Blue Coat Reporter 9.x Online Help System - PDF Version

Reporter 9.1.
x Online Help System

PDF Version
Table of Contents
About This PDF Document.............................................................................................................. 1
How Do I...? (Administrator Tasks).................................................................................................. 3
How Do I...? ..................................................................................................................................... 7
Personal Settings ............................................................................................................................ 9
Changing Personal Settings ........................................................................................................ 9
Changing Your Reporter Password ........................................................................................... 10
Specifying Your Reporter E-mail Address ................................................................................. 11
Administration ................................................................................................................................ 13
Database Management.............................................................................................................. 13
About Databases .................................................................................................................... 13
Creating New Access Log Databases.................................................................................... 15
Creating New Database Log Sources.................................................................................... 20
Managing Existing Databases................................................................................................ 23
User Management ..................................................................................................................... 28
About Creating New Users..................................................................................................... 28
Creating User Roles ............................................................................................................... 29
Creating Administrator and Standard Users .......................................................................... 31
Applying LDAP Authentication to Roles ................................................................................. 33
Reporter Application Management ............................................................................................ 34
Managing the Reporter License ............................................................................................. 34
Managing Reporter Server Connections................................................................................ 35
Connecting Reporter to Mail Servers ..................................................................................... 39
Connecting Reporter to External Authentication Servers ...................................................... 41
Sending Resource Alert E-mails ............................................................................................ 44
Viewing Reporter Tasks That Are Currently Scheduled to Run............................................. 46
Managing Data Directories..................................................................................................... 47
Viewing Archived Reports Currently Residing on the Reporter Server ................................. 48
Diagnostics/Troubleshooting...................................................................................................... 49
Uploading System Diagnostics to Blue Coat.......................................................................... 49
Viewing System Diagnostics .................................................................................................. 50
Reviewing Reporter Event Logs............................................................................................. 51
Shutting Down or Restarting Reporter ................................................................................... 52
The Dashboard .............................................................................................................................. 53
About the Dashboard ................................................................................................................. 53
Adding Reports to the Dashboard ............................................................................................. 55
Removing a Report from the Dashboard ................................................................................... 56
Expanding Dashboard Reports.................................................................................................. 57
iii
Reporter 9.1.x Online Help System PDF Version
Reports .......................................................................................................................................... 61
Viewing Generated Reports....................................................................................................... 61
About Overview Reports ............................................................................................................ 65
Searching Databases................................................................................................................. 66
Bandwidth Usage Reports ......................................................................................................... 67
Report: Bandwidth Cost per User .......................................................................................... 67
Report: Bandwidth Used per Day........................................................................................... 70
Report: Bandwidth Used per Hour of Day.............................................................................. 71
Report: Requests per Content Type ...................................................................................... 72
Report: Web Requests per Client IP ...................................................................................... 73
Security Reports ........................................................................................................................ 74
Reports: Blocked Web Browsing by User Agent.................................................................... 74
Report: Blocked Web Sites .................................................................................................... 75
Report: Filtering Verdict Trend by Day................................................................................... 76
Malware Requests Blocked by Site........................................................................................ 77
Report: Potential Malware Infected Clients ............................................................................ 78
Report: ProxyAV Malware Detected: Client IP....................................................................... 80
Report: ProxyAV Malware Detected: Names ......................................................................... 81
Report: ProxyAV Malware Detected: Site .............................................................................. 82
Report: SSL Certificate Categories ........................................................................................ 83
Report: SSL Certificate Errors................................................................................................ 84
User Behavior Reports............................................................................................................... 85
Web Browsing per Category .................................................................................................. 85
Report: Web Browsing per Day.............................................................................................. 86
Report: Web Browsing per Day of Week ............................................................................... 88
Report: Web Browsing per Group .......................................................................................... 90
Report: Web Browsing per Hour of Day................................................................................. 91
Report: Web Browsing per Month .......................................................................................... 92
Report: Web Browsing per Site .............................................................................................. 93
Report: Web Browsing per User............................................................................................. 94
Report: Web Browsing per User and Category...................................................................... 95
Report Management...................................................................................................................... 97
Tasks on the Reports Tab.......................................................................................................... 97
Adding a New Report Group...................................................................................................... 98
Changing Databases ................................................................................................................. 99
Applying a Filter to a Report .................................................................................................... 100
Changing Report Attributes...................................................................................................... 104
Managing Reports.................................................................................................................... 107
E-mailing Reports to Another Person................................................................................... 107
iv
Table of Contents
Archiving a Report................................................................................................................ 107

