Blue Coat Systems Reporter 9.x

Transcription

1 Blue Coat Systems Reporter 9.x Initial Configuration Guide Reporter Versions 9.4.x

2 Blue Coat Reporter 9.x Initial Configuration Guide Contact Information Americas: Blue Coat Systems Inc. 420 North Mary Ave Sunnyvale, CA Rest of the World: Blue Coat Systems International SARL 3a Route des Arsenaux 1700 Fribourg, Switzerland For concerns or feedback about the documentation: Copyright Blue Coat Systems, Inc. All rights reserved worldwide. No part of this document may be reproduced by any means nor modified, decompiled, disassembled, published or distributed, in whole or in part, or translated to any electronic medium or other means without the written consent of Blue Coat Systems, Inc. All right, title and interest in and to the Software and documentation are and shall remain the exclusive property of Blue Coat Systems, Inc. and its licensors. ProxyAV, ProxyOne, CacheOS, SGOS, SG, Spyware Interceptor, Scope, ProxyRA Connector, ProxyRA Manager, Remote Access and MACH5 are trademarks of Blue Coat Systems, Inc. and CacheFlow, Blue Coat, Accelerating The Internet, ProxySG, WinProxy, PacketShaper, PacketShaper Xpress, PolicyCenter, PacketWise, AccessNow, Ositis, Powering Internet Management, The Ultimate Internet Sharing Solution, Cerberian, Permeo, Permeo Technologies, Inc., and the Cerberian and Permeo logos are registered trademarks of Blue Coat Systems, Inc. All other trademarks contained in this document and in the Software are the property of their respective owners. BLUE COAT SYSTEMS, INC. AND BLUE COAT SYSTEMS INTERNATIONAL SARL (COLLECTIVELY BLUE COAT ) DISCLAIM ALL WARRANTIES, CONDITIONS OR OTHER TERMS, EXPRESS OR IMPLIED, STATUTORY OR OTHERWISE, ON SOFTWARE AND DOCUMENTATION FURNISHED HEREUNDER INCLUDING WITHOUT LIMITATION THE WARRANTIES OF DESIGN, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL BLUE COAT, ITS SUPPLIERS OR ITS LICENSORS BE LIABLE FOR ANY DAMAGES, WHETHER ARISING IN TORT, CONTRACT OR ANY OTHER LEGAL THEORY EVEN IF BLUE COAT SYSTEMS, INC. HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. Americas: Rest of the World: Blue Coat Systems, Inc. Blue Coat Systems International SARL 420 N. Mary Ave. 3a Route des Arsenaux Sunnyvale, CA Fribourg, Switzerland Document Number: Document Revision: Reporter 9.4.x 11/2012 ii

3 Contents Chapter 1: Preface/Task List About This Document...5 Document Conventions...5 Notes and Warnings...5 About Deployment Types...6 Initial Configuration Tasks...6 Chapter 2: Planning Your Reporter Deployment Example Planning Table...9 Example Deployment...9 Example Planning Table ProxySG/Server Information...10 Planning Table ProxySG/Server Information...11 Chapter 3: Deploying Reporter Section A: ProxySG Configuration Configuring the ProxySG to FTP Access Log Files...15 Configuring the ProxySG to Stream Access Log Files...17 Windows Prerequisite: Open Firewall Port ProxySG Direct to Reporter Server Configuration Procedure...19 Section B: Installing Reporter on a Dedicated Server or Virtual Machine Retrieving a License...21 Installing Reporter...22 Installing Reporter On A Windows Server (32 or 64-bit OS)...23 Installing Reporter On A Linux Server (32 or 64-bit OS, Non-Root User)...25 Installing Reporter on a Virtual Machine...27 Extending the Log Database Partition...35 Accessing the Reporter Management Console...35 Changing Languages...35 Logging In...36 Section C: Creating a Database and Log Source FTP Upload Method...39 Direct ProxySG Streaming Method...45 Section D: Configure User Access Section E: Where To Go For More Information 0

4 Blue Coat Reporter 9.x Initial Configuration Guide i

5 Chapter 1: Preface/Task List About This Document Document Conventions Audience: Network Administrators This document provides the tasks required to install Blue Coat Reporter 9.3.x to a dedicated server, configure the ProxySG to upload access logs to the Reporter server, and create a database to process the access log data. This document adheres to the following typographical and document design principles. Table 1 1 Document Conventions Conventions Italics Courier font Courier Italics Courier Boldface Arial Boldface Definition The first use of a new or Blue Coat-proprietary term. Screen output. For example, command line text, file names, and Blue Coat Content Policy Language (CPL). A command line variable that is to be substituted with a literal name or value pertaining to the appropriate facet of your network system. A Blue Coat literal to be entered as shown. Screen elements in the Management Console. { } One of the parameters enclosed within the braces must be supplied [ ] An optional parameter or parameters. Either the parameter before or after the pipe character can or must be selected, but not both. Notes and Warnings The following is provided for your information and to caution you against actions that can result in data loss or personal injury: Note: Information to which you should pay attention. Important: Critical information that is not related to equipment damage or personal injury (for example, data loss). WARNING! Used only to inform you of danger of personal injury or physical damage to equipment. An example is a warning against electrostatic discharge (ESD) when installing equipment. 5

