When you configure McAfee Web Gateway to send log data to USM Appliance, you can use the McAfee Web Gateway (mwg) plugin to translate raw log data into normalized events for analysis. The table below provides some basic information for the plugin:
|Data Source Name||mcafee-mwg|
|Data Source ID||1699|
Integrating McAfee Web Gateway
Before you configure the McAfee Web Gateway integration, you must have the IP Address of the USM Appliance Sensor.
To avoid potentially having your changes overwritten, complete this task, using only the McAfee Web Gateway web interface File Editor on a per appliance basis. Do not edit /etc/rsyslog.conf directly.
To configure McAfee Web Gateway to send log data to USM Appliance
- In File Editor, look for rsyslog.conf.
Look for a line similar to the following:
Make sure that the syslog daemon does not write any messages coming from the daemon facility (McAfee Web Gateway) with the level "info" to the /var/log/messages file by replacing it with the following line:
Important: This updated line ensures that the syslog daemon does not write any messages from the daemon facility (the McAfee Web Gateway) with info level, to the /var/log/messages file. Capturing and writing "info" level messages generates a high volume of messages, which could overflow the /var partition.
Send the data to a syslog server using UDP by adding a line like the one below to the end of the file:
Enable CEF format, as shown in the following figures.
For plugin enablement information, see Enable Plugins.
Additional Resources and Troubleshooting
For troubleshooting, refer to the vendor documentation: