . . . . .
Back up the current configuration . . . . . . . . . . . . . . . .
Install the software upgrade . . . . . . . . . . . . . . . . . .
Update the database schema . . . . . . . . . . . . . . . . . .
Install patches . . . . . . . . . . . . . . . . . . . . . . . . . . .
Uninstall the software . . . . . . . . . . . . . . . . . . . . . . . .
Uninstall from Microsoft Windows operating systems . . . . . . . . .
Uninstall from UNIX operating systems . . . . . . . . . . . . . .
3
.
.
.
.
.
McAfee Web Reporter Introduction
McAfee Web Reporter elements and how they interact . . . . . . . . .
McAfee Web Reporter features . . . . . . . . . . . . . . . . . .
Basic features . . . . . . . . . . . . . . . . . . . . . .
Premium features . . . . . . . . . . . . . . . . . . . . .
2
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
Database Configuration
25
Database use in McAfee Web Reporter . . . . . . . . . . . . .
Internal database . . . . . . . . . . . . . . . . . . .
External databases . . . . . . . . . . . . . . . . . .
Update the database schema . . . . . . . . . . . . . . . . .
Partition the database . . . . . . . . . . . . . . . . . . . .
Set the database online or offline . . . . . . . . . . . . . . .
Execute SQL use . . . . . . . . . . . . . . . . . . . . . .
. .
. .
. .
. .
. .
. .
. .
. .
. .
. .
. .
. .
. .
. .
. .
. .
. .
. .
. .
. .
. .
McAfee® Web Reporter 5.2.0 Product Guide
. 25
25
. 27
. 28
28
. 29
. 29
3
Contents
5
6
Directory Configuration in McAfee Web Reporter
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
. 31
. . 31
. . 31
. . 32
Update the internal directory . . . . . . . . . . . . . . . . . .
Add or remove users from the internal directory . . . . . . . . . .
External directories . . . . . . . . . . . . . . . . . . . . . . . . .
External directory configuration . . . . . . . . . . . . . . . . .
External directory updates . . . . . . . . . . . . . . . . . . .
Associate users with groups . . . . . . . . . . . . . . . . . . . . .
Display directories with user names . . . . . . . . . . . . . . . . . .
Display full names with user names . . . . . . . . . . . . . . . . . .
Test group settings in a directory . . . . . . . . . . . . . . . . . . .
Directory management . . . . . . . . . . . . . . . . . . . . . . .
Copy a directory configuration . . . . . . . . . . . . . . . . . .
Disable an external directory . . . . . . . . . . . . . . . . . .
View directory assignments . . . . . . . . . . . . . . . . . . .
View directory status . . . . . . . . . . . . . . . . . . . . .
Delete a directory . . . . . . . . . . . . . . . . . . . . . . .
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
33
33
34
34
36
37
38
39
39
40
41
. 41
41
. 41
42
Log Sources and Log Formats
Log sources overview . . . . . . . . . . . . . . . . . . . . .
Log source modes . . . . . . . . . . . . . . . . . . .
Log formats overview . . . . . . . . . . . . . . . . . . . . .
Custom log formats . . . . . . . . . . . . . . . . . . .
Standard log formats . . . . . . . . . . . . . . . . . .
Use custom log formats . . . . . . . . . . . . . . . . . . . .
Configure custom log formats . . . . . . . . . . . . . . .
Edit or copy custom log formats . . . . . . . . . . . . . .
Delete custom log formats . . . . . . . . . . . . . . . .
View custom log format use . . . . . . . . . . . . . . .
Custom columns, rule sets, and user-defined columns overview . . . .
Custom columns . . . . . . . . . . . . . . . . . . . .
User-defined columns . . . . . . . . . . . . . . . . . .
Rule sets . . . . . . . . . . . . . . . . . . . . . . .
Configure a log source . . . . . . . . . . . . . . . . . . . . .
Configure custom columns . . . . . . . . . . . . . . . .
Configure rule sets . . . . . . . . . . . . . . . . . . .
Configure user-defined columns . . . . . . . . . . . . . .
Log data processing setup . . . . . . . . . . . . . . . .
Move log file data into the database . . . . . . . . . . . . . . .
Process incoming log files . . . . . . . . . . . . . . . .
Import a single log file immediately . . . . . . . . . . . .
Delete a log source . . . . . . . . . . . . . . . . . . . . . .
Disable a log source . . . . . . . . . . . . . . . . . . . . . .
Configure browse time options . . . . . . . . . . . . . . . . .
Browse time threshold . . . . . . . . . . . . . . . . .
Default browse time . . . . . . . . . . . . . . . . . .
7
31
Directories overview . . . . . . . . . . . . . . . . . . . . . . . . .
Internal directory . . . . . . . . . . . . . . . . . . . . . . . . . .
Create the internal directory user and group file . . . . . . . . . .
Populate the internal directory . . . . . . . . . . . . . . . . .
Categorization using the TrustedSource database
43
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
43
43
44
44
44
52
52
53
53
54
54
54
55
55
56
57
57
58
58
59
60
60
61
61
61
61
62
63
TrustedSource database overview . . . . . . . . . . . . . . . . . . . . . . . . . . . 63
Download the TrustedSource database . . . . . . . . . . . . . . . . . . . . . . . . . 64
Disable TrustedSource database downloads . . . . . . . . . . . . . . . . . . . . . . . 64
4
McAfee® Web Reporter 5.2.0 Product Guide
Contents
8
Logon Accounts
Logon account types . . . . . . .
Logon account role and permissions .
Delegated reports . . . . . . . .
Configure logon accounts . . . . .
65
.
.
.
.
.
.
.
.
.
.
.
.
. . .
. . .
. . .
. . .
. . . . . . .
. . . . . . .
. . . . . . . .
. . . . . . . .
Specify the logon account type . . . . . . . . . .
Define the role and permissions . . . . . . . . . .
Select delegated report data . . . . . . . . . . .
Manage logon accounts . . . . . . . . . . . . . . . .
Edit logon accounts . . . . . . . . . . . . . . .
Configure user interface timeout . . . . . . . . . .
Disable logon accounts . . . . . . . . . . . . .
Delete logon accounts . . . . . . . . . . . . . .
9
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
. . .
. . .
. . .
. . .
. . .
. . .
. . .
. . .
. . .
. . .
. . .
. . .
.
.
.
.
. . 65
. . 67
. 67
. 68
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
68
69
69
72
72
72
. 73
. 74
Email Settings
75
Email use in McAfee Web Reporter . . . . . . . . . . . . . . . . . . . . . . . . . . . 75
Configure email settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75
Test email settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76
10
Mapped Columns
77
Mapped columns overview . . . . . . . . . . . . . . . . . . . . .
Mapped column example . . . . . . . . . . . . . . . . . . .
Configure general mapped column settings . . . . . . . . . . . . . .
Add or edit mapped values manually . . . . . . . . . . . . . . . . .
Import mapped column values . . . . . . . . . . . . . . . .
Export mapped column values . . . . . . . . . . . . . . . . .
11
13
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
. 77
77
. 79
. 79
. 80
80
Database and System Performance
Configure Quick View cache settings . . . .
Configure memory allocation . . . . . . .
View performance statistics for the database .
Configure advanced performance options . .
12
.
.
.
.
.
.
81
. . .
. . .
. . .
. . .
. . .
. . .
. . .
. . .
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
. . 81
. . 81
. 82
. . 82
Database maintenance overview . . . . . . . . . . . .
Perform manual database maintenance . . . . . .
Configure the database maintenance schedule . . .
Database records maintenance . . . . . . . . . . . .
Database records rollup . . . . . . . . . . . .
Delete or roll up database records . . . . . . . .
Delete records by log source . . . . . . . . . .
Database records updates . . . . . . . . . . .
Rebuild indexes . . . . . . . . . . . . . . . . . .
Manual index rebuilding . . . . . . . . . . . .
Schedule index rebuilding . . . . . . . . . . .
Get database statistics . . . . . . . . . . . . . . . .
View the status of database maintenance jobs . . . . . .
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
System maintenance overview . . . . . . . . . . . . . . .
Perform system maintenance . . . . . . . . . . . . . . . .
Manual system maintenance . . . . . . . . . . . . .
Schedule maintenance . . . . . . . . . . . . . . . .
View the status of system maintenance jobs . . . . . . . . . .
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
. 91
. 91
. 91
92
. 92
Database Maintenance
83
System Maintenance
.
83
83
83
84
84
85
87
87
88
88
89
89
90
91
McAfee® Web Reporter 5.2.0 Product Guide
5
Contents
14
Configuration Backup and Restore
93
Configuration settings backup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93
Back up the current configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . 94
Restore McAfee Web Reporter settings . . . . . . . . . . . . . . . . . . . . . . . . . 95
Index
6
McAfee® Web Reporter 5.2.0 Product Guide
97
Preface
This guide provides the information you need to install, configure, and maintain your McAfee product.
Contents
About this guide
Finding product documentation
About this guide
This information describes the guide's target audience, the typographical conventions and icons used
in this guide, and how the guide is organized.
Audience
McAfee documentation is carefully researched and written for the target audience.
The information in this guide is intended primarily for:
•
Administrators — People who implement and enforce the company's security program.
Conventions
This guide uses the following typographical conventions and icons.
Book title or Emphasis Title of a book, chapter, or topic; introduction of a new term; emphasis.
Bold
Text that is strongly emphasized.
User input or Path
Commands and other text that the user types; the path of a folder or program.
Code
A code sample.
User interface
Words in the user interface including options, menus, buttons, and dialog
boxes.
Hypertext blue
A live link to a topic or to a website.
Note: Additional information, like an alternate method of accessing an option.
Tip: Suggestions and recommendations.
Important/Caution: Valuable advice to protect your computer system,
software installation, network, business, or data.
Warning: Critical advice to prevent bodily harm when using a hardware
product.
McAfee® Web Reporter 5.2.0 Product Guide
7
Preface
Finding product documentation
What's in this guide
This guide is organized to help you find the information you need.
This guide is intended for a reporting administrator who installs, configures, and maintains the McAfee
Web Reporter. Administration tasks include creating logon accounts, managing delegated reporting
permissions, configuring email settings, managing the database, directories, and log sources, and so
on.
This guide assumes the reporting administrator has:
•
An understanding of the organization's filtering device or other log source
•
A working knowledge of the organization's internal network
•
An understanding of the operating system on which the McAfee Web Reporter is installed
•
A working knowledge of the Internet and its protocols
Finding product documentation
McAfee provides the information you need during each phase of product implementation, from
installation to daily use and troubleshooting. After a product is released, information about the product
is entered into the McAfee online KnowledgeBase.
Task
1
Go to the McAfee Technical Support ServicePortal at http://mysupport.mcafee.com.
2
Under Self Service, access the type of information you need:
To access...
Do this...
User documentation
1 Click Product Documentation.
2 Select a Product, then select a Version.
3 Select a product document.
KnowledgeBase
• Click Search the KnowledgeBase for answers to your product questions.
• Click Browse the KnowledgeBase for articles listed by product and version.
8
McAfee® Web Reporter 5.2.0 Product Guide
1
McAfee Web Reporter Introduction
The McAfee® Web Reporter creates reports that show you how people in your organization are using
the Internet.
McAfee Web Reporter provides the reporting tools to identify issues in your organization such as
liability exposure, productivity loss, bandwidth overload, and security threats. You can use this
information to modify web use policies and provide guidance for appropriate Internet use in your
organization. Use McAfee Web Reporter with McAfee® Web Gateway, McAfee® SiteAdvisor® Enterprise
software, McAfee® SmartFilter® software, and other third-party web filtering solutions.
Contents
McAfee Web Reporter elements and how they interact
McAfee Web Reporter features
McAfee Web Reporter elements and how they interact
The McAfee Web Reporter environment involves several elements to produce reports for your
organization.
Understand the role of each element to plan, use, and maintain the McAfee Web Reporter
environment. Elements in the environment include:
•
•
Administrators and users — There are three groups of people that use McAfee Web Reporter:
•
Users — People in your organization who access the Internet
•
Reporting users — People who create and view reports using McAfee Web Reporter
•
Reporting administrators — People who install, configure, and maintain the McAfee Web
Reporter and can create and view reports
Database — The database stores data from each log source and reports are generated using the
data. Use the internal database or one of these supported external database platforms:
• Internal database (MySQL)
• MySQL 5.0 (MyISAM Storage Engine)
• Microsoft SQL Server 2000
• Oracle 9i
• Microsoft SQL Server 2005
• Oracle 10g
• Microsoft SQL Server 2008
• Oracle 11g
McAfee® Web Reporter 5.2.0 Product Guide
9
1
McAfee Web Reporter Introduction
McAfee Web Reporter features
•
Directory — The directory contains user or group logon account information; McAfee Web Reporter
includes an internal directory, or you can connect to an external directory. Options include:
• LDAP
• Sun Java System Directory Server
• Microsoft Active Directory
• McAfee Web Reporter internal directory
• Novell eDirectory
•
•
Log sources — Log sources are devices on the network set up to generate (web filtering device)
or store (FTP server) log files. Log files contain web filtering data that includes information such as
user names, IP addresses, URLs, time stamps, protocols, and so on. McAfee Web Reporter receives
or collects and processes the log files and then imports the data into the database. Log sources
include:
• Custom log formats
• McAfee Web Security format
• FTP server
• NetCache
• McAfee Web Gateway
• McAfee Web Reporter server directory
McAfee Web Reporter — Server-based software that contains:
• Configuration settings
• Reporting database
• Created report definitions
• TrustedSource database (when you choose to
download it)
• Log data (when using the internal database)
• Web-based user interface
McAfee Web Reporter features
Review information about McAfee Web Reporter features to determine how you set up your reporting
environment.
Basic features
McAfee Web Reporter basic features are available for free in every installation of the software.
Basic features include:
10
•
External databases — Connect McAfee Web Reporter to a supported database that contains your
reporting data.
•
External directories — Use your organization's user directories to include user and group
information in reports and for logon accounts.
•
External log sources and standard log formats — Use your organization's device that generates log
files in one of the supported standard log formats; your organization might have more than one
device.
•
First four records in advanced reports — View the first four rows (also called records) of any
advanced report; to get full advanced reports, purchase a license for premium features.
McAfee® Web Reporter 5.2.0 Product Guide
McAfee Web Reporter Introduction
McAfee Web Reporter features
•
Internal reporting database — Use the included internal database to store smaller amounts of
reporting data, or for evaluation purposes.
•
Quick View reports — View and interact with all summary, custom, and favorite reports.
1
Premium features
McAfee Web Reporter premium features are available with the purchase of a license key. However, the
premium features are available for free during a 90-day evaluation period. After the evaluation period
expires, all premium features are disabled.
Premium reporting includes all the basic features and adds the following features:
•
Complete advanced reports — Advanced reports give you the ability to further customize reports
through options, such as table or graph layout, advanced queries, and more. Advanced reports are
available in the basic reporting version with up to the first four rows of data. To run a report and
display all available data, purchase and activate the premium reporting license.
•
Custom log formats — Gives you the ability to assign predefined column headers, exclude columns,
or rename columns for existing log files, in addition to the supported formats available in the basic
version. Customize a log format using the Custom Log Format wizard.
•
Custom logo — The logo image feature enables you to add a custom logo or another image to
display on all exported reports. By default the McAfee logo appears on all exported reports.
•
Delegated reporting — A role-based access control used to restrict access to specific report data;
specify access to data for:
•
Individual IP addresses or IP address ranges
•
Individual users or user groups (internal users and directory-based users)
•
Log source
Delegated reporting permissions are selected when the reporting account is configured.
See also
Activate premium features on page 23
Get a license on page 14
McAfee® Web Reporter 5.2.0 Product Guide
11
2
McAfee Web Reporter Installation
The installation procedure for McAfee Web Reporter varies depending on the operating system and the
type of installation (first time or upgrade). This section provides instructions about installing McAfee
Web Reporter in a variety of environments.
Contents
Planning considerations
Setup requirements
Download the software
Install the software
Upgrade the software
Install patches
Uninstall the software
Planning considerations
Before you install McAfee Web Reporter, make sure you understand what you need to install and run
the software. Use the information in this section to help you plan your installation of McAfee Web
Reporter.
Setup requirements
Before setting up McAfee Web Reporter, review the system and license requirements.
System requirements
To install and operate McAfee Web Reporter, the system must meet the following minimum requirements.
Hardware requirements
•
Processor: 2 GHz Dual CPU (or Dual Core)
•
RAM: 2 GB
•
Disk space:
•
600 MB for software
•
1 GB of space for every gigabyte of log data collected and processed
McAfee® Web Reporter 5.2.0 Product Guide
13
2
McAfee Web Reporter Installation
Setup requirements
Software requirements
•
•
•
Supported 32-bit operating systems:
•
Microsoft Windows Server 2003 Service Pack 2
•
Microsoft Windows Server 2008 Service Pack 1
•
Red Hat Enterprise Linux 4.5 server
•
Red Hat Enterprise Linux 5.4 server
Supported 64-bit operating systems:
•
Microsoft Windows Server 2003 Service Pack 2
•
Microsoft Windows Server 2008 Service Pack 1
•
Microsoft Windows Server 2008 Release 2
•
Oracle Solaris 9 or Oracle Solaris 10 (on Oracle's Sun SPARC systems)
•
Red Hat Enterprise Linux 4.5 server
•
Red Hat Enterprise Linux 5.4 server
Web browser:
•
Microsoft Internet Explorer 6.x and later (with Java version 6 installed)
•
Mozilla Firefox 3.6.x (with Java version 6 installed)
•
Safari 5.0 (on Apple OS X)
Report requirements
•
One or more log sources
•
One or more user directories
•
One database
•
License for premium features
License requirements
McAfee Web Reporter requires a license key for use of the premium features.
Get a license
A license is required for premium features in McAfee Web Reporter.
To obtain an evaluation license key, contact your sales representative, authorized reseller, or contact
Customer Service directly by visiting service.mcafee.com.
See also
Activate premium features on page 23
Premium features on page 11
14
McAfee® Web Reporter 5.2.0 Product Guide
McAfee Web Reporter Installation
Download the software
2
Download the software
Download the software to a computer where you want to install it.
Task
1
Open a web browser and go to the Download page located at www.mcafee.com/us/enterprise/
downloads.
2
Use your McAfee Support grant number to log on and download the software. Select the directory
where you want to save the installation file and click OK.
Install the software
Install the software using the instructions for your operating system.
Tasks
•
Installation for Microsoft Windows operating systems on page 15
Use these instructions to install the McAfee Web Reporter on a supported Microsoft
Windows operating system.
•
Installation for UNIX operating systems on page 15
Use these instructions to install the McAfee Web Reporter on a supported UNIX-based
operating system.