6 Blue Coat Reporter 9.x Initial Configuration Guide Related Documentation The following documents are available on the Blue Coat download site: Blue Coat Reporter 9.3 Release Notes Linked to from the Reporter software download page. Blue Coat Reporter 9.x Administrator s Guide Blue Coat Reporter 9.x Help System PDF Version Blue Coat Reporter Online Help System (available through the Reporter user interface) These document PDFs are available at: The intended reference path is: Release Notes > Initial Configuration Guide > Help System > Administrator s Guide For any Reporter documentation issues, send to: documentation@bluecoat.com. About Deployment Types Initial Configuration Tasks There are two deployment types. The standard method configures the ProxySG (serving as a Secure Web Gateway) to periodically FTP access logs to the Reporter server (or staging server), then configure Reporter to process those log files. The alternate method uses a custom Reporter upload client to stream access log data to the Reporter server for real-time processing. The Blue Coat-recommended Reporter initial configuration requires the following tasks. Table 1 2 FTP Deployment Tasks Task 1 Plan the Reporter network architecture, including which ProxySG appliances are sending access log files to which servers. 2 Configure the ProxySG to FTP the mainformat access logs to a pre-configured FTP server. 3 (Optional at this stage). Retrieve a Reporter license. 4 Install Reporter on a dedicated server (if sizing permits, it can be the same server that receives the access logs). 5 Create a database that processes the log files at the designated FTP or local folder location. Reference Link Chapter 2: "Planning Your Reporter Deployment" Chapter 3, "Configuring the ProxySG to FTP Access Log Files" on page 15 Chapter 3, "Retrieving a License" on page 21 Chapter 3, "Installing Reporter" on page 22 Chapter 3, Section C:"Creating a Database and Log Source" on page 38 6

7 Chapter 1: Preface/Task List Table 1 2 FTP Deployment Tasks Task Reference Link 6 Define a user role. Chapter 3, Section D:"Configure User 7 Create a user and assign to a role. Access" on page 50 7

8 Blue Coat Reporter 9.x Initial Configuration Guide 8

9 Chapter 2: Planning Your Reporter Deployment Example Planning Table You must be familiar with your network topologies. If you have multiple Reporter deployments, knowing the identities of the various ProxySG appliances and servers dedicated to Reporter processing saves you time when configuring databases and log sources. Also be advised of the following limit enforced by Reporter: no more than 50,000 unprocessed log files can exist at any time in a folder waiting to be processed. Use this knowledge to plan how many individual folders are required for each ProxySG. This section provides an example table and a blank table for you to fill out during your planning. Example Deployment Example Corp has a two-floor main campus in San Jose, California and smaller branch office in Austin Texas. Three ProxySG appliances provide Secure Web Gateway services and FTP log files to FTP servers in their respective build labs. Reporter will be installed on a dedicated server in the main IT lab and will FTP log files from each FTP server. 9

10 Blue Coat Reporter 9.x Initial Configuration Guide Figure 2 1 Example deployment diagram: San Jose and Austin offices. Example Planning Table ProxySG/Server Information The following example planning table is filled out based on Figure 2 1. Gateway ProxySG Location FTP Server Reporter Server* San Jose Floor 1Lab (IT) San Jose Floor 2 Lab Austin Lab * Might be the same server that receives the access logs. 10

11 Chapter 2: Planning Your Reporter Deployment Planning Table ProxySG/Server Information This table is provided to assist you in planning your Reporter deployment. If you have branch or regional offices with Reporter installed at each location, print this page for each location. For larger deployments, you might need to create a custom planning table. ProxySG Location FTP Server Reporter Server* * Might be the same server as the access log server. Next Step When you complete the Reporter deployment plan, proceed to Chapter 3: "Deploying Reporter" on page

12 Blue Coat Reporter 9.x Initial Configuration Guide 12

13 Chapter 3: Deploying Reporter This chapter provides Reporter deployment tasks in the following high-level order: Step 1: Configure a gateway ProxySG to FTP or stream its HTTP/HTTPS/ Streaming access logs to a dedicated server. Step 2: Install Reporter on either the same server to which the access logs are sent or on a dedicated Reporter server. For the latter, you must configure Reporter to FTP the logs again and you might have to configure it as an FTP server. You can also install on a 64-bit virtual machine. Step 3: Create a database that links to the log file source. Note: Alternatively, configure or assign the log source after you create the database. For larger deployments, you might want to assign one log source per ProxySG because of the amount of logs sent over; for direct ProxySG (streamed logs), you might elect to configure the database first and begin the log streams from each ProxySG. Step 4: Create a user role, such as Human Resource or IT. Step 5: Create a user and assign the user to a role (access permissions). 13

14 Blue Coat Reporter 9.x Initial Configuration Guide Section A: ProxySG Configuration This section describes how to configure a gateway ProxySG to upload (FTP) or stream access log files to a server. The examples in this procedure correspond to the "Example Planning Table ProxySG/Server Information" on page 10. For the standard, FTP upload method, follow the procedure in "Configuring the ProxySG to FTP Access Log Files" on page 15. For the direct ProxySG streaming method, follow the procedure "Configuring the ProxySG to Stream Access Log Files" on page 17. Note: These procedures use the SGOS 6.2.x Management Console. Other versions might vary. 14

15 Chapter 3: Deploying Reporter Configuring the ProxySG to FTP Access Log Files This section describes how to configure a gateway ProxySG to FTP access log files to the Reporter server. FTP Upload Client Method Prerequisite Step 1: Deploy a supported Windows or Linux FTP server (for supported see the Blue Coat Reporter 9.x Release Notes). Configuration Step 2: Access the gateway ProxySG Management Console. a. From a browser, enter: b. From the Management Console, select: Configuration > Access Logging > Logs > Upload Client. Step 3: Configure the FTP upload client. a. From the Log drop-down list, select Main (by default, this is the bcreportermain_v1 format) or streaming (by default this is the bcreporterstreaming_v1 format).in the Upload Client area, select FTP Client from the Client Type drop-down list. b. Click Settings. The FTP Client Settings dialog displays. Step 4: Enter the primary FTP server information. a. From the Settings drop-down list, select Primary FTP Server. b. In the Host field, enter the server IP address. The default Port value is 21; only change if the server uses a different port. c. In the Path field, enter the directory path that will be the destination for log files. d. In the Username field, enter the account name required for server access. e. If a server access password is required, click Change Primary Password and enter the information. f. Click OK to close the dialog. 15

