Web Filter reporting error with Blocked Web Events/Flagged Web Events

[jcoffin]

Looking at the Unknown in Web Category, it appears the Web Filter lookup is failing.

[jlficken]

Looking at the Unknown in Web Category, it appears the Web Filter lookup is failing.

Cool, thanks!!!

[jlficken]

Any thoughts on what I can do about this or is it something that only you guys can fix?

[jcoffin]

Look in the Web Filter log in /var/log/uvm/app-<web filter instance #>.log for query warnings. It means something between you and brightcloud servers is blocking or redirecting queries.

[jlficken]

Look in the Web Filter log in /var/log/uvm/app-<web filter instance #>.log for query warnings. It means something between you and brightcloud servers is blocking or redirecting queries.

The categories do resolve but not after you try changing reports after the error. If you F5 the page they all come back until the next time the error occurs.

I've been looking at it seems to be app-8.log that I need? Is there a way to find the <web filter instance #> that I can use as I'm not positive I have the right file.

Dec 27 12:50:14 localhost app-8: [EventWriterImpl] <> INFO forceFlush() complete.
Dec 27 12:50:14 localhost app-8: [ReportEntry] <> INFO endDate not specified, using now plus 1 min: '2019-12-27 12:51:14'
Dec 27 12:50:14 localhost app-8: [ReportsManagerImpl] <> INFO Getting Events for : (Web Filter) Blocked Web Events
Dec 27 12:50:14 localhost app-8: [ReportsManagerImpl] <> INFO Statement : SELECT * FROM reports.http_events WHERE time_stamp >= '2019-12-27 00:00:00' and time_stamp <= '2019-12-27 12:51:14' and web_filter_blocked is TRUE ORDER BY time_stamp DESC LIMIT 1000
Dec 27 12:50:14 localhost app-8: [ReportsManagerImpl] <> INFO Query Time : 166 ms
Dec 27 12:50:24 localhost app-8: [EventWriterImpl] <> INFO persist(): EventStats 30 events, 7 statements [ 14 ms] [ 2143 event/s] [ 0.47 avg] [ 9s delay] [ 0 pending]
Dec 27 12:50:24 localhost app-8: [EventWriterImpl] <> INFO persist(): EventMap InterfaceStatEvent[9,2ms,0.22avg] ApplicationControlLogEvent[7,4ms,0.57avg] SessionStatsEvent[7,4ms,0.57avg] WanFailoverTestEvent[2,0ms,0.00avg] HostTableEvent[2,1ms,0.50avg] OpenVpnStatusEvent[2,1ms,0.50avg] TunnelVpnStatusEvent[1,2ms,2.00avg]
Dec 27 12:50:32 localhost app-8: [ReportsApp] <> INFO forceFlush() ...
Dec 27 12:50:32 localhost app-8: [EventWriterImpl] <> INFO forceFlush() ...
Dec 27 12:50:32 localhost app-8: [EventWriterImpl] <> INFO persist(): EventStats 49 events, 14 statements [ 20 ms] [ 2450 event/s] [ 0.41 avg] [ 6s delay] [ 0 pending]
Dec 27 12:50:32 localhost app-8: [EventWriterImpl] <> INFO persist(): EventMap SessionStatsEvent[14,4ms,0.29avg] ApplicationControlLogEvent[13,5ms,0.38avg] InterfaceStatEvent[9,1ms,0.11avg] WanFailoverTestEvent[2,0ms,0.00avg] FirewallEvent[2,2ms,1.00avg] SessionEvent[2,2ms,1.00avg] HttpRequestEvent[1,1ms,1.00avg] HostTableEvent[1,1ms,1.00avg] SessionNatEvent[1,0ms,0.00avg] SystemStatEvent[1,1ms,1.00avg] WebFilterEvent[1,1ms,1.00avg] OpenVpnStatusEvent[1,0ms,0.00avg] PrioritizeEvent[1,1ms,1.00avg]
Dec 27 12:50:32 localhost app-8: [EventWriterImpl] <> INFO forceFlush() complete.
Dec 27 12:50:32 localhost app-8: [ReportEntry] <> INFO endDate not specified, using now plus 1 min: '2019-12-27 12:51:32'
Dec 27 12:50:32 localhost app-8: [ReportsManagerImpl] <> INFO Getting Events for : (Web Filter) Flagged Web Events
Dec 27 12:50:32 localhost app-8: [ReportsManagerImpl] <> INFO Statement : SELECT * FROM reports.http_events WHERE time_stamp >= '2019-12-27 00:00:00' and time_stamp <= '2019-12-27 12:51:32' and web_filter_flagged is TRUE ORDER BY time_stamp DESC LIMIT 1000
Dec 27 12:50:32 localhost app-8: [ReportsManagerImpl] <> INFO Query Time : 173 ms