Installation for Microsoft Windows operating systems
Use these instructions to install the McAfee Web Reporter on a supported Microsoft Windows operating
system.
Task
1
Log on to the Microsoft Windows operating system as an administrator.
2
Locate and run the installation file.
3
Follow the prompts to install the software.
•
On the Logon Credentials window, type a name and password (at least six characters) for the
default reporting administrator.
•
On the Email settings window, type the email account settings to receive notifications or reports
via email.
This step is optional. If you do not provide email information at this
time, you can type in the necessary information on the Email delivery
window in the interface. Email information is necessary for the emailed
reports and alerts features.
The software is installed.
Installation for UNIX operating systems
Use these instructions to install the McAfee Web Reporter on a supported UNIX-based operating system.
Task
1
Log on to the operating system with an account that has administrator privileges.
2
Locate and change permissions on the installation file using chmod 700 <installation filename>.
McAfee® Web Reporter 5.2.0 Product Guide
15
2
McAfee Web Reporter Installation
Upgrade the software
3
Run the installation file.
For Red Hat Linux users, select the platform that best matches the
version of Linux you are installing the software on.
4
Follow the prompts to install the software:
•
On the Logon Credentials window, type a name and password (at least six characters) for the
default reporting administrator.
•
On the Email settings window, type the email account settings to receive notifications or reports
via email.
If you do not provide email information at this time, you can type in the
necessary information on the Email delivery window in the interface.
Email information is necessary for the emailed reports and alerts features.
•
On the User account window, type a UNIX user account that has a valid login shell.
The software is installed.
Upgrade the software
Upgrading the software involves backing up the existing configuration, and updating the database and
directories.
Tasks
•
Back up the current configuration on page 16
Back up system settings so you can restore configuration settings after upgrading the
software, to ease recovery from a catastrophic failure, or to move settings from one McAfee
Web Reporter installation to another.
•
Install the software upgrade on page 17
Upgrade the McAfee Web Reporter to the latest version.
•
Update the database schema on page 19
Use the steps in this procedure to update the database schema when McAfee Web Reporter
requires it.
Back up the current configuration
Back up system settings so you can restore configuration settings after upgrading the software, to
ease recovery from a catastrophic failure, or to move settings from one McAfee Web Reporter
installation to another.
If you plan to use a backup file after uninstalling and reinstalling McAfee
Web Reporter, save the backup file to a location other than the McAfee
Web Reporter application folder.
16
McAfee® Web Reporter 5.2.0 Product Guide
McAfee Web Reporter Installation
Upgrade the software
2
Task
For option definitions, click Help in the interface.
1
Go to Administration | Tools | System Backup.
2
Perform one of the following actions:
•
Click Start. A backup folder and corresponding XML file are created. A backup.xml file is saved in
C:\Program Files\McAfee\Web Reporter\reporter\conf\ (for UNIX: /opt/McAfee/
WebReporter/reporter/conf), where 123456789 is the time stamp.
•
Click Browse, navigate to a directory where you want to store the backup file, click Select, then
click Start.
A message appears stating that the client will not be able to communicate with the server until the
system backup is done.
3
Click OK to continue.
The backup process can take several minutes.
4
Close McAfee Web Reporter after the backup is complete.
5
Stop the McAfee Web Reporter services.
6
Go to the C:\Program Files\McAfee\Web Reporter\reporter\ (for UNIX: /opt/McAfee/
WebReporter/reporter) directory and back up the following files and directories to a location of
your choosing:
7
•
.../conf/
•
.../mysql/var/reporting/
•
.../log/realtime.log (if you use real-time logging)
•
.../docs/
Upgrade McAfee Web Reporter.
If there are issues after the upgrade, you can reinstall the previous version you were running and
restore your backup files.
See also
Restore McAfee Web Reporter settings on page 95
Configuration settings backup on page 93
Install the software upgrade
Upgrade the McAfee Web Reporter to the latest version.
Before you begin
Determine if you are upgrading the McAfee Web Reporter 32-bit software to the latest
32-bit version, or if you are upgrading the McAfee Web Reporter 32-bit software to the
64-bit version. Then follow the appropriate software upgrade installation instructions.
McAfee® Web Reporter 5.2.0 Product Guide
17
2
McAfee Web Reporter Installation
Upgrade the software
Tasks
•
Upgrade McAfee Web Reporter 32-bit on page 18
Follow these steps when you are upgrading an existing McAfee Web Reporter 32-bit
software installation to the latest McAfee Web Reporter 32-bit software
•
Upgrade McAfee Web Reporter 64-bit on page 18
Follow these steps when you are upgrading from McAfee Web Reporter 32-bit to 64-bit, or
McAfee Web Reporter 64-bit to 64-bit.
Upgrade McAfee Web Reporter 32-bit
Follow these steps when you are upgrading an existing McAfee Web Reporter 32-bit software
installation to the latest McAfee Web Reporter 32-bit software
Before you begin
Back up your current McAfee Web Reporter configuration.
Task
1
Log on to the operating system with an account that has administrator privileges.
2
Locate and run the installation file.
3
•
[UNIX platforms] Change permissions on the installation file using chmod 700 <installation
filename>.
•
[Linux] If you install the software on an unsupported Linux platform, a message appears
requesting you to select a supported Linux platform from a supplied list. Select the platform
that best matches the version of Linux that you are installing McAfee Web Reporter on.
Follow the prompts to complete the upgrade.
•
The installer checks for a system backup file. The backup file contains all the McAfee Web
Reporter environment settings.
•
If a backup file is found, McAfee Web Reporter continues with the upgrade.
•
If a backup file is not found, a message appears asking you to create a system backup file. Click
Exit and log on to your current installation of McAfee Web Reporter and create a system backup
file. Log out of McAfee Web Reporter and restart the upgrade process.
McAfee Web Reporter is upgraded.
Upgrade McAfee Web Reporter 64-bit
Follow these steps when you are upgrading from McAfee Web Reporter 32-bit to 64-bit, or McAfee Web
Reporter 64-bit to 64-bit.
Before you begin
Back up your current McAfee Web Reporter configuration.
When you upgrade McAfee Web Reporter 32-bit to McAfee Web Reporter 64-bit, McAfee Web Reporter
must be installed in a different directory — do not use the existing McAfee Web Reporter 32-bit
installation directory. After the upgrade, McAfee Web Reporter 64-bit is the default installation and
McAfee Web Reporter 32-bit remains on the computer.
18
McAfee® Web Reporter 5.2.0 Product Guide
McAfee Web Reporter Installation
Upgrade the software
2
Task
1
Log on to the operating system with an account that has administrator privileges.
2
Download and run the installation file for McAfee Web Reporter 64-bit.
3
•
[UNIX platforms] Change permissions on the installation file using chmod 700 <installation
filename>.
•
[Linux] If you install the software on an unsupported Linux platform, a message appears
requesting you to select a supported Linux platform from a supplied list. Select the platform
that best matches the version of Linux that you are installing McAfee Web Reporter on.
Follow the prompts to complete the upgrade.
•
For UNIX, the installer asks for the user account.
•
For 32-bit to 64-bit:
•
The installer asks if you want to migrate the internal database.
Depending on the size of the internal database, this migration might
take some time. Ensure that you have sufficient disk space to migrate
the internal database.
•
•
The install checks for a system backup file. If a backup file is found, the installer asks if you
want to import it. If one is not found, the installer treats the upgrade as a new installation
and continues; the 32-bit version remains on the computer.
For 64-bit to 64-bit, the installer checks for a system backup file.
•
If a backup file is found, the installer asks if you want to import it.
•
If a backup file is not found, a message appears asking you to create a system backup file.
Click Exit and log on to your current installation of McAfee Web Reporter and create a system
backup file. Log out of McAfee Web Reporter and restart the upgrade process.
McAfee Web Reporter is upgraded.
Update the database schema
Use the steps in this procedure to update the database schema when McAfee Web Reporter requires it.
The database schema is the definition of tables and fields used in the database for McAfee Web
Reporter. When McAfee Web Reporter detects that the database schema is out of date (such as after
an upgrade), it sets the database to Offline. Schema is out of date. and provides an Update Schema button.
Depending on the size of your database, updating the database schema
might take some time.
Task
For option definitions, click Help in the interface.
1
Go to Administration | Setup | Database.
2
Click Update Schema.
To partition the database at the same time you perform the schema
update, click Advanced and select Partition Schema, then click Update Schema.
However, partition the database only if you need to. After you begin the
partition, you cannot cancel nor reverse this action. This option is not
available if the database is already partitioned.
The action completes and McAfee Web Reporter sets the database to Connected.
McAfee® Web Reporter 5.2.0 Product Guide
19
2
McAfee Web Reporter Installation
Install patches
Install patches
Obtain and install software patches when they are available.
In McAfee Web Reporter, a triangle appears in the upper-right corner of the user interface when a new
software patch is available. The symbol appears until you update the software.
Task
For option definitions, click Help in the interface.
1
Click the triangle in the upper-right corner of the user interface.
2
Click a link in the Notifications window to go to the software download center.
3
Enter your grant number to access the product downloads.
4
Download the software and install the patch.
Uninstall the software
Follow the steps for your operating system to uninstall the McAfee Web Reporter.
Tasks
•
Uninstall from Microsoft Windows operating systems on page 20
Follow the steps to uninstall the software from Microsoft Windows.
•
Uninstall from UNIX operating systems on page 20
Follow the steps to uninstall the software from UNIX operating systems.
Uninstall from Microsoft Windows operating systems
Follow the steps to uninstall the software from Microsoft Windows.
Task
1
Log on as an administrator.
2
Use the add or remove programs feature provided by Microsoft Windows.
3
Remove McAfee Web Reporter (32-bit) or (64-bit).
4
On the Welcome window, click Next.
5
On the Summary Information window, click Uninstall. McAfee Web Reporter is uninstalled.
6
On the Uninstall Complete window, click Finish.
The software is uninstalled.
Uninstall from UNIX operating systems
Follow the steps to uninstall the software from UNIX operating systems.
Task
20
1
Log on with an account that has administrator privileges.
2
In the McAfee Web Reporter uninstall directory, run ./uninstaller.bin.
3
On the Welcome window, click Next.
McAfee® Web Reporter 5.2.0 Product Guide
McAfee Web Reporter Installation
Uninstall the software
2
McAfee® Web Reporter 5.2.0 Product Guide
21
4
On the Summary Information window, click Uninstall.
5
On the Uninstall Complete window, click Finish.
The software is uninstalled.
3
Licensing
Basic features do not require a license and run without restriction. Premium features are fully enabled
during the 90 day evaluation period that begins immediately after installation. However, a license is
required to continue running premium features past the evaluation period.
The remaining period of days for the evaluation period displays in the top right corner of the McAfee
Web Reporter user interface. At the end of the evaluation period, all premium features are
automatically disabled and all data is retained. To keep premium features past the evaluation period,
you must activate a license. When you do, premium features are enabled through the length of your
license subscription. Disable premium features, including for the evaluation period, if you do not want
them.
If you have an existing license for premium features in previous versions of McAfee Web Reporter,
your license key is accepted and activates premium features in this version of McAfee Web Reporter.
The expiration date remains unchanged for your existing license and appears in the McAfee Web
Reporter user interface.
Contents
Activate premium features
Disable premium features
Activate premium features
To use premium features after the evaluation period ends, enter and activate your license key.
Tasks
•
Automatically activate license on page 23
Use the automatically activate feature when the McAfee Web Reporter server has an
Internet connection.
•
Manually activate license on page 24
Use the manually activate license feature when you have a license key.
See also
Get a license on page 14
Premium features on page 11
Automatically activate license
Use the automatically activate feature when the McAfee Web Reporter server has an Internet connection.
McAfee® Web Reporter 5.2.0 Product Guide
23
3
Licensing
Disable premium features
Task
For option definitions, click Help in the interface.
1
Go to Administration | Setup | License.
2
Click Activate.
3
On the Automatically Activate tab, fill in all the fields.
4
Click Activate.
Premium features are activated.
Manually activate license
Use the manually activate license feature when you have a license key.
Before you begin
You must obtain a license key before completing this procedure. To obtain a license key,
contact your sales representative, authorized reseller, or contact Customer Service directly
by visiting service.mcafee.com.
Task
For option definitions, click Help in the interface.
1
Go to Administration | Setup | License.
2
Click Activate.
3
On the Manually Activate tab, fill in the License key field.
4
Click Activate.
Premium features are activated.
Disable premium features
You can disable premium features at any time. However, if you do not need the premium features and
will not be purchasing a license, disable premium features during the evaluation period.
Task
For option definitions, click Help in the interface.
24
1
Go to Administration | Setup | License.
2
Select Disable premium features.
3
Click Save.
McAfee® Web Reporter 5.2.0 Product Guide
4
Database Configuration
McAfee Web Reporter uses a database to store data from log files. Use a database that is appropriate
for the size of your organization and the amount of data it generates.
Contents
Database use in McAfee Web Reporter
Update the database schema
Partition the database
Set the database online or offline
Execute SQL use
Database use in McAfee Web Reporter
McAfee Web Reporter comes with an internal database. You can use a supported external database
instead, depending on your organization and data needs.
Supported external database platforms
You can use one of the following databases to store data from log files:
•
Microsoft SQL Server 2000
•
Microsoft SQL Server 2005
•
Microsoft SQL Server 2008
•
MySQL 5.0 (MyISAM Storage Engine)
•
Oracle 9i
•
Oracle 10g
•
Oracle 11g
Internal database
During installation, McAfee Web Reporter is automatically configured to use the internal database
(MySQL 5.0). McAfee recommends using this database only if you need to store up to 50 GB of data.
The internal database is installed on the same drive as the McAfee Web Reporter; therefore, you must
have enough free drive space to accumulate data in the internal database. The internal database is
configured and ready to use immediately. For organizations that anticipate accumulating data
exceeding 50 GB, or if you plan to disable page view processing for log files, McAfee recommends you
use a supported external database.
You cannot transfer log files and data from the internal database to
another database.
McAfee® Web Reporter 5.2.0 Product Guide
25
4
Database Configuration
Database use in McAfee Web Reporter
McAfee recommends using the internal database for the following situations:
•
For a small- to medium-size organization
•
Evaluating McAfee Web Reporter
Internal database use
Use the internal database if you will accumulate less than 50 GB of data.
While the internal database does not require any configuration, you can view its settings. However,
you cannot make changes to the internal database.
You cannot transfer log files and data from the internal database to
another database.
Task
For option definitions, click Help in the interface.
1
Go to Administration | Setup | Database.
2
Select Default internal database.
The default internal database is named reporting.
The default internal database is selected and will store data when McAfee Web Reporter processes log
files.
Internal database backup and restore
Back up the internal database to safeguard your data against hardware failures or other issues.
Reinstate data from the backup using the restore feature.
Before you begin
McAfee recommends using the MySQL GUI Tools, which includes MySQL Administrator, to
back up or restore the McAfee Web Reporter internal database. The MySQL GUI Tools is
available as a free download from dev.mysql.com/downloads/gui-tools and must be
installed on the same computer as McAfee Web Reporter. Refer to the MySQL GUI Tools
documentation for specific instructions on backing up or restoring the database.
You will need the following information when using this tool:
26
•
Server Hostname — 127.0.0.1
•
Port — 9129
•
Username — dba
•
Password — dba
•
Database name — reporting
McAfee® Web Reporter 5.2.0 Product Guide
Database Configuration
Database use in McAfee Web Reporter
4
Task
1
Log off McAfee Web Reporter.
2
Shut down the Web Reporter Server service.
For Microsoft Windows:
a
Go to Control Panel | Administrative Tools | Services.
b
In the Name column, select Web Reporter Server.
c
Stop the service.
For Linux:
a
As root, open a terminal shell.
b
Execute the following command: /etc/init.d/webreporter_control stop
3
Perform the backup or restore procedure using instructions in the MySQL Administrator
documentation.
4
Restart the Web Reporter Server service.
For Microsoft Windows:
a
Go to Control Panel | Administrative Tools | Services.
b
In the Name column, select Web Reporter Server.
c
Restart the service.
For Linux:
5
a
As root, open a terminal shell.
b
Execute the following command: /etc/init.d/webreporter_control start
Log on to McAfee Web Reporter.
The backup or restore is complete and the internal database is functional.
External databases
Use an external database when you have more than 50 GB of data to store.
You can install the McAfee Web Reporter and the external database on the same computer or on
separate computers. If you install McAfee Web Reporter on the same computer as the external
database, you must have enough disk space to accumulate data according to your organization's needs.
McAfee recommends using an external database for the following situations:
•
When in a medium- to large-size organization
•
When you disable page view processing
•
When you need increased performance
•
When you need additional database management tools
Refer to the product documentation for your external database for
instructions about backing up the database.
McAfee® Web Reporter 5.2.0 Product Guide
27
4
Database Configuration
Update the database schema
Connect to an external database
Connect McAfee Web Reporter to an external database.
Refer to the product documentation for your external database for
instructions about backing up the database.
Task
For option definitions, click Help in the interface.
1
Go to Administration | Setup | Database.
2
On the Database window, select This external database and select an external database type from the
drop-down list.
3
On the Database settings window, fill in the fields.
4
Click Test to verify the settings are correct.
5
Click Save to complete setup.
Update the database schema
Use the steps in this procedure to update the database schema when McAfee Web Reporter requires it.
The database schema is the definition of tables and fields used in the database for McAfee Web
Reporter. When McAfee Web Reporter detects that the database schema is out of date (such as after
an upgrade), it sets the database to Offline. Schema is out of date. and provides an Update Schema button.
Depending on the size of your database, updating the database schema
might take some time.
Task
For option definitions, click Help in the interface.
1
Go to Administration | Setup | Database.
2
Click Update Schema.
To partition the database at the same time you perform the schema
update, click Advanced and select Partition Schema, then click Update Schema.
However, partition the database only if you need to. After you begin the
partition, you cannot cancel nor reverse this action. This option is not
available if the database is already partitioned.
The action completes and McAfee Web Reporter sets the database to Connected.
Partition the database
Partition the database to improve the performance of report generation when there is a large amount
of data in the database.
Before you begin
Partition the database only if you need to. After you begin the partition, you cannot cancel
or reverse this action. This option is not available if the database is already partitioned.
28
McAfee® Web Reporter 5.2.0 Product Guide
Database Configuration
Set the database online or offline
4
McAfee Web Reporter supports partitioning for the following databases:
•
Microsoft SQL Server 2005 and SQL Server 2008 Enterprise Edition
•
Oracle 10g and Oracle 11g Enterprise Edition
McAfee Web Reporter processes, such as importing logs and generating
reports, are not available during partitioning.