16 Blue Coat Reporter 9.x Initial Configuration Guide FTP Upload Client Method Step 5: Select a log format: compressed or text file. Options: In the Transmission Parameters area, select: gzip file: Compressed access log data. Blue Coat recommends this option, as most deployments process multiple Gigabytes (Gb) of data. text file: Acceptable for log files that are Kilobyte (Kb) in size rather than Gigabytes. Step 6: Click Apply to save these new settings. Step 7: Click Test Upload to ensure the configuration is correct. Follow the dialog notes. Note: Blue Coat recommends deleting the test file. Step 8: Begin uploading log files. a. Select the Upload Schedule tab. b. From the Log drop-down list, select main (currently, the only supported format). c. In the Upload the Log File area, click Upload Now. d. Specify how often log files are sent from this point going forward. Blue Coat recommends once per day (not continuously). e. If you perform other changes, click Apply. Step 9: On the Configuration > Access Logging > Genera > Global Settings tab, ensure that the value in the Limit total system access logging to field large enough to accommodate your enterprise s log files. Step 10: Proceed to the next section: Section B: "Installing Reporter on a Dedicated Server or Virtual Machine" on page

17 Chapter 3: Deploying Reporter Configuring the ProxySG to Stream Access Log Files This section describes how to configure a gateway ProxySG to create a direct connection to the Reporter server and stream data for immediate processing. Important: This method does not retain the raw access log data. If your enterprise requires log archiving or you are certain that you will have the need to reprocess legacy access logs, create a policy that streams backup copies of the log data. See the Blue Coat Reporter 9.x Administrator s Guide. Windows Prerequisite: Open Firewall Port 9081 If you do not open port 9081, the ProxySG cannot connect to the Reporter server. You can stream multiple ProxySG feeds to port 9081; you do not need a port for each feed. If you have already completed this or Reporter is deployed on Linux, proceed to "ProxySG Direct to Reporter Server Configuration Procedure" on page 19. Open Firewall Port 9081 Step 1: In Windows, open the Control Panel (Start > Control Panel). Step 2: Double-click Network Connections. 17

18 Blue Coat Reporter 9.x Initial Configuration Guide Open Firewall Port 9081 Step 3: Click Change Firewall Settings. The Windows Firewall dialog displays. Step 4: Click Add Port. The Add a Port dialog displays. Step 5: In the Name field, enter a name for the port (displays in the Programs and Service list). Step 6: In the Port Number field, enter 9081 (the port on which Reporter listens for streamed log data sent by the ProxySG). Step 7: Select TCP. Step 8: Click OK to close the Add a Port dialog; click OK to close the Windows Firewall dialog. Step 9: Proceed to the next section: "ProxySG Direct to Reporter Server Configuration Procedure" on page

19 Chapter 3: Deploying Reporter ProxySG Direct to Reporter Server Configuration Procedure The following procedure describes how to configure the ProxySG to communicate with the Reporter server. Direct ProxySG Method Prerequisite Step 1: Deploy or have access to a supported Windows or Linux server (for supported servers, see the Release Notes) this is not an FTP server; this server becomes the Reporter host. Configuration Step 2: Access the gateway ProxySG Management Console. Step 3: Configure the Blue Coat Reporter upload client. a. From a browser, enter: b. From the Management Console, select: Configuration > Access Logging > Logs > Upload Client a. From the Log drop-down list, select Main. b. In the Upload Client area, select Blue Coat Reporter Client from the Client Type drop-down list. c. Click Settings. The Blue Coat Reporter Client Settings dialog displays. Step 4: Enter the primary server information. a. From the Settings for drop-down list, select Primary Blue Coat Reporter Server. b. In the Host field, enter the server IP address. The default Port value is 9081; only change if the server uses a different port. Reporter requires only one port to service all upload clients. c. Click OK to close the dialog. 19

20 Blue Coat Reporter 9.x Initial Configuration Guide Direct ProxySG Method Step 5: Select a log format: compressed or text file. Options: In the Transmission Parameters area, select: gzip file: Compressed access log data. Blue Coat recommends this option, as most deployments process multiple Gigabytes (Gb) of data. text file: Acceptable for log files that are Kilobyte (Kb) in size rather than Gigabytes. Important: You can change this setting at any time as long as the ProxySG and Reporter server are properly communicating. Do not change this setting if the ProxySG loses connection with the Reporter server until after the connection is restored. Step 6: Click Apply to save these new settings. Step 7: Begin uploading log files. a. Select the Upload Schedule tab. b. From the Log drop-down list, select main (currently, the only supported format). c. In the Upload type area, select Continuously. d. Blue Coat recommends leaving Rotate the log file setting configured to Daily at 2:00AM because it enables a daily entry be added to the log source history file. The entry gives statistical information about this ProxySG log source. e. Click Apply. Step 8: Proceed to the next section: Section B: "Installing Reporter on a Dedicated Server or Virtual Machine" on page

21 Chapter 3: Deploying Reporter Section B: Installing Reporter on a Dedicated Server or Virtual Machine This section describes how to install Blue Coat Reporter. The Reporter server can be the same server that receives logs from ProxySG appliances, but your enterprise sizing requirements might dictate that you install the Reporter application on its own server so that it can manage larger databases. This section describes the following phases: "Retrieving a License" on page 21 "Installing Reporter" on page 22 "Accessing the Reporter Management Console" on page 35 Retrieving a License Installing and running Reporter does not require a license. You can run Reporter in Standard mode, which is adequate for trial periods and demonstrations. However, without a Reporter Enterprise or Premium license key, you cannot store more than 50 million log lines across all loaded databases. Note: If you expire past data (for example, older than 90 days) from your database(s), Reporter continues processing new log lines until the combined stored count of all loaded databases reaches this limit. This also means you can have multiple databases, each with 50 million lines, as long as you only load one at a time. When you order an Enterprise or Premium license key, Blue Coat sends an activation code to the address of the purchaser. Generate an Enterprise or Premium License Key Step 1: In a browser, enter: Step 2: Access the Blue Coat Licensing Portal (BCLP). a. On the BlueTouch Online tab, click License a Product. The rightportion of the area displays new links. b. Click License Others. The Blue Coat License Portal page displays. 21

