Web Gateway 7.1.5 Product Guide - McAfee

8
Monitoring
Logging
The settings of the blocking action specify a message to the requesting user. They also include an
ID for the block reason, which is recorded in the entry that is written into the Access Log for the
request.
To configure action settings for the rule, you need to create these settings before you create the rule.
If you want to set the text contained in the body of the web object as the value of the
User-defined.listOfWords property, you must use another rule to set the value. This rule, which must be
placed and executed before the blocking rule, could look as follows:
Set User-Defined.listOfWords
Always –> Continue — Set User-Defined.listofWords = String.ToStringList (Body.Text “ ” “.,;:‘’!?”)
When this rule is processed, it is always executed. It uses an event to set the User-Defined.listOf
Words property to a value, which is the list of words in a text. To provide this list, the String.To
StringListProperty converts the words from the text contained in the body of a web object into a
list. The web object is the one that is currently being requested by a user.
The Body.Text property is the first parameter of the String.ToStringList property. It is a string
containing the text in the body of the requested web object. The other two parameters specify a
list delimiter and a character that has all its occurrences deleted in the list, which is the whitespace
in this case.
The Continue action lets processing continue with the next rule.
For information on how to configure a user-defined property for the blocking rule, see Create a
user-defined property of the list type.
For creating a rule set to contain the two rules, see Create a rule set for new rules.
For creating the rules, see Create a rule for setting text as the value of a user-defined property and
Create a rule for blocking text with bad key words.
Addition to a default logging rule
You can use the Rule Sets tab to work with the default logging rules. To let a logging rule write key
words that have been identified by a suitable rule into the Access Log, you need to add the value of the
List.LastMatches property to the log line used by the log.
The value of the List.LastMatches property is a string containing all elements that have been found to
match when two lists are compared using an operator such as at least one in list or all in list.
After adding this value to the log line of the Access Log, you will see in this log the word or words that
the blocking rule has identified as the reason for blocking access to a web object.
For example, the blocking rule compares a keyword list containing the words “shopping”, “travel”, and
“games” to a list of words created by converting the text in question. If the comparison uses the
at-least-one-in-list operator, the occurrence of the word “shopping” is sufficient for blocking access to
this text. The log line then includes this word. This way you not only know why access was blocked, but
also the key word that triggered the blocking.
If you use a different operator, for example, the all-in-list operator, the blocking rule is only executed if
all key words are matched within the text in question. All key words are then recorded.
After adding the value of the List.LastMatches property to the log line of the Access Log, the default
logging rule that writes this line into the log could look as follows:
Write access.log
Always –> Continue —
Set User-Defined.logLine =
DateTime.ToWebReporterString + “ ”
+ Authentication.Username + “ ”
...
284 McAfee Web Gateway 7.1.5 Product Guide