Task
For option definitions, click Help in the interface.
1
Go to Administration | Setup | Database.
2
Click Advanced.
3
Click Partition Schema.
If the schema needs updating, both Update Schema and Partition
Schema options are available and can be performed at the same time. To
complete both actions at once, select Partition Schema, then click Update
Schema.
The action completes and McAfee Web Reporter sets the database to Connected.
Set the database online or offline
McAfee Web Reporter lets you set the database online or offline.
Task
For option definitions, click Help in the interface.
1
Go to Administration | Setup | Database.
2
Set the database online or offline.
3
Click Save to confirm the change.
4
Click Refresh to update the status message.
Execute SQL use
Use the Execute SQL feature when you are working with technical support.
Execute SQL opens a window that enables a reporting administrator to provide and execute SQL
statements. Use this function for support and troubleshooting when working with technical support.
McAfee® Web Reporter 5.2.0 Product Guide
29
5
Directory Configuration in McAfee Web
Reporter
Use directories to include information for user names and groups imported from log file data and for
McAfee Web Reporter logon accounts.
Contents
Directories overview
Internal directory
External directories
Associate users with groups
Display directories with user names
Display full names with user names
Test group settings in a directory
Directory management
Directories overview
Use the provided internal directory or connect to an external directory that contains existing network
user and group accounts.
Internal directory
McAfee Web Reporter is installed with an internal directory you can use to store user and group names
you create. Use the internal directory when you want a local list of user accounts.
You can create a list of local users and groups in a text file and import it into the McAfee Web Reporter
internal directory when you do not have an external directory or when you want a separate directory
for custom user names and groups.
The internal directory does not support nested groups.
See also
Display directories with user names on page 38
External directory configuration on page 34
Create the internal directory user and group file
The internal directory is populated with a text file that contains the user and group information in a
specific layout. The text file must be UTF-8 encoded.
McAfee® Web Reporter 5.2.0 Product Guide
31
5
Directory Configuration in McAfee Web Reporter
Internal directory
Task
For option definitions, click Help in the interface.
1
Open a new text file.
2
Type the user and group information.
When using the internal directory, the user and group names must not
contain spaces.
The content of the text file should look like this:
group 1
user bcarlisle
user jlock
group 2
user jshepherd
user jfourd
3
Save the file in a location accessible from McAfee Web Reporter.
Populate the internal directory
To use the internal directory for local logon accounts and custom user names and groups, populate the
internal directory with a list of users and groups.
Before you begin
You must have a text file containing the user and group information readily accessible from
the McAfee Web Reporter.
Task
For option definitions, click Help in the interface.
1
Go to Administration | Setup | Directories.
2
On the Directories tab, select internal and click Edit.
3
Browse to the file on the reporting server or a location accessible from McAfee Web Reporter.
4
Click Import.
The user structure appears in the Imported user and group structure pane at the bottom of the
window.
5
32
Click OK to complete populating the internal directory.
McAfee® Web Reporter 5.2.0 Product Guide
Directory Configuration in McAfee Web Reporter
Internal directory
5
Update the internal directory
Manually update the McAfee Web Reporter internal directory when you need to make immediate
changes or to schedule updates if there are changes to the text file on a regular basis.
Tasks
•
Manual internal directory updates on page 33
When you make changes to the text file at unscheduled times, you can immediately update
the internal database with the latest text file.
•
Scheduled internal directory updates on page 33
Schedule regular updates to the internal directory when you know there will be regular and
frequent changes to the text file that populates the internal directory.
Manual internal directory updates
When you make changes to the text file at unscheduled times, you can immediately update the
internal database with the latest text file.
Task
For option definitions, click Help in the interface.
1
Go to Administration | Setup | Directories.
2
Select internal from the list and click Update Now.
McAfee Web Reporter re-imports the text file to update the internal directory.
Scheduled internal directory updates
Schedule regular updates to the internal directory when you know there will be regular and frequent
changes to the text file that populates the internal directory.
Task
For option definitions, click Help in the interface.
1
Go to Administration | Setup | Directories.
2
Select internal and click Edit.
3
On the Edit Internal Directory window, click the Schedule tab.
4
Configure the frequency and start time for the scheduled updates.
5
Click OK to complete setup.
Add or remove users from the internal directory
Make changes to the internal directory at any time. After making changes to the text file, you can
immediately update McAfee Web Reporter to see the changes in the internal directory.
If you remove users from the internal directory and then perform an
update, any historical user data remains in the database and is available
until this information is deleted from the database.
McAfee® Web Reporter 5.2.0 Product Guide
33
5
Directory Configuration in McAfee Web Reporter
External directories
Task
For option definitions, click Help in the interface.
1
Open the text file that contains user information for the internal directory.
2
Add or delete users or groups.
3
Save and close the file.
4
Update the internal directory.
External directories
To use your organization's user directory, connect it with McAfee Web Reporter. Use an external
directory to include your organization's user names and groups in the log file data and for McAfee Web
Reporter logon accounts.
McAfee Web Reporter can use existing user and group names from your directory in report data or
existing user or group accounts as logon accounts for the McAfee Web Reporter user interface.
Supported external directory services include:
•
Lightweight Directory Access Protocol (LDAP)
•
Microsoft Active Directory
•
Novell eDirectory
•
Sun Java System Directory Server
Refer to the product documentation for your external database for
instructions about backing up the database.
External directory configuration
Connect McAfee Web Reporter with your organization's directory (an external directory) to include
user and group information in reports. You can also use your directory user and group accounts to
create logon accounts for McAfee Web Reporter.
Before you begin
Gather the following directory service information:
34
•
Name
•
Type
•
Address
•
Port
•
Logon information
McAfee® Web Reporter 5.2.0 Product Guide
Directory Configuration in McAfee Web Reporter
External directories
5
Task
For option definitions, click Help in the interface.
1
Go to Administration | Setup | Directories.
2
Click Add or Edit.
3
Specify the basic settings for the directory.
McAfee Web Reporter automatically associates user names with directory
resources using Microsoft Windows domain information from the log file.
To take advantage of this feature, the directory resource name must
exactly match the name (case-insensitive) of the Microsoft Windows
domain information in the log file.
4
Complete directory configuration automatically using the Detect option or manually by specifying
additional settings on the Advanced tab.
Tasks
•
Automatic directory configuration on page 35
McAfee Web Reporter can automatically obtain advanced directory settings. To make this
possible, you need to provide basic directory information.
•
Manual directory configuration on page 36
Manually configure a directory when McAfee Web Reporter is unable to connect to the
external directory using the Detect feature.
See also
Display directories with user names on page 38
Internal directory on page 31
Automatic directory configuration
McAfee Web Reporter can automatically obtain advanced directory settings. To make this possible, you
need to provide basic directory information.
Task
For option definitions, click Help in the interface.
1
Go to Administration | Setup | Directories and add or edit a directory.
2
On the Add or Edit Directory window, specify the directory name, the type of directory, and
directory address and port information.
3
Click Detect.
4
Provide a logon name and password if the directory requires authentication.
The directory logon window appears only when McAfee Web Reporter
detects that directory authentication is required.
After McAfee Web Reporter contacts the directory, it determines the directory’s base DN
(distinguished name).
5
On the Configure Directory window, select the path that contains user information. By default, the
base DN is selected.
McAfee® Web Reporter 5.2.0 Product Guide
35
5
Directory Configuration in McAfee Web Reporter
External directories
6
Click Select. McAfee Web Reporter fills in the required directory parameters on the Advanced tab.
7
Click OK to save the directory settings and close the window.
Manual directory configuration
Manually configure a directory when McAfee Web Reporter is unable to connect to the external
directory using the Detect feature.
Before you begin
Before you begin manual configuration, gather the following directory service information:
• Name
• Base Distinguished Name (DN)
• Type
• User Relative Distinguished Name (RDN)
• Address
• User key
• Port
• [Optional] Group key
• Login information
• [Optional] Full name key
Task
For option definitions, click Help in the interface.
1
Go to Administration | Setup | Directories and add or edit a directory.
2
On the Add or Edit Directory window, specify the directory name, the type of directory, and
directory address and port information.
3
Click the Advanced tab and fill in the necessary search parameter fields. The following fields require
input:
•
Base DN
•
User key
4
Click OK to save the directory settings and close the window.
5
If you are making changes to an existing directory definition, click Update Now or schedule an update.
External directory updates
Update an external directory to obtain new or changed user or group information.
If you remove users from a directory and then perform an update, any
historical user data remains available until this information is deleted
from the database.
Tasks
36
•
Update an external directory now on page 37
Update an external directory in McAfee Web Reporter when there are changes to user or
group information that you want to see in McAfee Web Reporter immediately.
•
Schedule external directory updates on page 37
Schedule regular external directory updates to ensure McAfee Web Reporter has the most
current user and group information.
McAfee® Web Reporter 5.2.0 Product Guide
Directory Configuration in McAfee Web Reporter
Associate users with groups
5
Update an external directory now
Update an external directory in McAfee Web Reporter when there are changes to user or group
information that you want to see in McAfee Web Reporter immediately.
Task
For option definitions, click Help in the interface.
1
Go to Administration | Setup | Directories.
2
Select one or more directories from the list and click Update Now.
User and group information is updated in McAfee Web Reporter.
See also
Log data processing setup on page 58
Associate users with groups on page 37
Process incoming log files on page 60
Test group settings in a directory on page 39
Schedule external directory updates
Schedule regular external directory updates to ensure McAfee Web Reporter has the most current user
and group information.
Task
For option definitions, click Help in the interface.
1
Go to Administration | Setup | Directories.
2
Add or edit an external directory.
3
On the Add or Edit Directory window, click the Schedule tab.
Schedule updates during off-peak times. The database (including new
reports) is not available during directory updates.
4
Select the Schedule directory to update checkbox and configure the frequency and start time.
5
Click OK.
The next update will occur at the scheduled time.
Associate users with groups
Groups appear in McAfee Web Reporter only after McAfee Web Reporter starts tracking group
membership. For McAfee Web Reporter to track group membership, it first must obtain a list of groups
from a directory. When this happens, McAfee Web Reporter tracks group membership during log file
processing and directory updates.
McAfee® Web Reporter 5.2.0 Product Guide
37
5
Directory Configuration in McAfee Web Reporter
Display directories with user names
Task
For option definitions, click Help in the interface.
1
Create a directory resource and configure the group attribute.
2
Add the directory to one or more log sources.
3
4
a
Go to Administration | Setup | Log Sources.
b
Add or edit a log source.
c
On the Add or Edit Log Source window, click the Directories tab and add a directory to the log source.
d
Import log data that contains users who belong to the directory you added in previous steps.
Create a group filter and use it in a report to begin tracking group membership.
a
Go to Quick View and click the Custom tab.
b
Expand Report type and filters.
c
Click the arrow beside the All user names drop-down and click Add to open the user/group filter
window
d
Click the Groups tab.
e
Click Search directory.
f
Search the directory for the group you want to track and add it to the filter.
g
Save the filter.
Update the directory.
The McAfee Web Reporter reporting database is populated with a list of groups and users are
associated with the appropriate groups.
See also
Log data processing setup on page 58
Process incoming log files on page 60
Update an external directory now on page 37
Test group settings in a directory on page 39
Display directories with user names
Use this option when you want reports to include the directory name with user names.
Before you begin
You must have the directory set up in McAfee Web Reporter.
38
McAfee® Web Reporter 5.2.0 Product Guide
5
Directory Configuration in McAfee Web Reporter
Display full names with user names
Task
For option definitions, click Help in the interface.
1
Go to Administration | Options | General.
2
Select Display directories with user names to display the directory name with each user and group name.
For example, if the directory is MyLDAP and the user name is sjones, then it appears as MyLDAP
\sjones in reports.
3
Click Save to save any changes.
See also
External directory configuration on page 34
Internal directory on page 31
Display full names with user names
Use this option when you want reports to include full names of users with their shortened user names.
Before you begin
You must have the directory set up in McAfee Web Reporter and configured with a full name
key.
Task
For option definitions, click Help in the interface.
1
Verify the Full name key is specified in the directory setup.
2
Go to Administration | Options | General.
3
Select Display full names with user names to display full names with user names. For example, if the user
name is a0012345 and the full name is Sara Jones, then McAfee Web Reporter displays (a0012345)
Sara Jones.
4
Click Save to save the changes.
Test group settings in a directory
Test group settings to verify that McAfee Web Reporter can communicate with the directory server and
obtain the groups a user belongs to.
Testing group settings does not use directory information to map users
to groups, nor does McAfee Web Reporter save directory information
about group names and group membership. If the error message,
"Unable to find the user [user name]." displays, verify McAfee Web
Reporter has group information.
McAfee® Web Reporter 5.2.0 Product Guide
39
5
Directory Configuration in McAfee Web Reporter
Directory management
Task
For option definitions, click Help in the interface.
1
Go to Administration | Setup | Directories.
2
Select the directory from the queue and click Edit.
3
Click the Advanced tab and verify that a group key is specified for the directory configuration.
The group key specified can be any attribute in the directory. This means
the group key might not be a real group attribute, but might be an
attribute you are using as a substitute for testing purposes.
4
Click the General tab and click Test.
5
In the Logon Name field of the Test Directory Settings window, type a valid user name exactly as it
appears in the directory, then click Retrieve. If the test is successful, the groups associated with the
user name you supplied appears in the Groups field.
6
Click Close to close the Test Directory Settings window.
7
Click OK to close the Edit Directory window.
See also
Associate users with groups on page 37
Process incoming log files on page 60
Update an external directory now on page 37
Directory management
After directories are set up in McAfee Web Reporter, you can perform tasks such as copying a
directory configuration, disabling a directory, and more. Use these tasks to manage directories.
Tasks
40
•
Copy a directory configuration on page 41
Copy an external directory configuration to retain most of the original settings and make
minor changes.
•
Disable an external directory on page 41
Disable an external directory so that McAfee Web Reporter skips this directory when
searching for user and group information to include in reports.
•
View directory assignments on page 41
To see which logon accounts and log sources use information from a selected directory,
view its assignments.
•
View directory status on page 41
The directory status details directory update jobs and the number of users and groups for a
particular directory.
•
Delete a directory on page 42
Deleting a directory does not remove user and group information from historical data in
McAfee Web Reporter.
McAfee® Web Reporter 5.2.0 Product Guide
Directory Configuration in McAfee Web Reporter
Directory management
5
Copy a directory configuration
Copy an external directory configuration to retain most of the original settings and make minor changes.
The internal directory cannot be copied.
Task
For option definitions, click Help in the interface.
1
Go to Administration | Setup | Directories.
2
Select a directory from the queue and click Copy.
3
In the Copy Directory window, make the necessary changes.
4
Click OK.
The copy is created.
Disable an external directory
Disable an external directory so that McAfee Web Reporter skips this directory when searching for user
and group information to include in reports.
The internal directory cannot be disabled.
Task
For option definitions, click Help in the interface.
1
Go to Administration | Setup | Directories.
2
Select a directory from the queue and click Edit.
3
On the General tab, select the Disable this directory checkbox.
4
Click OK.
The directory is disabled and McAfee Web Reporter skips this directory during searches.
View directory assignments
To see which logon accounts and log sources use information from a selected directory, view its
assignments.
Task
For option definitions, click Help in the interface.
1
Go to Administration | Setup | Directories.
2
Select a directory from the queue and click Used By. The View Use window appears and displays
which log sources and logon accounts use the selected directory.
3
Click Close to close the window.
View directory status
The directory status details directory update jobs and the number of users and groups for a particular
directory.
McAfee® Web Reporter 5.2.0 Product Guide
41
5
Directory Configuration in McAfee Web Reporter
Directory management
Task
For option definitions, click Help in the interface.
1
Go to Administration | Setup | Directories.
2
Click the Status tab to see details about directory update requests and the number of expected and
found users and groups.
3
Click Refresh to obtain updated status information.
4
To delete status entries, select an entry and click Delete or click Delete All to delete all entries. Click
Yes to confirm the deletion.
You can delete status information only for directories that have a
Successful or Failed status. When deleting a directory on the Directories
tab, status messages related to that directory are not automatically
deleted.
Delete a directory
Deleting a directory does not remove user and group information from historical data in McAfee Web
Reporter.
After you delete a directory, historical information from that directory remains available until this
information is deleted from the database. Since the directory’s historical data is available, the
directory name is available for use in delegated report permissions, filters, queries, and reports.
However, McAfee Web Reporter logon accounts created using information from this directory are deleted.
To
Follow these steps
Determine which log
sources and logon
accounts use the
directory.
1 Go to Administration | Setup | Directories and select the directory you want to delete.
Delete logon
accounts associated
with the directory.
1 Go to Administration | Setup | Logon Accounts.
2 Click Used By. Make note of the log sources and logon accounts that use this
directory.
2 Select the associated logon accounts and click Delete.
Remove the directory 1 Go to Administration | Setup | Log Sources and select the appropriate log source.
from log sources.
2 Click Edit and click the Directories tab.
3 From the Selected directories list, select the directory and click the < arrow.
4 Click OK.
Delete the directory.
1 Go to Administration | Setup | Directories.
2 Select a directory from the queue and click Delete.
You cannot delete the internal directory.
3 Click Yes to confirm the deletion. The directory is deleted.
See also
Delete logon accounts on page 74
Configure a log source on page 56
42
McAfee® Web Reporter 5.2.0 Product Guide
6
Log Sources and Log Formats
McAfee Web Reporter uses log sources to obtain data from log files from a filtering device. The log files
contain web usage data that is used in reports. Choose a specific log format for each log source to
determine how McAfee Web Reporter processes (also called parsing) the log files. McAfee Web
Reporter processes the log files and stores the data in a database you set up in McAfee Web Reporter.
Contents
Log sources overview
Log formats overview
Use custom log formats
Custom columns, rule sets, and user-defined columns overview
Configure a log source
Move log file data into the database
Delete a log source
Disable a log source
Configure browse time options
Log sources overview
When you set up a log source in McAfee Web Reporter, you are establishing a way for McAfee Web
Reporter to obtain the web use data from the log files. The data is then used in reports. Use one of the
three available log source modes to obtain the data.
A log source in McAfee Web Reporter corresponds to a device on your network, such as a McAfee Web
Gateway appliance, that captures web filtering data and puts the data in log files. The web filtering
data stored in log files shows data about how people in your organization are using their access to the
web. Data can include the URL for each visited website and the user name of the person who visited
that website. McAfee Web Reporter then uses this data in its reports.
Log source modes
Use one of the log source modes to obtain log file data from a log source. The mode you select
depends on the ability of your web filtering device to send log files.