22 Blue Coat Reporter 9.x Initial Configuration Guide Generate an Enterprise or Premium License Key Step 3: Enter your license activation key. a. From the Registration menu, select Blue Coat Reporter. b. In the Activation Code field, enter the number sent to you in the from Blue Coat. c. Click Submit. Step 4: Follow the on-screen instructions. Blue Coat sends the license key to the address registered on the account. Step 5: Proceed to the next section: "Installing Reporter". Installing Reporter This section describes how to install Reporter on a Windows or Linux server: Windows: "Installing Reporter On A Windows Server (32 or 64-bit OS)" on page 23 Linux: "Installing Reporter On A Linux Server (32 or 64-bit OS, Non-Root User)" on page 25 Virtual Machine: "Installing Reporter on a Virtual Machine" on page

23 Chapter 3: Deploying Reporter Installing Reporter On A Windows Server (32 or 64-bit OS) Installing the Reporter application requires downloading the program files to the designated, supported Reporter server (see the Blue Coat Reporter 9.x Release Notes for the list of supported Windows servers). Install the Reporter Application Step 1: In a browser, enter: Step 2: Access the software download page. Step 3: Download the application files: a. Click the Download tab. The Blue Coat Download page displays. b. From the Download menu, click Reporter. c. Click Reporter 9 (not pictured). d. Before installing any version of Reporter, Blue Coat strongly recommends reading the Release Notes (Please Read link). System compatibility lists, new feature briefs, and any known issues are listed in this document. e. Click the download link that matches the system on which you are installing. Step 4: Read the Software Download Rules page. By clicking I agree and wish to download this software, you acknowledge the rules and accept the terms. The next download page displays. Step 5: Download the executable. a. Click Download now. The Opening Reporter dialog displays. b. Click Save File. The executable file downloads to your desktop. 23

24 Blue Coat Reporter 9.x Initial Configuration Guide Install the Reporter Application Step 6: Locate the file on your system and doubleclick it to launch the installer. Follow the prompts to install the files. a. Click Next to begin the install. b. Review the License Agreement, select I accept the terms of the license agreement, and click Next. c. Review the Readme information and click Next. d. The Destination Folder page specifies where Reporter installs on the system. By default, Reporter installs in the C:\Program Files\Blue Coat\Reporter 9\ folder. Click Change to specify another location, or click Next. Step 7: Create the default Reporter Administrator account (this account can only be deleted by another user with administrator privileges). a. In the Admin Username field, enter the default administrator access username. b. In the Password fields, create a password for the default administrator user. c. (Optional) If you purchased an Enterprise license and retrieved the key (see "Retrieving a License" on page 21), enter it into the Reporter License field. Note: You can also enter the license key after installing Reporter. d. Click Next. A final screen displays, prompting you to confirm the installation settings. e. Upon verification, click Install. Reporter begins the installation process. Upon installation completion, Reporter launches. After it completes the installation process, Reporter displays a dialog that discusses the Blue Coat Reporter Improvement Program. As described in the dialog, Reporter sends anonymous information to Blue Coat to assist Blue Coat personnel in analyzing how Reporter is used. This basic information includes your license, server specifications, system resource use, and Reporter configuration and use. No private, enterprise-sensitive data is transmitted. Although this feature is enabled by default, you have the option to decline sending this information. The General Settings > Systems Settings > Server Settings page provides the Send anonymous system data to help improve Reporter option; clear this option and click Save. Proceed to "Accessing the Reporter Management Console" on page

25 Chapter 3: Deploying Reporter Installing Reporter On A Linux Server (32 or 64-bit OS, Non-Root User) Installing the Reporter application requires downloading the program files to the designated, supported Reporter server (see the Blue Coat Reporter 9.x Release Notes for the list of supported Linux servers). Note: The following procedure applies to installing Reporter as a non-root user. To install Reporter as a root user (less common method), see the Blue Coat Reporter 9.x Administrator s Guide. Install the Reporter Application (Linux) Step 1: In a browser, enter: Step 2: Access the software download page. Step 3: Download the application files: a. Click the Download tab. The Blue Coat Download page displays. b. From the Download menu, click Reporter. c. Click Reporter 9 (not pictured). d. Before installing any version of Reporter, Blue Coat strongly recommends reading the Release Notes (Please Read link). System compatibility lists, new feature briefs, and any known issues are listed in this document. e. Click the download link that matches the system on which you are installing. Note: The Linux##RPM link is the uncompressed installation file. If you select Linux##, this is the compressed (gzip) file. Gunzip the file in a directory such as /home/username/bc. 25

26 Blue Coat Reporter 9.x Initial Configuration Guide Install the Reporter Application (Linux) Step 4: As the root user, enter the following commands to install the RPM: # mkdir alternate_installation_directory # chown non_root_user:non_root_group alternate_installation_directory # rpm -Uhv --prefix=alternate_installation_directory bcreporter*.rpm Text similar to the following displays: Preparing... #################### [100%] 1:bcreporter #################### [100%] ##################################################################### # The Blue Coat Reporter installation completed successfully. # Please (re-)login as the user... # Then change your current working directory to... #... ##################################################################### Step 5: Log in as non-root user perform the remaining steps. Step 6: Change your working directory to the alternate_installation_directory for Reporter and run the startup configuration script: # cd alternate_installation_directory #./do-startup.sh Step 7: Enter responses for the prompts: # Username [admin] # Password: # Password (re-enter for verification): # License Key: Text similar to the following displays: ==> ==> The Blue Coat Reporter process must be started manually by entering "./bcreporter". ==> a. For the Username [admin] prompt, enter the default administrator access username. b. For the Password prompt, create a password for the default administrator user; repeat for verification c. (Optional) If you purchased an Enterprise license and retrieved the key (see "Retrieving a License" on page 21), enter it for the License key prompt. Note: You can also enter the license key after installing Reporter. d. Press <Enter>. Step 8: Start the Reporter process: #./bcreporter: Blue Coat Reporter is already stopped Starting Blue Coat Reporter: [OK] Reporter is now up-and-running. After it completes the installation process, Reporter displays a dialog that discusses the Blue Coat Reporter Improvement Program. As described in the dialog, Reporter sends anonymous information to Blue Coat to assist Blue Coat personnel in analyzing how Reporter is used. This basic information includes your license, server specifications, system resource use, and Reporter configuration and use. No private, enterprise-sensitive data is transmitted. Although this feature is enabled by default, you have the option to decline sending this information. The General Settings > Systems Settings > Server Settings page provides the Send anonymous system data to help improve Reporter option; clear this option and click Save. Proceed to "Accessing the Reporter Management Console" on page