[jcoffin]

[root @ gatewayhm] ~ # ucli instances
42      web-filter              RUNNING         Default Rack
9       virus-blocker           RUNNING         Default Rack
12      virus-blocker-lite      RUNNING         Default Rack
11      bandwidth-control       RUNNING         Default Rack
13      ssl-inspector           INITIALIZED     Default Rack
24      application-control     RUNNING         Default Rack
14      firewall                RUNNING         Default Rack
50      ssl-inspector           INITIALIZED     Mobile Devices
46      captive-portal          INITIALIZED     Mobile Devices
29      firewall                RUNNING         No Filter
116     web-filter              RUNNING         SSL Inspection2
51      ssl-inspector           INITIALIZED     SSL Inspection2
33      captive-portal          INITIALIZED     SSL Inspection2
2       ftp                     RUNNING         Service
8       http                    RUNNING         Service
4       license                 RUNNING         Service
1       router                  RUNNING         Service
3       shield                  RUNNING         Service
10      smtp                    RUNNING         Service
5       reports                 RUNNING         Service
19      policy-manager          RUNNING         Service
49      directory-connector     RUNNING         Service
53      wan-failover            RUNNING         Service
106     openvpn                 RUNNING         Service
111     tunnel-vpn              RUNNING         Service
115     intrusion-prevention    RUNNING         Service
16      configuration-backup    RUNNING         Service
22      branding-manager        RUNNING         Service
21      live-support            RUNNING         Service

[jlficken]

Thanks!

This is what I get when I run that command.

[root @ 5018D-FN8T] ~ # ucli instances
10      web-filter              RUNNING         Default
39      virus-blocker           RUNNING         Default
45      virus-blocker-lite      RUNNING         Default
9       bandwidth-control       RUNNING         Default
14      application-control     RUNNING         Default
5       captive-portal          RUNNING         Default
7       firewall                RUNNING         Default
26      ad-blocker              RUNNING         Default
60      bandwidth-control       RUNNING         Guest
62      bandwidth-control       RUNNING         IoT
50      web-filter              RUNNING         Kid
61      bandwidth-control       RUNNING         Kid
70      application-control     RUNNING         Kid
78      bandwidth-control       RUNNING         Lab
52      firewall                RUNNING         No Internet
3       ftp                     RUNNING         Service
6       http                    RUNNING         Service
1       license                 RUNNING         Service
2       router                  RUNNING         Service
4       shield                  RUNNING         Service
13      smtp                    RUNNING         Service
81      reports                 RUNNING         Service
17      policy-manager          RUNNING         Service
34      directory-connector     RUNNING         Service
37      wan-failover            RUNNING         Service
47      wan-balancer            RUNNING         Service
30      ipsec-vpn               RUNNING         Service
31      openvpn                 RUNNING         Service
16      tunnel-vpn              RUNNING         Service
80      intrusion-prevention    RUNNING         Service
42      configuration-backup    RUNNING         Service
22      live-support            RUNNING         Service
71      bandwidth-control       RUNNING         Streaming
63      bandwidth-control       RUNNING         Surveillance
55      firewall                RUNNING         Surveillance

Using 10 as the # these are the only entries in there from today:
Dec 27 12:49:26 localhost app-10: [AppBase] <> INFO Stopping web-filter [10] ...
Dec 27 12:49:28 localhost app-10: [AppBase] <> INFO Stopped web-filter [10] ...
Dec 27 12:49:32 localhost app-10: [AppBase] <> INFO Starting web-filter [10] ...
Dec 27 12:49:32 localhost app-10: [AppBase] <> INFO Started web-filter [10] ...

ETA: There is nothing in app-50.log for today.

I did uninstall the Reports module and reinstall it just to try but it didn't change anything.

[jlficken]

The only thing I can find in any log when the exception happens is this from uvm.log which isn't very helpful to you most likely.

Dec 27 13:42:30 localhost [UvmContextImpl] WARN Javascript Exception

I can attach any logs which may be helpful as I'm at a loss.

I also deleted the 6 months of data that I had stored up for reporting to see if that would help but it didn't.

[jlficken]

I see this oddity where the grid doesn't show the category, however, the Details window does have it...weird.

I'm going to give up for now though as I don't know what to try next.

Screen.png