When configuring a log source, select one of the available modes or manually import a single log file;
the mode you select depends on the ability of your web filtering device to send log files:
McAfee® Web Reporter 5.2.0 Product Guide
43
6
Log Sources and Log Formats
Log formats overview
•
Accept incoming log files — For organizations with web filtering devices that write their own log files and
have the ability to send the log files to another location (such as the McAfee Web Reporter server)
•
Collect log files from — For organizations using devices that write their own log files, but are unable to
send the log files to another location
When using the Directory on report server option in this mode, you need
approximately 1 GB of temporary space on the McAfee Web Reporter
server for every gigabyte of log data collected and processed.
•
Accept real-time log data — This option is for organizations using SmartFilter software
•
Import Log — For situations when you want to manually import log files from a local directory on the
McAfee Web Reporter server; use this option, available directly on the Administration | Log Sources
window, to immediately import log files from a new or existing log source
Log formats overview
Log formats determine how McAfee Web Reporter processes (also called parsing) data from log files
and stores it in the database. Accurate reports depend on McAfee Web Reporter using the correct log
format to recognize the type of data and store it correctly in the database.
McAfee Web Reporter is set up to recognize the structure of various custom log formats and standard
log formats.
Custom log formats
For situations when you have a log format that does not fit any of the formats listed in McAfee Web
Reporter, you can create a custom log format for McAfee Web Reporter to use when obtaining data
from that log file.
Creating a custom log format allows you to assign a field that is not recognized by McAfee Web
Reporter to a data column. After creating the custom log format and assigning it to a log source, each
new log file from that log source is processed using the custom format.
Use the following guidelines when considering a custom log format:
•
To configure a custom log format, an original log file must reside on the McAfee Web Reporter server.
•
At a minimum, a custom log format requires the assignment of the following fields: Time, Client
Address, and URL.
•
Any unassigned columns (labeled as Ignore) are skipped during log file processing and that data is
not stored in the database.
Standard log formats
When your web filtering device generates logs that match one of the log formats listed in McAfee Web
Reporter, all you need to do is select the log format from the list and McAfee Web Reporter recognizes
and stores the data correctly in the database.
Standard log formats consist of automatic-discover and fixed-field log formats.
Automatic-discover log formats
McAfee Web Reporter supports some automatic-discover log formats. However, some modifications to
the log file headers are necessary for McAfee Web Reporter to correctly parse the data.
The following tables provide necessary header modifications for the following automatic-discover log
formats:
44
McAfee® Web Reporter 5.2.0 Product Guide
Log Sources and Log Formats
Log formats overview
•
Blue Coat
•
McAfee Web Gateway
•
NetCache
6
This table provides information on Blue Coat log file headers used in McAfee Web Reporter and the
necessary modifications for McAfee Web Reporter to correctly parse the data. Some cells remain
intentionally empty.
Table 6-1 Blue Coat header formats
Format in extended log file Custom Content policy language
Description
c-ip
IP address of the client
%a
cs-categories
All content categories of the
request URL
cs-categories-bluecoat
All content categories of the
request URL that are defined
by Blue Coat Web Filter
cs-categories-external
All content categories of the
request URL that are defined
by an external service
cs-categories-local
All content categories of the
request URL that are defined
by a local database
cs-categories-policy
All content categories of the
request URL that are defined
by CPL
cs-categories-provider
All content categories of the
request URL that are defined
by the current third-party
provider
cs-categories-qualified
All content categories of the
request URL, qualified by the
provider of the category
cs-category
Single content category of
the request URL (such as
sc-filter-category)
cs-host
%v
Host name from the client’s
request URL; if URL rewrite
policies are used, this field’s
value is derived from the log
URL
cs-method
Request method used from
client to appliance
cs-request-line
First line of the client’s
request
c-dns
cs-uri
%h
Host name of the client
(using the client’s IP address
to avoid reverse DNS)
• url
• Original URL requested
• log_url
• The log URL
McAfee® Web Reporter 5.2.0 Product Guide
45
6
Log Sources and Log Formats
Log formats overview
Table 6-1 Blue Coat header formats (continued)
Format in extended log file Custom Content policy language
Description
cs-uri-address
• IP address from the
original URL requested;
DNS is used if the URL is
expressed as a host name
• url.address
• log_url.address
• IP address from the log
URL; DNS is used if URL
uses a host name
cs-uri-categories
All content categories of the
request URL
cs-uri-categories-bluecoat
All content categories of the
request URL that are defined
by Blue Coat Web Filter
cs-uri-categories-external
All content categories of the
request URL that are defined
by an external service
cs-uri-categories-local
All content categories of the
request URL that are defined
by a local database
cs-uri-categories-policy
All content categories of the
request URL that are defined
by CPL
cs-uri-categories-provider
All content categories of the
request URL that are defined
by the current third-party
provider
cs-uri-categories-qualified
All content categories of the
request URL, qualified by the
provider of the category
cs-uri-category
Single content category of
the request URL (such as
sc-filter-category)
cs-uri-host
• url.host
• log_url.host
• Host name from the
original URL requested
• Host name from the log
URL
cs-uri-hostname
• url.hostname
• log_url.hostname
• Host name from the
original URL requested;
RDNS is used if the URL is
expressed as an IP address
• Host name from the log
URL; RDNS is used if the
URL uses an IP address
cs-uri-path
• blank
• url.path
• %U
• blank
• Path of the original URL
requested without query
• Path from the log URL
without query
46
McAfee® Web Reporter 5.2.0 Product Guide
6
Log Sources and Log Formats
Log formats overview
Table 6-1 Blue Coat header formats (continued)
Format in extended log file Custom Content policy language
Description
cs-uri-pathquery
• Path and query of the
original URL requested
• url.pathquery
• log_url.pathquery
• Path and query from the
log URL
cs-uri-port
• url.port
• log_url.port
• Port from the original URL
requested
• Port from the log URL
cs-uri-query
• blank
• url.query
• %Q
• blank
• Query from the original
URL requested
• Query from the log URL
cs-uri-scheme
• url.scheme
• log_url.scheme
• Scheme of the original
URL requested
• Scheme from the log URL
cs-uri-stem
• Stem of the original URL
requested
• Stem from the log URL
The stem includes
everything up to the
end of path, but does
not include the query.
cs-user
%u
Qualified user name for
NTLM; relative user name
for other protocols
cs-userdn
Full user name of a client
authenticated to the proxy
(fully distinguished)
cs-username
Relative user name of a
client authenticated to the
proxy (not fully
distinguished)
date
%x
gmttime
%t
GMT date and time of the
user request in [DD/MM/
YYYY:hh:mm:ss GMT] format
localtime
%L
Local date and time of the
user request in [DD/MMM/
YYYY:hh:mm:ss +nnnn]
format
rs(Content-Type)
%c
sc-bodylength
sc-bytes
date.utc
GMT date in YYYY-MM-DD
format
response.header.Content-Type Response header:
Content-type
Number of bytes in the body
(excludes header ) sent from
appliance to client
%b
Number of bytes sent from
appliance to client
McAfee® Web Reporter 5.2.0 Product Guide
47
6
Log Sources and Log Formats
Log formats overview
Table 6-1 Blue Coat header formats (continued)
Format in extended log file Custom Content policy language
Description
sc-filter-category
%f
Content filtering category of
the request URL
sc-filter-result
%W
Content filtering result:
Denied, Proxied, or Observed
sc-headerlength
Number of bytes in the
header sent from appliance
to client
sc-status
%s
time
%y
timestamp
%g
Protocol status code from
appliance to client
time.utc
GMT time in HH:MM:SS
format
Unix type time stamp
x-cache-user
Relative user name of a
client authenticated to the
proxy (not fully
distinguished; same as
cs-username)
x-client-address
IP address of the client
x-client-ip
IP address of the client
x-cs-dns
client.host
The host name of the client
obtained through reverse
DNS
x-cs-http-method
http.method
HTTP request method used
from client to appliance;
empty for non-HTTP
transactions
x-cs-user-authorization-name
user.authorization_name
User name used to authorize
a client authenticated to the
proxy
x-cs-user-credential-name
user.credential_name
User name entered by the
user to authenticate to the
proxy
x-cs-user-login-address
user.login.address
The IP address that the user
was authenticated in
x-cs-username-or-ip
Used to identify the user
using either their
authenticated proxy user
name or, if that is
unavailable, their IP address
x-sc-http-status
http.response.code
HTTP response code sent
from appliance to client
x-virus-id
icap_virus_id
Identifier of a virus if one
was detected
This table provides information on McAfee Web Gateway log file headers used in McAfee Web Reporter
and the necessary modifications for McAfee Web Reporter to correctly parse the data.
Table 6-2 McAfee Web Gateway header formats
48
Header
Description
"attribute"
URL categories
"auth_user"
Client user name
McAfee® Web Reporter 5.2.0 Product Guide
Log Sources and Log Formats
Log formats overview
Table 6-2
6
McAfee Web Gateway header formats (continued)
Header
Description
"auth_user_anonymous"
Anonymous user name
block_res
Filtering action
bytes_to_client
Number of bytes written to the client
"categories"
URL categories
elapsed_time
Time to process request
"media_type"
Content-type header
"profile"
Skipped
"referer"
Referer
rep_level
Reputation of the URL
"req_line"
Request
src_host
Client host name
src_ip
Client IP address
status_code
HTTP status code
time_stamp
Time of request
unix_epoch
UNIX time stamp
"user_agent"
Client user agent
"virus_name"
Name of virus found in the request
This table provides information on NetCache log file headers used in McAfee Web Reporter and the
necessary modifications for McAfee Web Reporter to correctly parse the data.
Table 6-3 NetCache header formats
Header
Description
bytes
Bytes transferred
c-ip
Client IP address
cs-method
Request method (GET, PUT, POST, and so on)
cs-uri
Request URI
cs-uri-stem
Request URI
cs-username
Client user name
rs(Content-Type)
Content-type header
x-elapsed-milliseconds
Time to process request
x-hiercode
Skipped
x-localtime
Local time of the request
x-remote-id
Skipped
x-smartfilter-categories
URL categories
x-smartfilter-result
Filter action
x-timestamp
Time of request (seconds since epoch)
x-transaction
HTTP status code
x-wwfilter-categories
URL categories
x-wwfilter-result
Filter code
McAfee® Web Reporter 5.2.0 Product Guide
49
6
Log Sources and Log Formats
Log formats overview
Fixed-field log formats
McAfee Web Reporter supports some fixed-field log formats that do not require any header changes.
McAfee Web Reporter correctly parses the data from these log files without any modifications.
The following table provides information about supported log file formats that are not
automatic-discover in McAfee Web Reporter. This table includes examples of the expected header
information found in the corresponding log file format.
Any deviation from the expected field format can result in inaccurate
reports.
Table 6-4 Non-automatic-discover log file formats
50
Log file type
Expected formats
Blue Coat SG NCSA
SmartReporter
Format
client-ip remote-username 10.219.35.123 - - [01/Oct/2001:11:39:55 +0000]
username [dd/mm/
"GET /sample/ HTTP/1.1" 200 247
yyyy:hh:mm:ss +-HzMz]
"method url version"
status bytes
smartfilter-info
Blue Coat SG SmartReporter
Format
"[dd/mm/yyyy:hh:mm:ss
timezone]"
"computer-name" client-ip
url action "cat match list"
username bytes
"[15/05/2001:15:08:34 GMT]" "FunZone-77"
10.1.1.19 http://www.google.com/ OBSERVED
"Search Engines" - 909
Check Point
FireWall-1 SFv4 Text Format
client_ip - user_1
[time_stamp] "url"
http_status sf_action
sf_cats
172.17.68.177 - jlock [28/Jun/2004:11:44:54]
"http://www.msn.com" 403 COACH "Portal Sites"
Cisco CE SFv4 Apache Common
Log Format
client_ip user_2 user_1
172.17.68.177 - jshepherd [28/Jun/2004:11:44:54
[time_stamp]
-0500] "GET http://www.msn.com/ HTTP/1.0" 403 0
"http_request" http_status COACH "Portal Sites"
cache-size sf_action
sf_cats
Cisco CE SFv4 Extended Squid
Format
tv_sec.(tv_usec/1000)
cache_msec client_ip
cache_code/http_code
cache_size method_str url
user hier_code/hier_host
content_type sf_action
sf_cats
1085754420.626 1 172.17.68.177 TCP_DENIED/403
0 GET http://www.msn.com/ bcarlisle ONE/- - DENY
"Portal Sites"
Cisco CE SFv4 Squid Format
tv_sec.(tv_usec/1000)
cache_msec client_ip
cache_code/http_code
cache_size method_str url
user hier_code/hier_host
content_type sf_action
sf_cats
1085754420.626 1 172.17.68.177 TCP_DENIED/403
0 GET http://www.msn.com/ jfourd ONE/- - DENY
"Portal Sites"
McAfee Web
Security Format
tv_sec.(tv_usec/1000)
cache_msec client_ip
cache_code/http_code
cache_size method_str url
user hier_code/hier_host
content_type sf_action
"sf_cats"
1085754420.626 1 172.17.68.177 TCP_DENIED/403
0 GET http://www.msn.com/ sjones ONE/- - DENY
"Portal Sites"
McAfee® Web Reporter 5.2.0 Product Guide
Examples
Log Sources and Log Formats
Log formats overview
6
Table 6-4 Non-automatic-discover log file formats (continued)
Log file type
Expected formats
Examples
SiteAdvisor®
Enterprise
Software Format
DetectedUTC EventTypeID
CategoriesShortName URL
ActionID RatingID
ReasonId AgentGUID User
MachineName
PhishingFacet
DownloadsFacet
SpamFacet PopupsFacet
BadlinkerFacet
2009-01-01T14:31:12 18600 rb http://www.
0d6b214a-aafe-42e9-a150-c237c86cd959.com/
a9cf15e0-c151-408a-a8b2-fb31debd8e7c.html 1 1 9
ef4a3a5b-773b-467f-af1f-f1ddb0f5ba31 sara
machine1 6 3 6 6 1 6 192.168.0.1 text/html
Microsoft ISA c-ip cs-username c-agent
Web Proxy Format date time s-computername
cs-referred r-host r-ip
r-port time-taken cs-bytes
sc-bytes cs-protocol
s-operation cs-uri
s-object-source sc-status
192.168.109.30 anonymous Mozilla/4.0 2004-09-01
14:29:10 ANATO - hp.msn.com 208.172.13.221 80
100 503 1316 http GET http://hp.msn.com/global/c/
lg/msft_118x35.gif Inet 200
Microsoft ISA
SFv4 - Text
Format
client_ip user_2 user_1
172.17.68.177 - jshepherd [28/Jun/2004:11:44:54]
[time_stamp]
"GET http://www.msn.com/ HTTP/1.0" 403 - COACH
"http_request" http_status "Portal Sites"
- sf_action "sf_cats"
NCSA - Common
Log Format
client-ip remote-username 10.219.35.123 - - [01/Oct/2001:11:39:55 +0000]
username [dd/mm/
"GET /sample/ HTTP/1.1" 200 247
yyyy:hh:mm:ss +-HzMz]
"method url version"
status bytes
smartfilter-info
NetApp NetCache
SFv4 - Default
Format
tv_sec.(tv_usec/1000)
time_taken client_ip
cache_code/http_code
bytes method url user
hier_code "content type"
x-note sf_cats
1085754420.626 0.001 172.17.68.177 TCP_DENIED/
403 454 GET http://www.msn.com/ bcarlisle - "text/
html" -
McAfee® Firewall
Enterprise SFv4 Text Format
client_ip - user_1
[time_stamp] "GET url"
http_status sf_action
sf_cats
172.17.68.177 - jlock [28/Jun/2004:11:44:54] "GET
http://www.msn.com" 403 COACH "Portal Sites"
Secure McAfee
Web
Reporter 5.0.0
and higher - Text
Format
[YYYY:MM:DD hh:mm:ss
+/-hh:mm] proxyAddress
zone clientAddress
userName url
action:actionString
categories bytes
httpmethod httpstatus
contentType fileExtension
reputation actionReason
viruses
[2008:03:04 22:47:53 00:00] 172.17.68.177 10.49.112.227 jfourd http://www.msn.com
0:allowed Business,Computing/Internet 5997 GET
200 text/html - NEUTRAL - -
SmartFilter
Software IFP
SFv4 - Text
Format
client_ip - user_1
[time_stamp] "GET url"
http_status sf_action
sf_cats
172.17.68.177 - imanderson [28/Jun/
2004:11:44:54] "GET http://www.msn.com" 403
COACH "Portal Sites"
Secure Web
SmartReporter
4.2 and higher Text Format
[YYYY:MM:DD hh:mm:ss
+/-hh:mm] proxyAddress
zone clientAddress
userName url
action:actionString
categories
[2008:03:04 22:47:53 00:00] 172.17.68.177 10.49.112.227 amanderson http://www.msn.com
0:allowed Business,Computing/Internet
McAfee® Web Reporter 5.2.0 Product Guide
51
6
Log Sources and Log Formats
Use custom log formats
Table 6-4 Non-automatic-discover log file formats (continued)
Log file type
Expected formats
Examples
Squid - Squid
Native Format
tv_sec.(tv_usec/1000)
cache_msec client_ip
cache_code/http_code
cache_size method_str url
user hier_code/hier_host
content_type
1085754420.626 1 172.17.68.177 TCP_DENIED/403
0 GET http://www.msn.com/ jshepherd ONE/- -
Squid SFv4 Httpd-emulated
Format
client_ip user_2 user_1
172.17.68.177 - jlock [28/Jun/2004:11:44:54
[time_stamp]
-0500] "GET http://www.msn.com/ HTTP/1.0" 403 0
"http_request" http_status TCP_DENIED:NONE COACH "Portal Sites"
cache-size
cache_code:hier_code
sf_action "sf_cats"
Squid SFv4 Squid Native
Format
tv_sec.(tv_usec/1000)
cache_msec client_ip
cache_code/http_code
cache_size method_str url
user hier_code/hier_host
content_type sf_action
"sf_cats"
1085754420.626 1 172.17.68.177 TCP_DENIED/403
0 GET http://www.msn.com/ jfourd ONE/- - DENY
"Portal Sites"
Use custom log formats
Create, edit, and view how custom log formats are used.
Tasks
•
Configure custom log formats on page 52
Use custom log formats when you have log files with non-standard headers.
•
Edit or copy custom log formats on page 53
Edit a custom log format when you want to change its name or column header
assignments. Copy a custom log format when you have minimal changes, but want to leave
the original log format intact.
•
Delete custom log formats on page 53
Delete a custom log format when you no longer need it.
•
View custom log format use on page 54
The View Use window displays which log sources are using a particular custom log format.