27 Chapter 3: Deploying Reporter Installing Reporter on a Virtual Machine Beginning with Reporter , you can install Reporter on a 64-bit virtual machine, such as ESX or VMware. The requirements are: 64-bit systems only. The minimum sizing is at least 20 GB of virtual disk size at least 1 GB of RAM, but most production deployments will require much more resource. Refer to the Blue Coat Reporter Sizing Guide ( The ISO (virtual) image contains BOCA (Blue Coat s distribution of Linux) and Reporter. After prompting you for IP addresses, root password, and Reporter admin passwords, it loads up the virtual software and installs itself. The steps in this procedure are specific to VMware workstation Version 7, but are designed for any virtualized environment. This procedure assumes that you have some working knowledge of administering your virtual software. If you are configuring a first-time setup of your virtual hardware/software, consult the documentation for that product. Install on a Virtual Machine Step 1: In a browser, enter: 27

28 Blue Coat Reporter 9.x Initial Configuration Guide Install on a Virtual Machine Step 2: Access the software download page. Step 3: Download the application files: a. Click the Download tab. The Blue Coat Download page displays. b. From the Download menu, click Reporter. c. Click Reporter 9.3. d. Before installing any version of Reporter, Blue Coat strongly recommends reading the Release Notes (Please Read link). System compatibility lists, new feature briefs, and any known issues are listed in this document. e. Click the ISO download link and save the file in a directory that is accessible by the virtual machine. 28

29 Chapter 3: Deploying Reporter Install on a Virtual Machine Step 4: Create a new virtual machine and begin the wizard. a. Select Typical. b. Click Next. 29

30 Blue Coat Reporter 9.x Initial Configuration Guide Install on a Virtual Machine Step 5: Log in as non-root user perform the remaining steps. a. Select Install disc image file (iso). b. Click Browse and navigate to the folder in which you saved the installer file in Step 3e. c. Click Next. 30

31 Chapter 3: Deploying Reporter Install on a Virtual Machine Step 6: Select a supported Linux OS. a. Select Linux. b. Select a 64-bit version. c. Click Next. Step 7: Name the virtual machine: 31

32 Blue Coat Reporter 9.x Initial Configuration Guide Install on a Virtual Machine Step 8: Specify disk capacity. a. You must specify at least 20 GB of Maximum Disk Space. Refer to the Blue Coat Reporter Sizing Guide ( Whatever extra portion is not used during processing is partitioned for future use. b. Select Store virtual disk as a single file. c. Click Next. Step 9: Click Finish to create the new virtual machine. The VM automatically powers up and begins loading the bootable ISO as a CDROM device. a. At the Welcome to Reporter! message, click OK. b. At the to Configure the Ethernet Card prompt, answer Yes. 32

33 Chapter 3: Deploying Reporter Install on a Virtual Machine Step 10: Configure the Ethernet connection. The most common method is manually, but you can select Dynamic IP Configuration. a. Select Manual address configuration. b. In the IP Address field, enter the IP address of the ethernet card s network connection. c. Click OK. 33

34 Blue Coat Reporter 9.x Initial Configuration Guide Install on a Virtual Machine Step 11: (Manual Address Configuration only). If you selected Dynamic IP Configuration, skip to Step 12. Specify the hostname (if you skip this step, the system refers to it as localhost). a. Select Manually. b. Tab once and enter a hostname; for example, Reporter.com. c. Click OK. Step 12: Specify a root password (must be at least six characters) and click OK. The Linux installation begins. Step 13: Remove the ISO connection and click Reboot. Step 14: Login to Linux with the name root and the password specified in Step 12. Step 15: Verify the installation. a. To verify what IP address was configured, enter ifconfig. b. To verify that the Reporter daemon is running, enter /etc/init.d/bcreporter status. c. To verify where reporter was installed, use the change directory command (cd) to navigate down to /opt/ bc/reporter. d. The installation enables and starts an FTP service to enable ease of sending logs to the VM. To verify this service is active, access a terminal on or connected to (SSH) the virtual device. Enter the following command: #service vsftpd status A message similar to vsftpd (pid 2175) is running displays. 34

35 Chapter 3: Deploying Reporter Install on a Virtual Machine Step 16: Access Reporter. Enter the IP address (manually entered or dynamically obtained); for example: The Reporter Management Console (UI) displays. The default login credentials are admin/admin. Blue Coat strongly recommends changing this password, which you can do in Admin mode in the Management Console. Extending the Log Database Partition By default, the virtual appliance gives you 5GB in /sglogs for storing the raw logs. Most likely, this is not enough and you must enlarge the file system to accommodate more data. This procedure assumes that you created a virtual disk in your virtual server with enough extra space to accommodate a larger volume for /sglogs. If you are unsure how large your virtual disk is, check your virtual server configuration. Alternatively, use the Linux fdisk -l command to see how much space the operating system sees. These commands require root access. Access your Reporter virtual appliance using ssh and login as root. These commands assume you have a stock installation of Reporter and it has not been modified since installation. Step 1: Unmount the /syslogs file system: #umount /sglogs Step 2: Extend the file system: Note: You might have to run e2fsck at this point. The operating system prompts you if this is necessary and provides the appropriate syntax. By default, that syntax is: #e2fsck f /dev/mapper/system_vg-sglogs_vol. #lvextend L +20G r /dev/mapper/system_vg-sglogs_vol /dev/sda2 Note: The -L+20G command extends the logical volume by 20GB. Modify the -L command to size the volume to meet your requirements. Step 3: Remount the file system: #mount /sglogs Step 4: Confirm the new size: #df -h Accessing the Reporter Management Console If the Reporter Management Console is currently not displayed, access a Web browser on the Reporter server and enter: (exception: VMs). The log in screen displays. 35

