Thread Info
  • State Verified Answer
  • Locked Locked
  • Replies 1 reply
  • Subscribers 1 subscriber
  • Views 4565 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos Reporting Interface- different time and modify script

the_man

I'm newbie for sophos reporting interface. Our customer need to generate report from sophos to import to another application (splunk). First, they as me why on output log files on Log Files folder any different time with computer one? such as, when user on client open blocked browser, internet explorer at 10/10/2014 8:49 AM, in the output file 'DefaultCommonEvents' contain like this :

InsertedAt=2014-10-10 01:47:20; EventID=18; EventTime=2014-10-10 01:47:18; EventTypeID=5; EventType=Application control; Name=Internet Explorer 8; ReportingName=Internet Explorer 8; UserName=DOMAIN\Administrator; ActionID=1; Action=Blocked; ScanTypeID=200; ScanType=Unknown; SubTypeID=19; SubType=; ComputerName=SOPHOSSVR; ComputerDomain=DOMAIN; ComputerIPAddress=192.168.2.14

can anyone explain me about this?

other things are, how to modify script on SophosLogWriterConfig for connection string?

our script are like this:

<connectionString>Integrated Security=SSPI;Persist Security Info=False;Initial Catalog=SOPHOS52;Data Source=192.168.2.14</connectionString>

where :

Initial Catalogl= SOPHOS52, since using sophos 5.2.2 version

Data source = IPAddress Sophos console

And, how to change default directory Log files to another drive or network drive. Since as default installation they will be generate on C:\Program Files (x86)\Sophos\Reporting Interface\Log Files

thank anyone for help

The Man

:53917


This thread was automatically locked due to age.
  • 0

    Hi,

    The times are in UTC which probably explains the difference in times.

    If you run the log writer service on the management server it will use the connection string from the registry so you don't need to specifiy it in the config, benefit being that as SEC upgrades the logwriter keeps working.  If you are running it remotely then, if you have:

    <connectionString>Integrated Security=SSPI;Persist Security Info=False;Initial Catalog=SOPHOS52;Data Source=192.168.2.14</connectionString>

    Should be correct, unless you have a SQL instance name, e.g. SOPHOS, in which case:

    <connectionString>Integrated Security=SSPI;Persist Security Info=False;Initial Catalog=SOPHOS52;Data Source=192.168.2.14\sophos</connectionString>

    To change the outplut location, have a search for

    <outputLocataion>

    http://www.sophos.com/en-us/medialibrary/PDFs/documentation/srlw_51_ugeng.pdf?la=en

    Regards,

    Jak

    :53921