Configure custom log formats
Use custom log formats when you have log files with non-standard headers.
Task
For option definitions, click Help in the interface.
52
1
Go to Administration | Setup | Log Sources and click the Custom Formats tab.
2
Click Add to start the Log Format wizard.
3
Assign a name and browse to a log file. Click Next.
McAfee® Web Reporter 5.2.0 Product Guide
Log Sources and Log Formats
Use custom log formats
4
6
Click a column to open the Column Selection window and assign a column.
When assigning column headers to columns, you must designate at least
the Time, Client domain or IP address, and URL columns.
5
After assigning necessary columns, click OK.
When you assign a custom column header (Custom1, Custom2, and so on) to
a custom log format, you need to configure a user-defined column so the
log source includes the custom log format column during processing.
6
Click Finish.
The custom log format is configured and appears in the Custom Formats list.
See also
Configure user-defined columns on page 58
Configure a log source on page 56
User-defined columns on page 55
Rule sets on page 55
Edit or copy custom log formats
Edit a custom log format when you want to change its name or column header assignments. Copy a
custom log format when you have minimal changes, but want to leave the original log format intact.
Task
For option definitions, click Help in the interface.
1
Go to Administration | Setup | Log Sources and click the Custom Formats tab.
2
Select a custom log format from the list and click Edit or Copy.
3
Make changes to the name of the custom log format if necessary.
4
Click Next and make column header assignment changes.
5
Click OK.
Changes are saved.
6
Click Finish.
Delete custom log formats
Delete a custom log format when you no longer need it.
Task
For option definitions, click Help in the interface.
1
Go to Administration | Setup | Log Sources and click the Custom Formats tab.
2
Select a custom log format from the queue and click Delete.
3
Click Yes to confirm the deletion.
The custom log format is deleted.
McAfee® Web Reporter 5.2.0 Product Guide
53
6
Log Sources and Log Formats
Custom columns, rule sets, and user-defined columns overview
View custom log format use
The View Use window displays which log sources are using a particular custom log format.
Task
For option definitions, click Help in the interface.
1
Go to Administration | Setup | Log Sources and click the Custom Formats tab.
2
Select a custom log format from the list and click Used By.
The View Use window appears and displays the custom log format assignments.
3
Click Close to close the window.
Custom columns, rule sets, and user-defined columns overview
Custom columns and user-defined columns are similar, yet separate, features for use when processing
log files. When used, custom columns and user-defined columns use rule sets that act as a search and
replace function that will substitute specific log file data with a different string that better identifies the
data.
In this feature, the rule sets do most of the work. You set up rule sets to identify which data you want
to find and what you want to replace it with. For example, you want to find the URL category Auctions/
Classifieds and replace it with the string non-productive. Now that the rule set knows to find Auctions/
Classifieds and to replace it with non-productive, you need to point the rule set at the correct log file
record or header. In this case, you would apply this rule set to a user-defined column in the log source
setup and select the log record URL category.
•
Custom columns are predefined columns with predefined rule sets. These columns and corresponding
rule sets cannot be deleted; however, the rule sets for the columns can be edited.
•
User-defined columns are for you, the user, to configure. These columns and corresponding rules can be
deleted, copied, and used by more than one column at a time.
•
Custom rule sets are instructions that tell McAfee Web Reporter to search for a specific string and
replace it with a different string.
Custom columns
Custom columns substitute the data in the browser and cache columns in your log files with a word or
phrase that better identifies the browser or cache value.
Custom columns are separate from user-defined columns and are pre-defined rules in McAfee Web
Reporter. Instead of your reports containing Mozilla/4.0 (compatible; MSIE 7.0…), the reports contain
Internet Explorer 7.0. However, the original data value is retained in your database.
Each custom column uses a rule set that is already configured to take technical data values from the
browser or cache columns and substitute the value with common identifiers, making the browser and
cache data in your reports more recognizable. To change or add to the custom columns, edit the rule
sets from within the Custom Columns window.
See also
Rule sets on page 55
Configure custom columns on page 57
Configure rule sets on page 57
54
McAfee® Web Reporter 5.2.0 Product Guide
Log Sources and Log Formats
Custom columns, rule sets, and user-defined columns overview
6
User-defined columns
With user-defined columns, you can substitute column data values with a string that is more
recognizable for you and get data from log file fields that might normally be skipped.
The User-defined columns feature is separate from the Custom Columns feature, but is also used
during log file processing to substitute column data or obtain data from columns that are normally
skipped during this process. User-defined columns are also used when repopulating database columns
during database maintenance. You can configure up to four user-defined columns for each log source.
When you assign a custom column header to a custom log format, you
need to configure a user-defined column so the log source includes the
custom log format column during processing. For example, you created a
custom log format and assigned a column to Custom 1. You then add the
custom log format as a log source. When configuring the custom log
format log source, you assign the log source to populate User-Defined 1
with source data from a log file header and you type Custom 1 into the
Log file header field. At this point, when McAfee Web Reporter processes
this log source, any data from the Custom 1 column in the custom log
format is included in the database and will appear in reports.
User-defined columns will do the following:
Include skipped log field data — During log file processing in McAfee Web Reporter, some log file
fields are skipped. For example, log file processing skips the Referer field or the McAfee Web Gateway
Policy name field. When you want your reports to include data from any skipped fields in reports, you
can configure user-defined columns to get the data from the skipped fields. That data is then available
for use in reports.
Assign a custom value to column data — Substitute standard column data with a custom string
value to make it easier to find and review in reports. For example, you want to assign test-lab to all IP
addresses beginning with 115 and assign other to any additional IP addresses. In the report, the
user-defined column displays either test-lab or other in place of the numeric value of IP addresses.
When you create a user-defined column, McAfee Web Reporter treats this as an additional column and
leaves the original column and original data in the log file. Using the previous example of substituting
IP addresses, the original IP address column data remains unchanged and is still available for use in
reports.
See also
Rule sets on page 55
Configure user-defined columns on page 58
Configure custom log formats on page 52
Configure a log source on page 56
Rule sets
Rule sets are customized instructions that tell McAfee Web Reporter to look for a specific string of data
during log file processing and replace it with a different string. This resulting string appears in reports
and is more recognizable to users.
Rule sets make your custom columns and user-defined columns work. Configure rule sets to find any
string that appears in a log file and replace it with a different string defined by you. The string can be
letters, numbers, and symbols.
McAfee® Web Reporter 5.2.0 Product Guide
55
6
Log Sources and Log Formats
Configure a log source
Custom column rule sets
Custom columns are predefined in McAfee Web Reporter for the browser and cache columns. Each
custom column has a corresponding rule set. You can modify the rule sets, but you cannot add or
delete rule sets for the custom columns.
User-defined column rule sets
User-defined columns are customized by you for any available log record or header. You create the
rule sets for these columns, which can be edited, deleted, copied, and used by more than one
user-defined column at a time.
See also
User-defined columns on page 55
Configure user-defined columns on page 58
Configure custom log formats on page 52
Configure a log source on page 56
Custom columns on page 54
Configure custom columns on page 57
Configure rule sets on page 57
Configure a log source
Configure log sources to collect web filtering data for reports.
Task
For option definitions, click Help in the interface.
1
Go to Administration | Setup | Log Sources.
2
To configure a new log source, click Add. To modify an existing log source, select it from the list,
then click Edit.
3
When adding a new log source, provide a name.
4
Select the appropriate mode for your device according to how McAfee Web Reporter will obtain log
files.
5
From the Log Format drop-down list, select the log format that corresponds to your device.
Custom formats appear at the end of the list in bold text.
6
Complete log source configuration using options on the tabs.
Tasks
56
•
Configure custom columns on page 57
Create custom columns for use with any log source.
•
Configure rule sets on page 57
Add, edit, copy, and delete rule sets for use with custom columns and user-defined columns.
•
Configure user-defined columns on page 58
You can use up to four user-defined columns for each log source. The user-defined columns
rules are used when log files are processed for the log source.
McAfee® Web Reporter 5.2.0 Product Guide
Log Sources and Log Formats
Configure a log source
6
See also
Delete a directory on page 42
Delete logon accounts on page 74
Guide to page views on page 59
Configure user-defined columns on page 58
Configure custom log formats on page 52
User-defined columns on page 55
Rule sets on page 55
Configure custom columns
Create custom columns for use with any log source.
Custom columns are predefined columns with a set of corresponding predefined rule sets that you can
edit.
Task
For option definitions, click Help in the interface.
1
Go to Administration | Setup | Log Sources | Custom Columns.
2
Select a custom column.
3
From the Populate this column using drop-down menu, select a rule set for the custom column.
4
To edit a rule set for a custom column, click Edit Rule Set.
5
Click Save.
See also
Configure rule sets on page 57
Custom columns on page 54
Rule sets on page 55
Configure rule sets
Add, edit, copy, and delete rule sets for use with custom columns and user-defined columns.
Rule sets are used in user-defined columns and custom columns for use during log file processing.
Task
For option definitions, click Help in the interface.
1
Go to Administration | Setup | Log Sources | Custom Rule Sets.
To edit custom columns rule sets, go to Administration | Setup | Log Sources |
Custom Columns.
2
Add, edit, or copy a rule set.
3
Configure the rule set using the available options.
See also
Configure custom columns on page 57
Custom columns on page 54
Rule sets on page 55
McAfee® Web Reporter 5.2.0 Product Guide
57
6
Log Sources and Log Formats
Configure a log source
Configure user-defined columns
You can use up to four user-defined columns for each log source. The user-defined columns rules are
used when log files are processed for the log source.
Before you begin
Configure rule sets for the user-defined columns.
Task
For option definitions, click Help in the interface.
1
Go to Administration | Setup | Log Sources.
2
Add, edit, or copy a log source.
3
Click the User-Defined Columns tab.
4
Configure up to four user-defined columns using the available options.
See also
Configure custom log formats on page 52
Configure a log source on page 56
User-defined columns on page 55
Rule sets on page 55
Log data processing setup
When configuring a log source, use the options to determine how McAfee Web Reporter handles the
data it gets from the log files. Processing setup involves deciding if you want to include every detail of
a log record, add details that might be missing, change how data appears, and what to do with the log
file when processing is finished.
When setting up a log source, consider the following processing options:
Table 6-5 Processing options
To...
Use this option...
Include user and group information
Directories
Include a user-defined column
User-defined columns
Include TrustedSource database categories and reputation scores
TrustedSource database
categories and reputation
Consolidate multiple lines of data into a single page view in reports Page views
Keep full log records for detailed reports
Store log records
Use this option when you want to report on URLs with more than
one category.
58
Use client host names for unknown users
Client host names
Convert UTC time to local time
Locale
Stop log parsing when errors occur
Parsing errors
Ignore records that match a regular expression
Regular expression
Permanently delete log files
Delete
Move log files
Move
Transfer log files to a new location using FTP
FTP
McAfee® Web Reporter 5.2.0 Product Guide
Log Sources and Log Formats
Move log file data into the database
6
See also
Associate users with groups on page 37
Process incoming log files on page 60
Update an external directory now on page 37
Guide to page views
The page view setting for a log source affects queries and disk space requirements for the reporting
database. Page views, sometimes referred to as hits, are related to HTTP requests.
Each line of a log file is an HTTP request for an element that makes up a webpage. Viewing one
webpage can result in multiple lines of data in the log file, each line equaling one page view. In McAfee
Web Reporter, the Condense log records into page views option consolidates multiple lines of data from a log
file into a single page view in reports. Condensing log records into page views results in more concise
reports when using either summary or detailed queries. This option also reduces storage requirements
for the reporting database and increases performance during log imports. For example, condensing log
records into page views could potentially reduce a 1 GB log file down to a 100 MB log file.
By default, the Condense log records into page views option is enabled. If you disable this option, each
webpage you visit and each element on the page are logged as separate HTTP requests. For example,
if you visit www.example.com, and that page contains multiple elements, then the log data would look
like this:
www.example.com
www.example.com/rss.xml
www.example.com/advertisement.js
adserver.example.com/ad1.jpg
adserver.example.com/ad2.jpg
adserver.example.com/ad3.jpg
With Condense log records into page views enabled, your log data will show only one HTTP request as a page
view—www.example.com.
See also
Configure a log source on page 56
Move log file data into the database
Use these additional steps to put log file data into your database when your log source is set to accept
incoming log files or collect log files, or when you want to process a normally scheduled log file
immediately.
Any log processing jobs interrupted when Web Reporter is restarted will
automatically resume.
Tasks
•
Process incoming log files on page 60
After setting up a log source to accept incoming log files or collect log files from another
location, you may need to manually process the log files.
•
Import a single log file immediately on page 60
You can import a single log file immediately using the Import Log option for an existing log
source. Import log files from a directory on the reporting server.
McAfee® Web Reporter 5.2.0 Product Guide
59
6
Log Sources and Log Formats
Move log file data into the database
Process incoming log files
After setting up a log source to accept incoming log files or collect log files from another location, you
may need to manually process the log files.
Depending on the mode selected during log source setup, you have one of three ways to perform log
file processing.
Table 6-6 Log file processing
For this mode...
Perform the following...
Accept incoming
log files
Set up your filtering device to transfer logs to McAfee Web Reporter (consult the
documentation for your filtering device).
• HTTP or HTTPS — Use the logon name, password, and HTTP or HTTPS URL
specified on the Source tab of your log source.
• FTP — To transfer log files using FTP, use the logon name, password, and the
FTP port specified on the Source tab of your log source.
Collect log files from On the Schedule tab, configure the frequency, start time, and dates of the time
schedule that McAfee Web Reporter will collect and process log files from the
device.
Accept real-time
log data
Log data is imported into McAfee Web Reporter from SmartFilter software in
actual time; no further action is needed.
See also
Log data processing setup on page 58
Associate users with groups on page 37
Update an external directory now on page 37
Test group settings in a directory on page 39
Import a single log file immediately
You can import a single log file immediately using the Import Log option for an existing log source.
Import log files from a directory on the reporting server.
When using the Import Log option, the log source format must
be the same as the log source to avoid errors.
Task
For option definitions, click Help in the interface.
1
Go to Administration | Setup | Log Sources.
2
Select the log source in the queue that you want to process the log file from.
3
Click Import Log.
A window opens displaying a local directory on the McAfee Web Reporter server.
4
Browse to the log file you want to import.
5
Click Open.
A message confirms that the selected log file is imported.
6
Click OK.
McAfee Web Reporter processes the log file and the processing status appears on the Jobs tab.
60
McAfee® Web Reporter 5.2.0 Product Guide
Log Sources and Log Formats
Delete a log source
6
Delete a log source
Delete a log source when you no longer need to receive log files from it.
Task
For option definitions, click Help in the interface.
1
Go to Administration | Setup | Log Sources.
2
Select the log source from the list.
3
Click Delete.
4
Click Yes to confirm the deletion.
The log source is deleted and no new report data is imported from it anymore. Historical data from the
log source is kept, however, and the name of the log source is still available for use in queries, filters,
reports, and delegated report permissions.
Disable a log source
Disable a log source to temporarily exclude it from obtaining additional data.
Task
For option definitions, click Help in the interface.
1
Go to Administration | Setup | Log Sources.
2
Select the log source from the list.
3
Click Edit.
4
Select the Disable this log source check box.
5
Click OK.
McAfee Web Reporter no longer processes log files from the disabled log source.
Configure browse time options
Choose the browse time threshold and default browse time for user browsing sessions.
Browse time threshold
Specify the length of time for the browse time threshold.
McAfee Web Reporter estimates a user's browse time by calculating the difference between the time
stamps of two log lines.
For example, if the log file shows that Jon Lock visits www.example.com at 03:00:00 P.M. and then
news.example.com at 04:30:00 P.M., the browse time is the 1 hour 30 minutes that occured between
the time he first visited www.example.com and then visited news.example.com. However, Jon Lock
probably did not spend more than one hour viewing a single webpage. To compensate for this, McAfee
Web Reporter overrides the estimated browse time with a default browse time.
McAfee® Web Reporter 5.2.0 Product Guide
61
6
Log Sources and Log Formats
Configure browse time options
The browse time threshold option specifies the maximum length of time you expect a user to spend
viewing a single webpage. The default is 3 minutes. When a user exceeds the browse time threshold,
the default browse time is recorded in the database instead.
Task
For option definitions, click Help in the interface.
1
Go to Administration | Options | General.
2
Configure the browse time threshold.
3
Click Save.
Default browse time
Specify the length of time for the default browse time.
McAfee Web Reporter uses the default browse time when the browse time threshold is exceeded.
For example, the browse time threshold is set for 3 minutes. Suppose Jon Lock visits
www.example.com at 03:00:00 P.M. and then news.example.com at 04:15:00 P.M. Because 1 hour
and 15 minutes exceeds the browse time threshold (3 minutes), the default browse time is recorded in
the database instead.
Task
For option definitions, click Help in the interface.
62
1
Go to Administration | Options | General.
2
Configure the default browse time.
3
Click Save.
McAfee® Web Reporter 5.2.0 Product Guide
7
Categorization using the TrustedSource
database
The TrustedSource database contains category information and reputation scores for URLs. For
example, www.mcafee.com is categorized as a Business and Software/Hardware URL and has a
Minimal Risk reputation score. Use the TrustedSource database to include category information and
reputation scores for URLs in log files that do not contain this information.
By default, the McAfee Web Gateway and SmartFilter software log files
contain category and reputation information.
Contents
TrustedSource database overview
Download the TrustedSource database
Disable TrustedSource database downloads
TrustedSource database overview
The TrustedSource database contains category and reputation scores for URLs.
URL categorization
The TrustedSource database uses categories to organize similar types of URLs into groups based on
the webpage’s content. For example, www.mcafee.com and www.trustedsource.org are grouped in the
Business category and the Software/Hardware category. Categorizing a particular URL is a defined
process using objective standards and definitions. To gather and rate websites, McAfee uses various
technologies, artificial intelligence techniques, and customer logs. After gathered and rated, sites are
reviewed and the corresponding URLs are added to the database.
URL reputation scores
To determine an appropriate reputation score for a given URL, TrustedSource database uses an
automated process that looks at many different security attributes of that URL. The security attributes
include the URL’s content, where the URL is appearing on the Internet, the URL’s domain behavior, and
more. The core focus of TrustedSource database is to determine a score that represents the level of
risk at which you are placing your network, computers, and personal information when you visit a
particular URL. After TrustedSource database determines the reputation score, it is represented in the
database regardless of its categorization status. This means a URL can have a reputation score
without categorization.
For more information, see the TrustedSource Web Database Reference Guide. Download the guide
from www.trustedsource.org.