36 Blue Coat Reporter 9.x Initial Configuration Guide Changing Languages If your access log data was generated in Chinese or Japanese language, you can change the language of the Reporter Management Console by selecting one from the Language drop-down list. This list is located on the bottom-right corner of the log in screen. You must change the language before logging in (you can log out and change the language at any time). Figure 3 1 Selecting a Reporter Language Logging In The first time you log in to the Reporter user interface, you must use the default administrator login name and password, as specified in "Installing Reporter" on page 22 Figure 3 2 Reporter Log In Screen When you click Log In, Reporter displays the General Settings page. Because you do not have any databases created yet, an overlay dialog displays informing you of the fact. 36

37 Chapter 3: Deploying Reporter Figure 3 3 Welcome Overlay Dialog Click OK to access Reporter. You can now create databases, user roles, and users. Proceed to "Creating a Database and Log Source" on page 38. Troubleshooting If you cannot gain access to the Reporter user interface, check the following. Platform Windows Linux Task Open the Task Manager and confirm that the two Reporter services, bcreporter and bcservice, are running. Confirm that the OS firewall is allowing communication on the port. Run Top and grep for bcreporter. Run -ps aux and grep for bcreporter. Verify port 8082 is open: netstat -a. 37

38 Blue Coat Reporter 9.x Initial Configuration Guide Section C: Creating a Database and Log Source This section describes how to create a database, assign a log source, and view the highlevel report Dashboard. This allows you to examine the basic operations of Reporter. Although some steps are the same, there are key differences between the FTP Upload and Direct ProxySG Streaming methods. Proceed to the section of your deployment choice: "FTP Upload Method" on page 39 "Direct ProxySG Streaming Method" on page 45 38

39 Chapter 3: Deploying Reporter FTP Upload Method This section describes how to create a database with a log source for access log files that are periodically uploaded to the Reporter server (or staging server) by the ProxySG. Creating a Database Prerequisite Step 1: Know the location of the log source (the server folder location) that contains the access logs sent from the ProxySG. If Reporter is to FTP logs from a staging server to the Reporter server, you must also have the access credentials and IP address or DNS name of the staging server. Configuration Step 2: Access the Reporter Management Console. From a browser, enter: Local access: Network access: The Reporter Management console displays. Click OK to close the welcome dialog. Step 3: Access the database creation wizard. a. Select General Settings > Reporter Settings > Data Settings > Databases. b. Click New. The Create New Database wizard displays. Step 4: Select the log type. Options: a. ProxySG (main): Logs generated by employees on the internal network. b. ProxyClient: Logs generated by employees who have ProxyClient installed on their mobile or remote systems (or on external IP addresses controlled by the company). c. Click Next to move to the next wizard page: Set Name. Step 5: Name the database. a. In the Database Name field, enter a meaningful name. For example, if this database is to represent a specific branch location, name the database after the location. The maximum database name length is 63 single-byte characters. For multi-byte characters (Chinese/ Japanese), the limit is fewer (varies). b. Click Next to move to the next wizard page: Set Log Sources. 39

40 Blue Coat Reporter 9.x Initial Configuration Guide Creating a Database Step 6: Configure Log Source options. a. From the Check for new log files every dropdown lists, select the interval that Reporter checks the log source for unprocessed log files. b. Click New Log Source. The Create New Log Source wizard displays. Step 7: Select a source option. a. Options: Local File Source: Select this option if Reporter is installed on the same server to which the ProxySG is uploading log files. FTP Server Source: Select this option if Reporter is installed on a dedicated system and must retrieve log files from another server. ProxySG Upload: This option is available for selection only if one or more ProxySG appliances are configured to stream log data using the Blue Coat Reporter Client and the ProxySG appliance has not been assigned to the Reporter database. For more information, see "Direct ProxySG Streaming Method" on page 45. b. Click Next to move to the next wizard page: Set Description. Step 8: Name the log source. a. In the Log Source Description field, enter a name that describes the origination of these log files. The maximum database name length is 63 single-byte characters. For multi-byte characters (Chinese/Japanese), the limit is fewer (varies). b. Click Next to move to the next wizard page: Set Location. 40

41 Chapter 3: Deploying Reporter Creating a Database Step 9: If you selected a local source in Step 6: a. In the Directory Path field, click the folder icon; navigate to the location of the log files (or paste in the server path this field also supports UNC paths). b. In the File Pattern field, the default value is *. Searching for specific log files is described in the Online Help System. For this initial database example, Reporter processes all files (with.log and.log.gz extensions). c. If your log directories contain multiple sub-folders, select Process Subdirectories (includes subdirectories of the log source root). d. Allows Reporter to verify it recognizes the log files for the given source. e. Click Next to move to the next wizard page: Set Post Processing Action. Proceed to Step 11. Step 10: If you selected an FTP server source in Step 6: a. Enter the FTP server access credentials: Hostname/IP, Port number, Username, and Password. b. Enter the Directory Path to the log files. c. In the File Pattern field, the default value is *. Searching for specific log files is described in the online Help System. For this initial database example, Reporter processes all files. d. If your log directories contain multiple sub-folders, select Process Subdirectories (includes subdirectories of the log source root). e. Click Done. This closes the Create New Log Source Wizard and returns you to the Create New Database wizard. 41