McAfee® Web Reporter 5.2.0 Product Guide
63
7
Categorization using the TrustedSource database
Download the TrustedSource database
Download the TrustedSource database
Configure TrustedSource database downloads when your log files do not contain category information
or reputation scores. McAfee Web Reporter then matches categories and reputation scores to URLs
and displays that information in reports.
Task
For option definitions, click Help in the interface.
1
Go to Administration | Options | Categorization.
2
Select the Download the TrustedSource Web Database checkbox.
3
Provide a valid serial number.
Use a premium features, McAfee Web Gateway, or SmartFilter software
serial number.
4
Configure the frequency and start time to schedule regular database downloads.
5
Type the address and port settings for the download server, if necessary.
If you make any changes to the address or port fields for the download
server settings, you must click Save to re-enable the Download Now button.
6
Configure proxy settings when the McAfee Web Reporter server does not have a direct connection
to the Internet.
7
Click Save.
Disable TrustedSource database downloads
Disable scheduled TrustedSource database downloads in McAfee Web Reporter when you no longer
need categorization information and reputation scores. TrustedSource database downloads are
disabled by default.
Task
For option definitions, click Help in the interface.
1
Go to Administration | Options | Categorization.
2
Deselect the Download the TrustedSource Web Database checkbox.
3
Click Save.
TrustedSource database downloads are disabled.
64
McAfee® Web Reporter 5.2.0 Product Guide
8
Logon Accounts
Create logon accounts for users who want to create and view reports and for additional administrators.
Each logon account has three main sections to configure—the logon type, role and permissions, and
delegated reports.
Contents
Logon account types
Logon account role and permissions
Delegated reports
Configure logon accounts
Manage logon accounts
Logon account types
The logon account type determines how the account accesses McAfee Web Reporter and whether the
account permissions are inherited or unique.
Before setting up a logon account, decide how you want the McAfee Web Reporter account to
authenticate with McAfee Web Reporter.
Table 8-1 Determining the appropriate logon account type
Use this logon
account type...
When you want to use...
Requirements
Local user
A local logon account unique to McAfee Web
Reporter that has its own set of McAfee Web
Reporter permissions
None
Network user
An existing network account that logs on to
McAfee Web Reporter with its network credentials
and has its own set of McAfee Web Reporter
permissions
A directory defined in
McAfee Web Reporter
Network group
An existing network group with permissions set
for member network user accounts that log on to
McAfee Web Reporter
A directory defined in
McAfee Web Reporter
McAfee® Web Reporter 5.2.0 Product Guide
65
8
Logon Accounts
Logon account types
Local user
This option allows you to create logon accounts used only for McAfee Web Reporter. Users then log on
to the user interface with the user name and password a McAfee Web Reporter administrator provides.
Permissions are determined by the administrator.
Network user
This option allows you to use existing network accounts from a directory set up in McAfee Web
Reporter as logon accounts. After the account is added to McAfee Web Reporter, the user logs on to
the user interface using their network user name and password. Permissions are determined by the
McAfee Web Reporter administrator. Permissions are set up for the account individually or are inherited
from a network group account if you add the account to a Parent Group at a later time.
You do not have to assign network user logons to a group even when
they are members of the network group in your directory. Assign
network user accounts to a group only when you want the account to
inherit permissions from the group.
Network group
This option allows you to create reporting user accounts that belong to an existing network group from
a directory set up in McAfee Web Reporter. Using a network group allows you to assign the same
permissions to each user account at the group level. After you select a group and set permissions, any
user who is a member of that group can log on to McAfee Web Reporter using their network user
name and password.
If you already have individual network user logon accounts for McAfee Web Reporter, you can add
them to a newly setup network group. Verify that the existing network user is a member of the
network group, and then add or edit the network user account and assign it to the network group
logon using the Parent Group option.
Do not assign a group if you want unique permissions set for a network
user logon.
Example of using network user and group
You want to create a McAfee Web Reporter logon account for Jon Lock using his network
account, jlock. The account, jlock, is a member of two network groups—Management and
HR. Both groups, Management and HR, are set up as network group logons. You want the
jlock logon account to inherit permissions from the Management network group logon, not
the HR group. There are two scenarios you can follow to complete account setup for the
jlock account:
•
66
The network group logon account — You first set up the network groups as logons in
McAfee Web Reporter. At this point, Jon Lock can log on to the user interface with his
jlock network account because it is a member of at least one network group that is
defined in McAfee Web Reporter as a logon group. When jlock logs on to the user
interface, his account automatically appears within the first group McAfee Web Reporter
finds his account a member of. Since McAfee Web Reporter searches the groups in
alphabetical order, McAfee Web Reporter assigns jlock to HR. However, you want the
jlock account to appear within Management. As an administrator, you can now edit the
jlock account to manually assign this account to the Management network group logon.
After assigning the jlock account to Management, it now appears within the
Management group in the user interface and inherits account permissions from this group.
McAfee® Web Reporter 5.2.0 Product Guide
Logon Accounts
Logon account role and permissions
•
8
The network user logon account — You first set up the network user account, jlock, as a
logon in McAfee Web Reporter. The jlock network account is a member of the HR and
Management network groups. At this point, jlock is not part of a group in McAfee Web
Reporter and can log on to the user interface using the permissions you defined for the
account. Since you want the jlock account to inherit permissions from the Management
group, you add the Management group as a logon in McAfee Web Reporter and define
permissions for it. Now you can edit the jlock account and assign it to the Management
group. The jlock account now appears within the Management group in McAfee Web
Reporter and inherits account permissions from this group. Later, you add the HR group
as a logon in McAfee Web Reporter. Even though the jlock network account is also a
member of this group, group membership within McAfee Web Reporter does not change
because jlock is already assigned to the Management group.
See also
Logon account role and permissions on page 67
Delegated reports on page 67
Specify the logon account type on page 68
Logon account role and permissions
The account role and permissions specify either an administrator or user account. Also specified is the
data the user account can access. Administrator accounts have unlimited access to all McAfee Web
Reporter tasks and log file data, and user accounts have limited access.
In McAfee Web Reporter, the role for a logon account defines which tasks the account can perform—
either administrative and reporting tasks (administrator), or only reporting tasks (user). When
selecting the user account role, you can specify which tasks the account can perform and can use
permission options to limit the data a user account can access.
Choose one of two roles for the account:
Administrator — Access to all tasks, including system configuration and creating and viewing reports, and
to all report data
User — Access to only reporting tasks, such as viewing reports, scheduling reports, and managing the
report list; however, you can restrict this type of account from access to any of the reporting tasks
listed in the options
Additionally, you can restrict user account access to report data using delegated report settings.
Restricting access to specific report data means limiting this user account's ability to view report data
for specific individuals, groups, IP addresses, or log sources.
See also
Logon account types on page 65
Delegated reports on page 67
Define the role and permissions on page 69
Delegated reports
Delegated reports is a premium feature used as an access control to restrict which report data a user
account can access.
You can specify which report data is available based on user names, groups, IP addresses, or log sources.
McAfee® Web Reporter 5.2.0 Product Guide
67
8
Logon Accounts
Configure logon accounts
Example of delegated reports
For example, you want the supervisor of the Management department, Jake Shepherd, to
have the ability to run reports only for members of the Management group. Therefore,
when setting up Jake Shepherd's account, you use the delegated reports group option with
access to only the Management group.
See also
Logon account types on page 65
Logon account role and permissions on page 67
Select delegated report data on page 69
Configure logon accounts
As a McAfee Web Reporter administrator, you can create logon accounts for additional administrators
or for users who need only to create and view reports.
Logon account configuration is completed using the following options:
•
Logon account type — Select the type of account to match the way a user authenticates with
McAfee Web Reporter.
•
Role and permissions — Specify the role and level of permissions for the logon account .
•
Delegated reports — Identify which report data the logon account can view in report results.
Tasks
•
Specify the logon account type on page 68
The account type determines the user name and password for the logon account for McAfee
Web Reporter.
•
Define the role and permissions on page 69
The role and permission options for a McAfee Web Reporter logon account determine the
tasks the account can access. Roles and permissions can be configured at the internal user,
network user, or network group level.
•
Select delegated report data on page 69
Delegated report options define which log file data a user account can view in reports.
Configure delegated reports for an account that is assigned the user role.
See also
Edit logon accounts on page 72
Configure user interface timeout on page 72
Delete logon accounts on page 74
Specify the logon account type
The account type determines the user name and password for the logon account for McAfee Web
Reporter.
Task
For option definitions, click Help in the interface.
68
1
Go to Administration | Setup | Logon Accounts.
2
Click Add to create a new account or click Edit to modify an existing account.
McAfee® Web Reporter 5.2.0 Product Guide
Logon Accounts
Configure logon accounts
3
On the Logon tab, select the logon method type.
4
Complete the logon information by typing or selecting the appropriate information for the
remaining fields.
8
See also
Logon account types on page 65
Define the role and permissions
The role and permission options for a McAfee Web Reporter logon account determine the tasks the
account can access. Roles and permissions can be configured at the internal user, network user, or
network group level.
The default reporting administrator account is created during installation.
Task
For option definitions, click Help in the interface.
1
Go to Administration | Setup | Logon Accounts.
2
Click Add to create a new account or click Edit to modify an existing account.
3
On the Permissions tab, select the role.
4
•
When selecting User, specify which options you want to enable or disable for this account. At a
minimum, you must select either View quick reports or View advanced reports.
•
When selecting Administrator, you are done setting up this account.
Click OK to close the window.
See also
Logon account role and permissions on page 67
Select delegated report data
Delegated report options define which log file data a user account can view in reports. Configure
delegated reports for an account that is assigned the user role.
Task
For option definitions, click Help in the interface.
1
Go to Administration | Setup | Logon Accounts.
2
Click Add to create a new account or click Edit to modify an existing account.
3
On the Delegated Reports tab, select the amount of data you want the logon report to view.
4
When selecting Selected report data, click Select to complete setting up the delegated reports options.
5
Publish these settings when you want this user to see which settings their account has.
McAfee® Web Reporter 5.2.0 Product Guide
69
8
Logon Accounts
Configure logon accounts
Tasks
•
Select user report data or group report data on page 70
Specify that the user account in McAfee Web Reporter can view only selected user report
data or selected group report data.
•
Select IP address report data on page 70
Specify that the user account can view only selected IP address report data.
•
Select log source report data on page 71
Specify that the user account in McAfee Web Reporter can view selected log source report
data.
See also
Delegated reports on page 67
Select user report data or group report data on page 70
Select IP address report data on page 70
Select log source report data on page 71
Select user report data or group report data
Specify that the user account in McAfee Web Reporter can view only selected user report data or
selected group report data.
Task
For option definitions, click Help in the interface.
1
Go to Administration | Setup | Logon Accounts.
2
Click Add to create a new account or click Edit to modify an existing account.
3
On the Delegated Reports tab, click Select.
4
On the Users/Groups tab of the Select Report Data window, select Only selected users & groups.
5
Find users and groups and determine if you want to include or exclude them in the delegated
report settings.
6
Click Delete to remove access to user or group report data.
7
Click OK to complete setup.
See also
Select IP address report data on page 70
Select log source report data on page 71
Select delegated report data on page 69
Select IP address report data
Specify that the user account can view only selected IP address report data.
Task
For option definitions, click Help in the interface.
70
1
Go to Administration | Setup | Logon Accounts.
2
Click Add to create a new account or click Edit to modify an existing account.
3
In the Delegated Reports tab, click Select.
McAfee® Web Reporter 5.2.0 Product Guide
Logon Accounts
Configure logon accounts
8
4
In the IP address tab, select Only selected IP Addresses.
5
Define which IP address report data you want to allow this logon account to view and add them to
the Selected IP addresses field.
6
Click Delete to remove access to IP address report data.
7
Click OK to complete the setup.
See also
Select user report data or group report data on page 70
Select log source report data on page 71
Select delegated report data on page 69
Select log source report data
Specify that the user account in McAfee Web Reporter can view selected log source report data.
By default, All log sources is selected—this means reporting data for all log sources is available.
Task
For option definitions, click Help in the interface.
1
Go to Administration | Setup | Logon Accounts.
2
Click Add to create a new account or click Edit to modify an existing account.
3
In the Delegated Reports tab, click Select.
4
In the Log Sources tab, select Only selected log sources.
5
Define which log source report data you want to allow this logon account to view and add them to
the Selected log sources field.
6
To remove access to log source report data, select a log source in the Selected log sources field and
click the left arrow.
7
Click OK to complete setup.
See also
Select user report data or group report data on page 70
Select IP address report data on page 70
Select delegated report data on page 69
McAfee® Web Reporter 5.2.0 Product Guide
71
8
Logon Accounts
Manage logon accounts
Manage logon accounts
Edit and delete logon accounts, and set the inactivity timeout for all logon accounts.
Tasks
•
Edit logon accounts on page 72
Edit logon accounts to change permissions or delegated reports settings and delete
accounts no longer needed.
•
Configure user interface timeout on page 72
Specify how long an account will remain logged on to the user interface without activity.
•
Disable logon accounts on page 73
Disable a logon account when the user no longer needs access to McAfee Web Reporter.
•
Delete logon accounts on page 74
Delete a logon account when it is no longer needed.
Edit logon accounts
Edit logon accounts to change permissions or delegated reports settings and delete accounts no longer
needed.
Task
For option definitions, click Help in the interface.
1
Go to Administration | Setup | Logon Accounts.
2
Select a logon account from the list, and click Edit.
3
Make your changes and click OK.
The logon account is updated.
See also
Configure logon accounts on page 68
Configure user interface timeout on page 72
Delete logon accounts on page 74
Configure user interface timeout
Specify how long an account will remain logged on to the user interface without activity.
This setting affects all McAfee Web Reporter accounts.
Task
For option definitions, click Help in the interface.
1
Go to Administration | Options | Inactivity Timeout.
2
Enter an amount of time in the number field and select a time period from the drop-down list.
3
Click Save.
See also
Configure logon accounts on page 68
Edit logon accounts on page 72
Delete logon accounts on page 74
72
McAfee® Web Reporter 5.2.0 Product Guide
8
Logon Accounts
Manage logon accounts
Disable logon accounts
Disable a logon account when the user no longer needs access to McAfee Web Reporter.
Disabling a logon account deactivates it, but preserves its settings so you can re-enable it at a later time.
Consider the following before disabling accounts:
•
Disables access to McAfee Web Reporter — When you disable a logon account, you cannot use
it to log on to McAfee Web Reporter.
•
Disabling a network group also disables all of its members — When you disable a network
group, each individual logon account that is a member of that group is also disabled.
•
Disabling a logon account disables its report schedules — When you disable a logon account,
any report schedules associated with that account stop running. However, another user with access
to those report schedules can access them and run them manually. The following remain enabled
and accessible:
•
•
Shared objects, such as filters and queries
•
Existing report results generated by the disabled account
•
Any jobs running at the time the account is disabled
There must be at least one administrator account enabled at all times
Tasks
•
Disable local, network user, and network group logon accounts on page 73
Follow this procedure to disable a local, network user, or network group logon account.
•
Disable a member of a network group logon account on page 73
Follow this procedure to disable an individual network user logon account that is currently a
member of a network group logon account.
Disable local, network user, and network group logon accounts
Follow this procedure to disable a local, network user, or network group logon account.
Task
For option definitions, click Help in the interface.
1
Go to Administration | Setup | Logon Accounts.
2
Select the account you want to disable and click Edit.
3
Select Disable this logon account.
4
Click OK to confirm the change.
The logon account is disabled.
Disable a member of a network group logon account
Follow this procedure to disable an individual network user logon account that is currently a member
of a network group logon account.
When you want to disable a member of a network group logon account, you need to move them out of
the group and then disable the individual account.
McAfee® Web Reporter 5.2.0 Product Guide
73
8
Logon Accounts
Manage logon accounts
Task
For option definitions, click Help in the interface.
1
Go to Administration | Setup | Logon Accounts.
2
Select the network user logon account that you want to disable and click Edit.
3
Change the Parent group to None.
4
Select Disable this logon account.
5
Click OK to confirm the change.
The logon account is removed from the group and the account is disabled.
Delete logon accounts
Delete a logon account when it is no longer needed.
Before you begin
Before deleting any McAfee Web Reporter account, you must delete all reports, queries, or
filters that the account owns. The reporting administrator account created during
installation cannot be deleted.
Task
For option definitions, click Help in the interface.
1
Delete all reports, queries, or filters that the account owns.
2
Go to Administration | Setup | Logon Accounts.
3
Select a logon account from the list and click Delete.
4
Click Yes to confirm the deletion.
See also
Delete a directory on page 42
Configure a log source on page 56
Configure logon accounts on page 68
Edit logon accounts on page 72
Configure user interface timeout on page 72
74
McAfee® Web Reporter 5.2.0 Product Guide
9
Email Settings
Add email server and address information to McAfee Web Reporter so that you can email reports to
yourself or other users and receive system notifications.
Contents
Email use in McAfee Web Reporter
Configure email settings
Test email settings
Email use in McAfee Web Reporter
Use your organization's email server and email accounts to deliver reports and system notifications to
specified recipients.
•
Report delivery — Provide your organization's SMTP mail server information to email reports to
any email address provided when configuring delivery options for a report.
•
System notification messages — Provide the sender and recipient email addresses for McAfee
Web Reporter to send system notification messages. System notifications include messages about
an expired serial number, the inability to download the TrustedSource database, and so on.
See also
Configure email settings on page 75
Test email settings on page 76
Configure email settings
Add email account information to McAfee Web Reporter so that it delivers reports and system
notifications through email.
Task
For option definitions, click Help in the interface.
1
Go to Administration | Setup | Email.
2
Type the server and email address information in the appropriate fields.
3
Click Save.
See also
Test email settings on page 76
Email use in McAfee Web Reporter on page 75
McAfee® Web Reporter 5.2.0 Product Guide
75
9
Email Settings
Test email settings
Test email settings
Verify that email settings are configured correctly.
Task
For option definitions, click Help in the interface.
1
Go to Administration | Setup | Email.
2
Click Test.
3
•
If incorrect information is typed, an error message appears.
•
If the test is successful, a successful message appears and a test email messages are sent to
any email address specified in the Recipient address field on the Email window.
Click OK to close the Test Mail Settings window.
See also
Configure email settings on page 75
Email use in McAfee Web Reporter on page 75
76
McAfee® Web Reporter 5.2.0 Product Guide
10
Mapped Columns
Mapped columns in McAfee Web Reporter provide a way to assign a custom value to a specific data
type (column).
Contents
Mapped columns overview
Configure general mapped column settings
Add or edit mapped values manually
Mapped columns overview
Assign a custom numeric or string value to one or more data types (columns) with mapped columns.
Use mapped columns for summary or detail query types.