42 Blue Coat Reporter 9.x Initial Configuration Guide Creating a Database Step 11: Specify how often that the database checks this specific log source for new files. a. Select an option: Use Database Default: The database checks the log source for new files as specified in Step 6. Custom Schedule: Selecting this option allows you to specify an alternate check time than specified in Step 6a. For example, the database is set to check daily for new data, but the data generated by this log source only requires a once a week check. b. Click Next to move to the next wizard page: Set Post Processing Action Step 12: Specify post-processing action (applies to Local File Source option only; not visible for the FTP Server Source option). a. Select an option: Rename: Append '.done' to filename: After Reporter processes a log file, it adds.done to the existing.log or.gz suffix. When you browse the directories with a file viewer, this is how you know when files have been processed. Note: If you delete the.done suffix, Reporter reprocesses the log file. Move to folder: After Reporter processes a log file, the file moves to the specified directory (or subdirectory tree if Process Subdirectories was selected in Step 9c). Should you ever require a reprocessing of log files, you can copy the files back to the directory. Delete log file: After Reporter processes a log file, the file is deleted. Select this option if you are certain you will never have the need to process those log files again. b. Click Done. This closes the Create New Log Source Wizard and returns you to the Create New Database wizard. Step 13: Repeat Steps 6 through 12 to add another log source, or click Next to move to the next wizard page: Set Expiration 42

43 Chapter 3: Deploying Reporter Creating a Database Step 14: Specify when, if ever, database data automatically expires. a. Select an option: To never automatically expire a database, clear the Expire database data older than option. Reporter continues to display report data for all dates. To force Reporter to stop generating report data for dates beyond a specified time frame, select Expire database data older than, specify when data expires, and select the Frequency (when Reporter checks the database). For example, if the database contains log files processed with March 1st as the earliest date, the setting is 30 days, and the current date is April 1st, Reporter no longer generates and displays report data for March 1st (Reporter deletes the data from the database). Step 15: By default, Reporter stores each database in a folder called databases, which is located in the Reporter root folder/directory on the server. For example: Program Files/Blue Coat Reporter 9/ databases in Windows. Note: Reporter monitors only the main databases location for disk space and preemptive shutdown. If you place your databases around on separate disks (which is good for performance), Reporter 9.x does not monitor them for free space. You must manually monitor those disks (Reporter does not provide a disk monitoring application). b. Click Next to move to the next wizard page: Set Directory. Select an option: To accept the default, click Done. Databases can grow to be quite large and you might elect to create your database on a larger disk (databases cannot be moved after creation). Also, if you store your database on a faster hard drive, you should notice a better performance from Reporter. To specify an alternate location, click folder icon and navigate to a new location. Click Done. The new database displays. If you have specified log file sources and those sources contain log files, the Reporter begins processing the data and populating the database. 43

44 Blue Coat Reporter 9.x Initial Configuration Guide Creating a Database You can now click View Reports (upper-right corner of the Management Console). This displays the Report Dashboard, which is a collection of high-level reports intended to give you an overview of the processed access logs to date. For more information about the Dashboard, click the Help (?) button on the page. 1 The Database field displays the current database name. When more than one database is configured (and loaded), the field becomes a drop-down list and you, as an administrator, can select another database. 2 The Signed in as area indicates that you are logged in as the admin user. When more than one role is configured, you can select another role from the drop-down list (between the parenthesis). 3 The Administration link takes you back to the Reporter configuration module. 4 The Search field enables you to search reports for specific strings and values. 5 The Dashboard displays various report groups. To give you a high-level view of the most recently processed access logs, each report provides up to the top ten lines of data (highest volume top to bottom), or displays a graph. You can modify the appearance of these report graphs. 6 The Export to PDF button enables you to save the current Dashboard page as a PDF file, which you can then print or send to someone. 7 The Add Report button enables you to add another available report group to the Dashboard. 8 Some report groups display graphics by default. Hover over graphic components to display data. 9 Clicking the Reports tab displays all of the pre-defined data reports. 10 Clicking the Video Usage tab displays all of the pre-defined video reports. Now you can create user accounts and specify access parameters. Click the Administration link and proceed to Section D: "Configure User Access". 44

45 Chapter 3: Deploying Reporter Direct ProxySG Streaming Method This section describes how to create a log source for access log files that are streamed to the Reporter server by the ProxySG, create a database for that log source, and view the report Dashboard. Important: This method does not retain the raw access log data. If your enterprise requires log archiving or if you frequently need to reprocess legacy access logs, create a policy that streams backup copies of the log data. See the Blue Coat Reporter 9.x Administrator s Guide. Creating a Database Prerequisite Step 1: Know the server IP address. Configuration Step 2: Access the Reporter Management Console. From a browser, enter: Local access: Network access: The Reporter Management console displays. Click OK to close the welcome dialog. Step 3: Access the database creation wizard. a. Select General Settings > Reporter Settings > Data Settings > Databases. b. Click New. The Create New Database wizard displays. Step 4: Select the log type. Options: a. ProxySG (main): Logs generated by employees on the internal network. b. ProxyClient: Logs generated by employees who have ProxyClient installed on their mobile or remote systems (or on external IP addresses controlled by the company). c. Click Next to move to the next wizard page: Set Name. 45

46 Blue Coat Reporter 9.x Initial Configuration Guide Creating a Database Step 5: Name the database. a. In the Database Name field, enter a meaningful name. This example uses Demo as a name. b. Click Next to move to the next wizard page: Set Log Sources. Step 6: Click New Log Source. The Create New Log Source wizard displays. Alternative: You have configured the ProxySG to begin streaming access log data to the Reporter server, the Data Settings > Log Source page might already display it in the Unassigned Log Source area. If this is true: a. Skip Steps 5 through 8. b. Complete Steps 9 and 10. c. On the Data Settings > Log Source page, select Set Log Sources from the Actions dropdown list, and select the ProxySG log source. Step 7: Select ProxySG Upload and click Next to move to the next wizard page: Set Description. Step 8: In the Log Source Description field, enter a name that describes the origination of these log files. Click Next to move to the next wizard page: Set Location. 46

47 Chapter 3: Deploying Reporter Creating a Database Step 9: Select the log file location: a. From the ProxySG drop-down list, select the name of the ProxySG that you configured to stream log data (Reporter detects all ProxySG appliances configured to stream to this server). b. Click Done. This closes the Create New Log Source Wizard and returns you to the Create New Database wizard. c. View the Dashboard, as described in Step 12 on page 49. Note: If the ProxySG has not uploaded data to the Reporter server yet, the ProxySG does not display in the list and thus cannot connect; check again later. By default, the ProxySG is configured to upload after a minimum of 8K of received data. If this is the case, do not assign a log source at this time. When the ProxySG begins streaming data, it displays in the Unassigned Log Sources area on the Log Sources page; you can then assign it to the database. Step 10: Specify when, if ever, database data automatically expires. a. Select an option: To never automatically expire a database, clear the Expire database data older than option. Reporter continues to display report data for all dates. To force Reporter to stop generating report data for dates beyond a specified time frame, select Expire database data older than, specify when data expires, and select the Frequency (when Reporter checks the database). For example, if the database contains log files processed with March 1st as the earliest date, the setting is 30 days, and the current date is April 1st, Reporter no longer generates and displays report data for March 1st (Reporter deletes the data from the database). b. Click Next to move to the next wizard page: Set Directory. 47

48 Blue Coat Reporter 9.x Initial Configuration Guide Creating a Database Step 11: By default, Reporter stores each database in a folder called databases, which is located in the root Reporter folder or directory. Note: Reporter monitors only the main databases location for disk space and preemptive shutdown. If you place your databases around on separate disks (which is good for performance), Reporter 9.2 does not monitor them for free space. You must manually monitor those disks. (SAN disks are supported.) Select an option: To accept the default, click Done. Databases can grow to be quite large and you might elect to direct your database to a larger disk. Also, if you store your database on a faster hard drive, you should notice a better performance from Reporter. To specify an alternate location, click folder icon and navigate to a new location. Click Done. The new database displays. If you have specified log file sources and those sources contain log files, the Reporter begins processing the data and populating the database. 48

49 Chapter 3: Deploying Reporter Creating a Database Step 12: You can now click View Reports (upper-right corner of the Management Console). This displays the Report Dashboard, which is a collection of high-level reports intended to give you an overview of the processed access logs to date. For more information about the Dashboard, click the Help (?) button on the page. 1 The Database field displays the current database name. When more than one database is configured, the field becomes a drop-down list and you, as an administrator, can select another database. 2 The Signed in as area indicates that you are logged in as an administrator user. When more than one role is configured, you can select another role from the drop-down list. 3 The Administration link takes you back to the Reporter configuration module. 4 The Search field enables you to search reports for specific strings and values. 5 The Dashboard displays various report groups. To give you a high-level view of the most recently processed access logs, each report provides up to the top ten lines of data (highest volume top to bottom), or displays a graph. You can modify the appearance of these report graphs. 6 The Export to PDF button enables you to save the current Dashboard page as a PDF file, which you can then print or send to someone. 7 The Add Report button enables you to add another available report group to the Dashboard. 8 Some report groups display graphics by default. Hover over graphic components to display data. 9 Clicking the Reports tab displays all of the pre-defined data reports. 10 Clicking the Video Usage tab displays all of the pre-defined video reports. Now you can create user accounts and specify access parameters. Proceed to Section D: "Configure User Access" on page

50 Blue Coat Reporter 9.x Initial Configuration Guide Section D: Configure User Access Now that you have a populated database, the next step is to enable access to Reporter by users who are responsible for reviewing and analyzing report data. This section describes how to: Step 1: Create a role within the enterprise (for example Human Resources, Information Technology) and assign log fields to that role. Step 2: Create a user account, specify access credentials, and assign the user to a role. Note: The third step in configuring user access is optional. You can connect Reporter to a back-end LDAP server and assign LDAP groups to roles. The Reporter online Help system provides more information on this step. The following procedure provides an example of creating one role (that has access to a populated database), one user, and assigning the user to the role. Configure Reporter User Access Step 1: In the Reporter Management Console, select General Settings > Reporter Settings > Access Control > Roles (if you are on the Dashboard page, first click the Administration link at the top). Step 2: Click New. The Create New Role wizard displays. Step 3: Name the role. a. In the Role Name field, enter a name for the role; the more specific the name, the easier it will be to assign your users to their correct roles. b. Click Next to move to the next page of the wizard: Permissions. 50

51 Chapter 3: Deploying Reporter Configure Reporter User Access Step 4: Specify database options. a. Select the databases that users in this role can access. b. By default, the role has access to all database fields. To limit the log fields that reports in this role display, clear the unnecessary field options (or select No Fields to clear all options, then select the required fields). In this example, to customize an HR role the administrator clears log fields not related to user browsing activity. c. At this time, you have the option to create a filter that focuses report data to specific groups or IP addresses. This procedure does not apply a filter to the example role; all dates and data from selected log fields are displayed in reports. Filters can be added to a role at any time. d. You can also select the fields that need to be anonymous for a specific role and click on Done when finished. By default the No Fields box will be checked. Step 5: Click Done. The new role displays on the Roles page. Step 6: Select General Settings > Reporter Settings > Access Control > Users. Step 7: Click New. The Create New User wizard displays. Step 8: Create a user account. a. In the Username field, enter the name the user will use to log in to Reporter. b. Click Next to move to the next page: Set Password. Step 9: Specify the password this user will use to access the non-admin Reporter user interface. a. In the New Password field, enter the access credential password for this user; repeat in the Validate Password field. Again, if you are following a planning sheet, enter the password exactly as printed. If you are creating the passwords, record them accurately. b. Click Next to move to the next page: Set Permissions. 51