For example, if you map the File Type column to image when the value is .jpg or .gif, the report will
display image in the File Type column any time it detects a .jpg or .gif file type.
After mapped columns are created, they are available as a query column for any McAfee Web Reporter
account.
Mapped column example
This is an example of using mapped columns for a report.
First mapped column
1
Go to Administration | Options | Mapped Columns.
2
Add a new mapped column.
3
On the General tab:
4
•
Name the mapped column Example One and select Web – Summary.
•
From the Base column list, select Action.
•
Select = as the Operator and String as the Result Type.
•
Skip the Maximum result length.
•
Select the empty field next to Fallback and enter Unknown as the value.
On the Mapped Values tab, click Add.
McAfee® Web Reporter 5.2.0 Product Guide
77
10
Mapped Columns
Mapped columns overview
5
On the Add Mapped Column Value window, enter the numeric value for When ‘Action’ is and enter a
string in the map it to field. Click OK. Repeat for each Action value.
Refer to the following table for a list of mapped Action values. Remaining values mapping to the
Fallback value.
Table 10-1 Action values
6
Value
Description
0
Refer
1
Continue
2
Stop
3
Accepted
4
Delegated
Click OK on the Add Mapped Column window to complete the first mapped column.
Second mapped column
1
Add a new mapped column.
2
On the General tab:
3
•
Name the mapped column Example Two and select Web – Summary.
•
From the Base column list, select Action.
•
Select = as the Operator and String as the Result Type.
•
Skip the Maximum result length.
•
Select the empty field next to Fallback and enter Call Administrator as the value.
•
On the Mapped Values tab, click Add.
On the Add Mapped Column Value window, enter the numeric value for When ‘Action’ is and enter a
string in the map it to field. Click OK. Repeat for each Action value.
Refer to the following table for a list of mapped Action values. Remaining values mapping to the
Fallback value.
Table 10-2 Action values
4
Value
Description
0
Unsuccessful
1
Successful
2
Successful
3
Successful
4
Successful
Click OK on the Add Mapped Column window to complete the second mapped column.
Using the first and second mapped columns in a report
78
1
Go to Reports | Advanced | Queries.
2
Add a new query, and from the Available columns Web – Summary list, select Example One and Example Two
and use the > arrow button to move them to the Selected columns field.
McAfee® Web Reporter 5.2.0 Product Guide
Mapped Columns
Configure general mapped column settings
3
Configure any additional settings.
4
Go to Advanced Reports and add a new advanced report.
5
Name the report and select the newly created query that uses the mapped columns.
6
Configure any additional settings.
7
Run the report.
10
Configure general mapped column settings
With the general mapped column settings, define a name, select the query columns, and use the
remaining options to determine the general settings of the mapped column.
Before you begin
This option is available for administrator accounts only.
Task
For option definitions, click Help in the interface.
1
Go to Administration | Mapped Columns and click Add or Edit.
2
Specify a name and configure the general settings using the available options on the General tab.
If you select < or <= as the operator, then a reporting administrator can
use several mapping rules. Examples: If the value of column 1 is < 400,
then map it to the value Z, and if the value of column 1 is < 500, then
map it to the value V. In this case, Z is the mapped-to value up to 399,
V is the mapped-to value 400 to 499, and all values greater than 499
will rely on the Fallback value.
Add or edit mapped values manually
Configure mapped column values.
Task
For option definitions, click Help in the interface.
1
Go to Administration | Options | Mapped Columns.
2
Click Add to create a new mapped column or click Edit to modify an existing mapped column.
3
On the Mapped Values tab, click Add or Edit.
4
Configure the mapped value.
5
Click OK.
McAfee® Web Reporter 5.2.0 Product Guide
79
10
Mapped Columns
Add or edit mapped values manually
Tasks
•
Import mapped column values on page 80
Import mapped column values when you have existing values from a previous McAfee Web
Reporter installation.
•
Export mapped column values on page 80
Export mapped column values when you want to save existing values from a mapped
column configuration.
Import mapped column values
Import mapped column values when you have existing values from a previous McAfee Web Reporter
installation.
Task
For option definitions, click Help in the interface.
1
Go to Administration | Options | Mapped Columns.
2
On the Mapped Values tab, click Import.
3
Select the method for importing the values.
4
Select how you want to use the mapped values.
5
Click OK.
6
Click OK to complete importing.
Export mapped column values
Export mapped column values when you want to save existing values from a mapped column
configuration.
Task
For option definitions, click Help in the interface.
80
1
Go to Administration | Options | Mapped Columns.
2
Add or edit a mapped column.
3
On the Mapped Values tab, click Export.
4
On the Export Mapped Values window, click Browse and navigate to a directory on the report server
where you want to save the file.
5
Select the file and click OK. The Export Mapped Column window re-opens.
6
In the File name field, enter a name for the export mapped values file.
7
Click OK.
McAfee® Web Reporter 5.2.0 Product Guide
11
Database and System Performance
Performance options for the McAfee Web Reporter database and system allow you to optimize
performance so that McAfee Web Reporter runs efficiently.
Performance optimization involves configuring specific settings, such as system cache, memory
allocation, and so on, to increase performance in McAfee Web Reporter. Configure settings that work
best for your McAfee Web Reporter environment.
Contents
Configure Quick View cache settings
Configure memory allocation
View performance statistics for the database
Configure advanced performance options
Configure Quick View cache settings
Configure the number of reports and the length of time McAfee Web Reporter caches Quick View
summary and custom reports. Configuring these settings helps your McAfee Web Reporter system use
memory resources efficiently.
Task
For option definitions, click Help in the interface.
1
Go to Administration | Options | Performance.
2
On the Quick View Cache pane, select how McAfee Web Reporter manages memory cache settings.
3
Click Save.
Configure memory allocation
Dedicate an amount of memory that will be available each time you load the database.
Task
For option definitions, click Help in the interface.
1
Go to Administration | Options | Performance.
2
Configure the amount of memory you want reserved for McAfee Web Reporter to use when loading
the database.
3
Click Save.
McAfee® Web Reporter 5.2.0 Product Guide
81
11
Database and System Performance
View performance statistics for the database
View performance statistics for the database
View database performance statistics and use them as a guide when modifying settings that control
database performance.
Task
For option definitions, click Help in the interface.
1
Go to Administration | Options | Performance.
2
Click Database Statistics to view database performance statistics. Use the options on this window to
refresh and reset the statistics.
Configure advanced performance options
Advanced performance settings control the number of report and log processing jobs that run
simultaneously, the parameters for processing, and additional cache settings.
Task
For option definitions, click Help in the interface.
82
1
Go to Administration | Options | Performance.
2
Click Advanced Options.
3
Configure performance settings as appropriate.
4
Click OK to save any changes and exit the window.
McAfee® Web Reporter 5.2.0 Product Guide
12
Database Maintenance
Database maintenance options allow you to perform tasks that increase database performance, free
database space, and ensure database records are reconciled with connected directories and recent log
data.
Contents
Database maintenance overview
Database records maintenance
Rebuild indexes
Get database statistics
View the status of database maintenance jobs
Database maintenance overview
Use database maintenance options to roll up or delete database records, synchronize users with a
directory, repopulate user-defined columns, rebuild database indexes, and view the status of
maintenance jobs.
You can schedule database maintenance to run at a regular frequency and start time, or perform the
tasks manually for immediate results.
McAfee recommends that you perform database maintenance during
off-peak times. During maintenance, the database and new reports are
not available. Make sure you read the instructions for each maintenance
task before starting the maintenance job in McAfee Web Reporter.
Perform manual database maintenance
To perform manual maintenance, go to Administration | Tools | Database Maintenance and click the Manual
Maintenance tab. Follow instructions related to any of the maintenance tasks to complete manual
maintenance.
Configure the database maintenance schedule
Set the frequency and start time for any database maintenance jobs that complete according to a
schedule.
Any options you configure on the Scheduled Maintenance window for database maintenance will run
according to the schedule you configure, except for additional scheduling options for index rebuilding.
McAfee® Web Reporter 5.2.0 Product Guide
83
12
Database Maintenance
Database records maintenance
Task
For option definitions, click Help in the interface.
1
Go to Administration | Tools | Database Maintenance.
2
Click the Scheduled Maintenance tab.
3
Click Set Schedule and configure the frequency and start time.
4
Click OK.
Database records maintenance
McAfee Web Reporter can delete or condense database records on a regular schedule or manually
perform the tasks whenever you want.
Over time, records are added to the database and more space is used. To increase the amount of free
space in the database, you can delete or condense older records you no longer need.
Database records rollup
When McAfee Web Reporter imports log data into the database, the summary data is stored in hourly
increments, per user, per website name, per client IP address, per log source. Keeping summary data
in hourly increments might cause the database to increase in size over time. To control the size of the
database, you can "roll up" database records into daily or monthly increments.
Database rollups control the size of the database by converting hourly data into daily or monthly data.
Performing regular database rollups reduces unnecessary data and improves McAfee Web Reporter
performance. Rollups ensure that the report database remains as compact as possible.
Roll hours into days
When hours are rolled up into days, all records are condensed into one single record time-stamped
midnight for that day, and hits and bytes are totaled.
Table 12-1 Representation of rolling hourly data into daily data
Hourly data...
84
Rolled into daily data...
Time and date
Hits
Bytes
Time
Hits
Bytes
8:00:00 AM 3/15/2010
120
2000
12:00:00 AM 3/15/2010
11140
47500
9:00:00 AM 3/15/2010
500
3500
10:00:00 AM 3/15/2010
700
4000
11:00:00 AM 3/15/2010
1500
6000
12:00:00 PM 3/15/2010
2000
7500
1:00:00 PM 3/15/2010
3500
9000
2:00:00 PM 3/15/2010
1500
6000
3:00:00 PM 3/15/2010
700
4000
4:00:00 PM 3/15/2010
500
3500
5:00:00 PM 3/15/2010
120
2000
McAfee® Web Reporter 5.2.0 Product Guide
12
Database Maintenance
Database records maintenance
Roll days into months
When days are rolled up into months, each record is condensed into one record time-stamped
midnight of the first day of that month, with hits and bytes totaled.
Table 12-2 Representation of rolling daily data into monthly data
Daily data...
Rolled into monthly data...
Time and date
Hits
Bytes
Time
Hits
Bytes
12:00:00 AM 3/15/2010
11140
47500
12:00:00 AM 3/01/2010
84645
336500
12:00:00 AM 3/16/2010
14370
57000
12:00:00 AM 3/17/2010
13212
55000
12:00:00 AM 3/18/2010
12555
52000
12:00:00 AM 3/19/2010
18572
65000
12:00:00 AM 3/20/2010
1800
7000
12:00:00 AM 3/21/2010
875
5000
12:00:00 AM 3/22/2010
12121
48000
Example of rolling up and deleting records
You want to roll all daily records older than six months into monthly records. You also want
to delete any records older than one year.
You configure scheduled database maintenance to roll daily records to months for all
records older than 6 months and to delete all records that are older than 12 months.
McAfee Web Reporter has been following your scheduled database configuration for two
years. It is now October 15, 2010, and you need to look at data from October 18, 2009.
When you look for records dated October 18, 2009, you cannot find them. The reason
records for October 18, 2009, are missing is because all daily records older than six months
were rolled up into monthly records. Since October 18, 2009, was more than six months
ago, it is now part of a monthly record. Second, when that daily record was rolled into a
monthly record, the date and time were changed from October 18, 2009, to October 1,
2009, and time stamped 12:00:00 AM. Since you are deleting records older than 12
months and October 1, 2009, is more than 12 months ago, October data of 2009, is
deleted. You are now no longer able to access this data. For this reason, we recommend
you carefully consider the rollup and delete schedule for the database records. For
example, if it is possible that you will want to review database records from any time in the
past 12 months, then maybe you want to schedule McAfee Web Reporter to delete records
older than 13 or 14 months.
Delete or roll up database records
Increase database space by deleting or rolling up database records.
•
If you disable database rollups, the database will increase in size at the rate of log file processing.
•
If reports are taking a long time to generate, schedule McAfee Web Reporter to delete database
records more frequently.
McAfee® Web Reporter 5.2.0 Product Guide
85
12
Database Maintenance
Database records maintenance
Tasks
•
Manually roll up or delete database records on page 86
Perform manual maintenance when you want to rollup or delete database records
immediately.
•
Schedule to roll up or delete database records on page 86
Scheduled jobs to perform database records maintenance at the time and frequency you
want.
Manually roll up or delete database records
Perform manual maintenance when you want to rollup or delete database records immediately.
Perform maintenance during off-peak times. During maintenance, the
database and new reports are not available.
Task
For option definitions, click Help in the interface.
1
Go to Administration | Tools | Database Maintenance.
2
Click the Manual Maintenance tab.
3
Configure maintenance by date range options, then click Start.
4
Click Yes when the confirmation message appears stating the database is not available during
maintenance and asking if you want to continue.
The rollup or delete process starts immediately.
5
Click OK to close the message that appears stating that the maintenance job is successfully queued.
6
Click the Status tab to see progress for the maintenance jobs.
Schedule to roll up or delete database records
Scheduled jobs to perform database records maintenance at the time and frequency you want.
Schedule maintenance during off-peak times. During maintenance, the
database and new reports are not available.
Task
For option definitions, click Help in the interface.
86
1
Go to Administration | Tools | Database Maintenance.
2
Click the Scheduled Maintenance tab.
3
Configure the options for rolling up and deleting database records.
4
Click Save.
5
Click the Status tab to see progress for scheduled maintenance jobs that have completed or are
running.
McAfee® Web Reporter 5.2.0 Product Guide
Database Maintenance
Database records maintenance
12
Delete records by log source
Delete database records based on the log source that generated them.
Perform maintenance during off-peak times. During maintenance, the
database and new reports are not available.
Task
For option definitions, click Help in the interface.
1
Go to Administration | Tools | Database Maintenance.
2
Click the Manual Maintenance tab.
3
From the Delete all database records for this log source drop-down list, select the log source.
4
Click Start.
5
Click Yes to continue. The database maintenance process starts immediately.
6
Click OK to close the message that appears stating that the job is successfully queued.
7
Click the Status tab to see progress for the database maintenance job.
Database records updates
Update database records by synchronizing users or repopulating columns.
•
Synchronize users — Synchronizing users assigns directories to user names. For example, when you
configure a log source without specifying a directory and then import a log file from that log
source, user names appear without a directory (such as -\jlock). Later, you add a directory to the
log source and then want to update your database records to assign the directory to user names.
You can accomplish this by synchronizing users with directories. User names will then appear with
the directory (such as directory1\jlock).
•
Repopulate columns — Repopulating columns applies user-defined column settings to existing database
records. For example, after processing log files, you decide to create a user-defined column to
substitute specific IP addresses with the custom string value test-lab. After creating the
user-defined column, any new log files processed will have that column applied to the data.
However, you have existing database records you want this column applied to. You can accomplish
this by repopulating columns. The specified IP addresses in existing database records now appear
with the custom string value.
Synchronize users
Synchronize users if you imported data from a log source before associating a directory.
Synchronizing users might take a significant amount of time depending
on your hardware, number of users, and amount of existing database
records. Perform maintenance during off-peak times. During
maintenance, the database and new reports are not available.
McAfee® Web Reporter 5.2.0 Product Guide
87
12
Database Maintenance
Rebuild indexes
Task
For option definitions, click Help in the interface.
1
Go to Administration | Tools | Database Maintenance.
2
On the Manual Maintenance tab, click Synchronize Users.
A confirmation message appears stating that the database is not available during maintenance and
asking if you want to continue.
3
Click Yes to continue.
The synchronization process starts immediately and a message appears stating that the job is
successfully queued.
4
Click OK to close the message.
5
Click the Status tab to see progress for the synchronization job.
Repopulate columns
Repopulate columns to apply settings to existing database records.
Perform maintenance during off-peak times. During maintenance, the
database and new reports are not available.
Task
For option definitions, click Help in the interface.
1
Go to Administration | Tools | Database Maintenance.
2
Click Repopulate Columns.
3
Configure the options appropriate for your use of user-defined columns in McAfee Web Reporter.
Rebuild indexes
Perform index rebuilding to prevent or correct performance issues.
Over time, there are many changes made to database indexes that result in degraded performance.
Degraded performance occurs when the index becomes fragmented. In McAfee Web Reporter,
fragmentation occurs each time you import data, roll up records, and delete data. Degraded
performance affects importing logs, database maintenance jobs, and generating reports. On the
database server, degraded performance can result in a high CPU load and high paging rate.
Use the steps in the index rebuilding procedures to resolve performance issues related to database
index fragmentation.
Manual index rebuilding
Perform manual index rebuilding when you want to rebuild the indexes immediately.
Perform maintenance during off-peak times. During maintenance, the
database and new reports are not available.
88
McAfee® Web Reporter 5.2.0 Product Guide
Database Maintenance
Get database statistics
12
Task
For option definitions, click Help in the interface.
1
Go to Administration | Tools | Database Maintenance.
2
Click the Manual Maintenance tab.
3
In the Index maintenance pane, click Rebuild Indexes.
4
Click the Status tab to see progress for the job.
Schedule index rebuilding
Schedule index rebuilding to run at regular intervals during database maintenance jobs.
Before you begin
Ensure that you schedule index rebuilding on a day that you normally schedule your
database maintenance. If you scheduled index rebuilding for Monday, but you do not have
regularly scheduled database maintenance on Mondays, then the index rebuilding job will
not run.
When you schedule index rebuilding, it runs according to the frequency you select (weekly or
monthly), on the day of the week you select, and will run at the same time of day that you scheduled
database maintenance.
For example, your regularly scheduled database maintenance is daily on Saturday, Sunday, and
Wednesday at 12:01 a.m. You configure index rebuilding every week on Sunday. Index rebuilding will
run as part of the regularly scheduled maintenance on Sundays at 12:01 a.m.
Schedule maintenance during off-peak times. During maintenance, the
database and new reports are not available.
Task
For option definitions, click Help in the interface.
1
Go to Administration | Tools | Database Maintenance.
2
Click the Scheduled Maintenance tab.
3
In the Index maintenance pane, select the Rebuild indexes every checkbox and configure how often you
want this task to run.
4
Click Save.
Index rebuilding occurs during regularly scheduled database maintenance for the frequency you
selected.
Get database statistics
View database statistics for information about the number and type of database records, database
record maintenance, and user records in the database that are not linked to a directory.
McAfee® Web Reporter 5.2.0 Product Guide
89
12
Database Maintenance
View the status of database maintenance jobs
Task
For option definitions, click Help in the interface.
1
Go to Administration | Tools | Database Maintenance.
2
Click the Manual Maintenance tab.
3
Click Run Statistics.
A confirmation message appears stating that the database is not available during maintenance and
asking if you want to continue.
4
Click Yes to continue.
The statistics job starts immediately. A message appears stating that the job is successfully queued.
5
Click OK to close the message.
6
Click the Status tab to see progress and statistics for the statistics job.
View the status of database maintenance jobs
View detailed information about each database maintenance job, including rollups, deletions,
synchronizations, and statistics.
Task
For option definitions, click Help in the interface.
90
1
Go to Administration | Tools | Database Maintenance.
2
Click the Status tab.
3
On the Status window, select a job from the queue to view details.
Details for the status are provided in the Details pane.
4
Click Refresh to obtain updated status information.
5
To delete status entries, select an entry and click Delete or click Delete All. Entries are deleted.
McAfee® Web Reporter 5.2.0 Product Guide
13
System Maintenance
System maintenance tasks allow you to increase performance by deleting report results, real-time
traffic logs, and status messages.
Contents
System maintenance overview
Perform system maintenance
View the status of system maintenance jobs
System maintenance overview
System maintenance options allow you to reduce the use of storage space in the McAfee Web Reporter
system using manual tasks or scheduled tasks.
Perform system maintenance
Delete status messages, report results, or real-time traffic logs.
Tasks
•
Manual system maintenance on page 91
Preform manual maintenance on the system when you want to delete status messages,
report results, or real-time traffic logs immediately.
•
Schedule maintenance on page 92
Schedule jobs to perform system maintenance at the time and frequency you want.
Manual system maintenance
Preform manual maintenance on the system when you want to delete status messages, report results,
or real-time traffic logs immediately.
Task
1
Go to Administration | Tools | System Maintenance.
2
Click the Manual Maintenance tab.
3
Configure the system maintenance options, then click Delete Now for the options you configured.
The delete process starts immediately.
4
Click OK to close the message that appears stating that the maintenance job is successfully queued.
5
Click the Status tab to see progress for the maintenance job.
McAfee® Web Reporter 5.2.0 Product Guide
91
13
System Maintenance
View the status of system maintenance jobs
Schedule maintenance
Schedule jobs to perform system maintenance at the time and frequency you want.
Task
For option definitions, click Help in the interface.
1
Go to Administration | Tools | System Maintenance.
2
Click the Scheduled Maintenance tab.
3
Configure the maintenance options and set the schedule the maintenance jobs, then click Save
4
Click the Status tab to see progress for the maintenance job.
View the status of system maintenance jobs
View maintenance jobs status.
Task
For option definitions, click Help in the interface.
1
Go to Administration | Tools | System Maintenance.
2
Click the Status tab.
Status information is shown for each job in the list and details appear in the Details pane.
92
3
Click Refresh to obtain updated status information.
4
To delete status entries, select an entry, and click Delete or Delete All.
McAfee® Web Reporter 5.2.0 Product Guide
14
Configuration Backup and Restore
McAfee Web Reporter includes a feature to back up and restore the system configuration settings. The
backup feature acts as a restore point in situations where the McAfee Web Reporter environment
needs to be restored to a previous state, or when you want to back up the McAfee Web Reporter
environment before upgrading the software.
Contents
Configuration settings backup
Back up the current configuration
Restore McAfee Web Reporter settings
Configuration settings backup
The backup feature in McAfee Web Reporter backs up specific report and administration configuration
settings.
When McAfee Web Reporter creates a backup file, it automatically saves specific settings for reports
and administration.
Configuration settings include:
Table 14-1 Backed-up report configuration settings
Setting
Description
Advanced report definitions
Saves each advanced report definition so you can re-create the
report result
Filter configurations
Saves each filter configuration and restores its use
Favorite report configurations in
Quick View
Saves each custom report configuration saved as a favorite in
Quick View
Query configurations
Saves each query configuration and restores its use
Scheduled report settings
Saves each report scheduled to run on a regular basis
Table 14-2 Backed-up administration configuration settings
Settings
Description
Database connection settings
Saves the configuration settings that allows McAfee Web Reporter to
communicate with the database
Database maintenance settings Saves scheduled database maintenance job settings and status
messages
Directory resource settings
Saves each directory resource McAfee Web Reporter is connected to
Email settings
Saves email delivery settings
McAfee® Web Reporter 5.2.0 Product Guide
93
14
Configuration Backup and Restore
Back up the current configuration
Table 14-2 Backed-up administration configuration settings (continued)
Settings
Description
General settings
Saves general settings, such as display directories and full names
with user names, and inactivity timeout
License keys
Saves the activated license key
Logon accounts
Saves each logon account created with permissions and delegated
report settings
Mapped column configurations
Saves each mapped column configuration
Performance settings
Saves database and system performance settings
System maintenance settings
Saves scheduled system maintenance settings and status messages
System logs
Saves each system log generated
See also
Back up the current configuration on page 16
Restore McAfee Web Reporter settings on page 95
Back up the current configuration
Back up system settings so you can restore configuration settings after upgrading the software, to
ease recovery from a catastrophic failure, or to move settings from one McAfee Web Reporter
installation to another.
If you plan to use a backup file after uninstalling and reinstalling McAfee
Web Reporter, save the backup file to a location other than the McAfee
Web Reporter application folder.
Task
For option definitions, click Help in the interface.
1
Go to Administration | Tools | System Backup.
2
Perform one of the following actions:
•
Click Start. A backup folder and corresponding XML file are created. A backup.xml file is saved in
C:\Program Files\McAfee\Web Reporter\reporter\conf\ (for UNIX: /opt/McAfee/
WebReporter/reporter/conf), where 123456789 is the time stamp.
•
Click Browse, navigate to a directory where you want to store the backup file, click Select, then
click Start.
A message appears stating that the client will not be able to communicate with the server until the
system backup is done.
3
Click OK to continue.
The backup process can take several minutes.
94
4
Close McAfee Web Reporter after the backup is complete.
5
Stop the McAfee Web Reporter services.
McAfee® Web Reporter 5.2.0 Product Guide
Configuration Backup and Restore
Restore McAfee Web Reporter settings
6
7
14
Go to the C:\Program Files\McAfee\Web Reporter\reporter\ (for UNIX: /opt/McAfee/
WebReporter/reporter) directory and back up the following files and directories to a location of
your choosing:
•
.../conf/
•
.../mysql/var/reporting/
•
.../log/realtime.log (if you use real-time logging)
•
.../docs/
Upgrade McAfee Web Reporter.
If there are issues after the upgrade, you can reinstall the previous version you were running and
restore your backup files.
See also
Restore McAfee Web Reporter settings on page 95
Configuration settings backup on page 93
Restore McAfee Web Reporter settings
Restore the configuration settings when you need to return to previous settings or after you uninstall
and reinstall the software.
Before you begin
Back up the configuration before completing these steps.
Task
1
Log out of McAfee Web Reporter.
2
If you need to reinstall the previous version of McAfee Web Reporter that you were running:
a
Uninstall McAfee Web Reporter.
b
Reinstall the previous version of McAfee Web Reporter.
3
Stop the Web Reporter Server service.
4
Create a folder named backup (must be lowercase) in the conf directory. If a backup folder already
exists, do not create a new one.
The backup folder and backup.xml file must have read and write
permissions for the same account running the McAfee Web Reporter
service.
5
•
Windows — C:\Program Files\McAfee\Web Reporter\reporter\conf\
•
UNIX — /opt/McAfee/WebReporter/reporter/conf
Copy the backup.xml file created during the backup to the backup folder in the conf directory.
McAfee® Web Reporter 5.2.0 Product Guide
95
14
Configuration Backup and Restore
Restore McAfee Web Reporter settings
6
If you reinstalled McAfee Web Reporter, also copy the files and directories you backed up to the
corresponding locations in the C:\Program Files\McAfee\Web Reporter\reporter\ (for UNIX — /
opt/McAfee/WebReporter/reporter) directory:
•
.../conf/
•
.../mysql/var/reporting/
•
.../log/realtime.log (if you use real-time logging)
•
.../docs/
7
Restart the Web Reporter Server service.
8
Open McAfee Web Reporter and log on.
The configuration settings are restored.
See also
Back up the current configuration on page 16
Configuration settings backup on page 93
96
McAfee® Web Reporter 5.2.0 Product Guide
Index
A
about 65
about this guide 7
accept incoming log files
about 43
accept real-time log data
about 43
activation
automatic 23
manual 24
administrators
about 9
disable 73
logon accounts 67
advanced reports
complete 11
custom logo 11
first four rows 11
aggregate record cache size 82
automatic-discover log formats
about 44
list of 44
B
backup
McAfee Web Reporter 16, 94
internal database 26
McAfee Web Reporter settings 93
system settings 16, 94
basic features 10
C
cache
aggregate record cache size 82
fixed memory usage 82
incremetally load entries 82
IP cache size 82
load all entries 82
mode 82
Quick View 81
site request cache size 82
user cache size 82
cache size
aggregate record 82
IP 82
site request 82
user 82
categories
log source setup 58
multiple 58
categorization
log sources 63
collect log files from
about 43
concurrent jobs 82
configuration
McAfee Web Reporter 93
backup 93
directories
assignment 41
copy 41
delete 42
disable 41
manual 36
status 41
used by 41
external directory
automatic 35
settings 93
status 41
update now 37
conventions and icons used in this guide 7
custom columns
about 54
custom log formats
assignments 54
configure 52
copy 53
delete 53
edit 53
premium feature 11
used by 54
custom rule sets
about 54, 55
McAfee® Web Reporter 5.2.0 Product Guide
97
Index
D
data
delegated reports 70, 71
databases
maintenance 84, 85, 87–90
about 9
delete 85
execute SQL 29
external 25, 27
external database 28
internal 25, 26
internal database 26
jobs 90
log source 87
maintenance 84, 85, 87–90
about 83
offline 29
online 29
out-of-date 19, 28
partition 19, 28
records 84, 89
records maintenance 86, 87, 92
records rollup 84
records update 87
repopulate columns 87, 88
roll days to months 85
roll hours into days 84
rollups 85
days to months 85
delete
manual 86
schedule 92
scheduled 86
hours to days 84
manual 86
schedule 92
scheduled 86
schema 19, 28
statistics 89
status 89
supported 9, 25
synchronize users 87
system maintenance jobs 92
update 19, 28
delegated reporting
premium feature 11
delegated reports
about 67
example 67
group report 70
IP address data 70
log source 71
logon accounts 67, 68
setup 69
user data 70
98
McAfee® Web Reporter 5.2.0 Product Guide
delete
log source 61
directories
about 9
assignment 41
associate users and groups 37
configuration
automatic 35
copy 41
delete 42
disable 41
manual 36
update 36
copy 41
delete 42
disable 41
external 34, 36, 37
schedule update 37
groups 37, 39
in log sources 56
internal 31, 32
log sources 42, 58
logon accounts 42, 65
manage 40
reporting database 37
status 41
supported 9, 34
synchronize users 87
test groups 37, 39
used by 41
user names, display 38
users without 89
disable
license 24
log source 61
documentation
audience for this guide 7
product-specific, finding 8
typographical conventions and icons 7
download
McAfee Web Reporter 15
E
elements
planning considerations 13
elements, software 9
email
configure 75
report delivery 75
system notifications messages 75
test settings 76
evaluation
license 14
license, requirements 14
Index
evaluation period 11
execute SQL 29
external database
connect to 28
recommendations 27
setup
test 28
external directories
add 34
configuration 34
assignment 41
automatic 35
copy 41
delete 42
disable 41
manual 36
status 41
used by 41
detect 34
edit 34
schedule update 37
status 41
supported 34
update 36
update now 37
F
features
basic 10
fixed field log formats
about 44
fixed memory usage 82
fixed-field log formats
list of 50
FTP
incoming log source 56
retrieve log files 60
full names 39
G
general
inactivity timeout 72
groups
associate users with 37
directories 39
internal directory 31, 32
report data 70
reporting database 37
test settings 37, 39
H
HTTP
incominglog source 56
retrieve log files 60
HTTPS
incoming log source 56
retrieve log files 60
I
import log
about 43
import now 60
inactivity timeout 72
incoming log files 56
index
about rebuilding 88
schedule rebuild 89
installation
database, internal 25
hardware requirements 13
license requirements 14
Microsoft Windows 15
operating system requirements 13
patches 20
planning considerations 13
report requirements 13
setup requirements 13
software requirements 13
system requirements 13
UNIX platforms 15
upgrade 18
internal database
backup 26
restore 26
setup 26
internal directory
add users 33
import 32
manual update 33
populate 32
remove users 33
schedule update 33
setup 31
text file 31
update 33
users 33
users and groups 31
IP
cache size 82
IP addresses
report data 70
IP cache size 82
hardware requirements 13
host names
log source setup 58
McAfee® Web Reporter 5.2.0 Product Guide
99
Index
J
log formats (continued)
jobs
concurrent 82
database maintenance 90
log processing 82
report 82
system maintenance 92
L
license
activation 23, 24
disable 24
obtaining 14
requirements 14
local user 65
locale
log source setup 58
log data
database 59
import 59
log fields
custom value 55
skipped 55
log files
accept incoming 60
categorization 63
collect 43
custom columns 54
custom rule sets 54, 55
FTP 60
get log files 60
HTTP 60
HTTPS 60
import 43
import now 60
incoming 43
log loader 60
page views 59
process now 60
real-time 43
reputation scores 63
retrieve 60
TrustedSource database 63
user-defined columns 54, 55
log formats
about 44
automatic-discover
list of 44
categorization 63
custom 52
about 44
assignments 54
configure 52
copy 53
100
McAfee® Web Reporter 5.2.0 Product Guide
delete 53
edit 53
used by 54
fixed-field
list of 50
parsing 44
processing 44
reputation scores 63
standard
about 44
automatic-discover 44
fixed-field 44
TrustedSource database 63
log loader 60
log out, automatic 72
log source
accept incoming 60
FTP 60
get log files 60
HTTP 60
HTTPS 60
log loader 60
log sources
about 9, 43
categories 58
categorization 63
character format 58
client host names 58
collect 43
configuring 58
custom columns 54
custom rule sets 54, 55
delete 61
detailed records 58
directories 58
directory use 42
disable 61
FTP 56
HTTP 56
HTTPS 56
import 43
import now 60
incoming 43
incoming log files 56
locale 58
modes 43
page views 58, 59
parsing errors 58
post-processing 58
process now 60
processing 56, 58
real-time 43
records maintenance 87
regular expression 58
Index
log sources (continued)
report data 71
reputation 58
reputation scores 63
setup 58
supported 9
synchronize users 87
time offset 58
TrustedSource 58
TrustedSource database 63
user-defined columns 54, 55, 58
UTC 58
logon accounts
about 65
administrator 67
configure 68
delegated reports 67–69
delete 74
directory use 42
disable 73
edit 72
inactivity timeout 72
manage 72
permissions 67, 68
select 69
roles 67, 68
select 69
type 68
types 65
specify 68
users 67
mapped columns (continued)
example 77
mapped values 79, 80
mapped values
add 79
edit 79
export 80
import 80
M
P
maintenance
database 83–85
database records 84
database records rollups 84
database records updates 87
delete 85
jobs 90, 92
log source records 87
manual 86
repopulate columns 88
roll days into months 85
roll hours into days 84
rollups 85
schedule 92
scheduled 86
synchronize users 87
system 91
mapped columns
about 77
add 79
edit 79
page views
about 59
log source setup 58
parent group 65
parsing logs 44
partition 28
See also databases
maximum unflushed record age 82
McAfee ServicePortal, accessing 8
memory
fixed usage 82
memory allocation 81
messages 75
multiple categories
log source setup 58
N
network group
about 65
example 65
network user
about 65
example 65
notifications 75
O
operating system requirements 13
options
inactivity timeout 72
partition database
during schema update 19, 28
patches, install 20
performance
advanced options 82
database statistics 82
index, rebuild 88, 89
memory allocation 81
Quick View cache 81
tunable parameters 82
permissions
delegated reports 67
logon accounts 68
select for account 69
McAfee® Web Reporter 5.2.0 Product Guide
101
Index
permissions, logon accounts 67
planning considerations 13
post-processing
incoming log files 56
premium features
activation 23, 24
disable 24
license, obtain 14
license, requirements 14
processing
incoming log files 56
processing logs 44
Q
restore (continued)
internal database 26
system settings 95
roles
logon accounts 68
select for account 69
roles, logon accounts 67
rollups
days to months 85
example 85
hours to days 84
manual 86
schedule 92
scheduled 86
queue throttle threshold 82
queue throttle wait time 82
rule sets, See custom rule sets
R
schema
See also databases
record age 82
records
repopulate columns 88
rollups
manual 86
schedule 92
scheduled 86
records rollups 84
regular expressions
log source setup 58
repopulate columns 87, 88
report data
IP address 70
log source 71
users
groups 70
report delivery
email setup 75
reporting database 37
reports
complete 11
custom logo 11
first four rows 11
reputation
log source setup 58
reputation scores 63
requirements
hardware 13
license 14
operating system 13
report 13
setup 13
software 13
system 13
restore
McAfee Web Reporter 95
102
McAfee® Web Reporter 5.2.0 Product Guide
S
update and partition 19, 28
serial number, See license
ServicePortal, finding product documentation 8
setup
requirements 13
site request cache size 82
software
download 15
elements 9
requirements 13
uninstall 20
upgrade 18
statistics
database 82
synchronize users 87
syncronize users 87
system
requirements 13
system maintenance 91
system notification messages
email setup 75
system settings
backup 16, 94
restore 95
T
Technical Support, finding product information 8
text file for internal directory 31
throttle threshold 82
throttle wait time 82
timeout 72
TrustedSource
software element 9
Index
TrustedSource database
categorization 63
disable 64
download 64
log sources 63
reputation scores 63
U
unflushed record age 82
uninstall
Microsoft Windows 20
UNIX platforms 20
update 37
updates
external directories 36, 37
schedule 37
internal directory 33
upgrade
32-bit 18
64-bit 18
database, update schema 19, 28
URLs
categorization 63
multiple categories 58
reputation scores 63
user cache size 82
user-defined columns
about 54, 55
assign custom value 55
user-defined columns (continued)
configure 58
in log sources 56
include skipped data 55
log source setup 58
log sources 58
rule sets 55
setup 58
users
about 9
associate with groups 37
cache size 82
directories 37
directories, display 38
directories, without 89
full names, display 39
groups in directories 37
internal directory 31–33
logon accounts 67
names, display 38
report data 70
reporting database 37
test group settings 37
UTC
log source setup 58
UTF-8 31
W
what's in this guide 8
McAfee® Web Reporter 5.2.0 Product Guide
103
700-2692A-00
Download PDF