Downloading a Report.......................................................................................................... 108
Scheduling a Report to Generate......................................................................................... 109
Creating New Reports.............................................................................................................. 112
Saving Reports ........................................................................................................................ 116
v
About This PDF Document
This document is a PDF version of the entire Reporter 9.1.x Online Help System. Because it
contains every topic, including administrative tasks, it is not intended for distribution to non-admin
Reporter users. Reporter Administrators might want to read this document as a knowledge base
or print it as a backup hardcopy.
1
How Do I...? (Administrator Tasks)
The following table provides cross-reference links in response to anticipated common Reporter
administrator tasks.
Task Category How do I...? See...
Database- I want to understand what About Databases

Related a database is.
How do I create a new Creating New

database and assign a log Access Log
source to it? Databases
I have an existing Creating New

database and I want to Database Log
add new log sources. Sources
Can I temporarily stop log Managing Existing

processing for a specific Database Profiles
log source? (Changing Existing
Database/Log
Source Parameters
section)
User-Related How do I create a new • About Creating

Administrative user? New Users
• Creating Admin
and Standard
Users
I want to create a new • About Creating

user who only has access New Users
to specific database fields.
• Creating User
Roles
• Creating Admin
and Standard
Users
Is it possible to configure • About Creating

Reporter to use our New Users
deployed LDAP servers
• Applying LDAP
for authenticated sign-on
Authentication
based on LDAP groups?
to Roles
Report-related How do I change the Managing Existing

default values that Database Profiles
3
Reporter uses to estimate (Changing Default

costs (bytes and time)? Cost Calculators
section)
How do I change how Managing Existing

rows display by default in Database Profiles
all pre-defined reports? (Changing Default
Report Row Limits
section)
Application- Where can I see which Viewing System

related version of Reporter is Diagnostics
running on the system?
Where do I enter the Managing the

Enterprise license that I Reporter License
purchased from Blue
Coat?
Is it possible to secure the Managing Reporter

HTTP connection between Server Connections
the Reporter server and
the Reporter user
interface?
I want Reporter to be able Connecting Reporter

to e-mail alerts. Where do to Mail Servers
I configure Reporter to
communicate with my
SMTP server?
I will be enabling LDAP Connecting Reporter

authentication for my to External
Reporter users. Where do Authentication
I configure Reporter to Servers
connect to my LDAP
databases?
How do I change which Changing the

language the Management Reporter Language
Console uses?
Troubleshooting Blue Coat wants me to Uploading System

enter a service request Diagnostics to Blue
(SR) number and upload Coat
Reporter diagnostics. How
do I do that?
How can I review Viewing System

Reporter's resource Diagnostics
consumption?
4
Admin How Do I
Is there a way to monitor Reviewing Reporter

event messages Event Logs
generated by Reporter?
5
How Do I...?
The following table provides cross-reference links in response to anticipated common Reporter
user tasks.
Component How do I...? See...
Dashboard What do the Dashboard About the Dashboard

reports represent?
What other reports are Adding Reports to the Dashboard

available on the Dashboard
and how do I add them?
Can I change the pie chart to Changing Report Attributes

another chart type?
I want to remove the charts in About the Dashboard

Dashboard reports.
I want to remove the grids in Changing Report Attributes

Dashboard reports and only
display graphs.
How do I drill down a Expanding Dashboard Reports

Dashboard report to see more
specific data?
How do I delete reports I am Deleting a Report from the

not interested in from the Dashboard
Dashboard?
Generated Reports How do I view detailed report About Overview Reports

data?
How do I change to another Changing Databases

database to which I have
access?
I want to add a new report Adding a New Report Group

group to the Reports tab.
How do I search reports for a Searching Reports

specific string or value?
7
How do I limit or target report Applying a Filter to a Report

results?
For future reference, I have a Managing Reports (Archiving a

report that I want to archive off Report section)
of my local system.
How do I e-mail a report to Managing Reports (E-mailing

another person in my Reports to Another Person section)
company?
How do I schedule reports to Managing Reports (Scheduling a

generate a specific time? Report to Generate section)
How do I download a report to Managing Reports (Downloading a

my local system? Report section)
General How do I change the password Changing Your Reporter Password

that I use to access Reporter?
How do I change the e-mail Specifying Your Reporter E-mail

address the Reporter uses to Address
send e-mail on my behalf?
8
Personal Settings
Changing Personal Settings
Your Blue Coat Reporter Administrator created a user account for you that includes a default
password. After you log in to Reporter the first time, you can change either the password and also
specify your Reporter e-mail address.
Note: You are not allowed to change your password if you used an LDAP-authenticated
password.
See:
• Changing Your Reporter Password
• Specifying Your Reporter E-mail Address
9
Changing Your Reporter Password

Your Reporter administrator assigned you a Reporter access password. You have the option to
change the password anytime after your initial login.
Note: You are not allowed to change your password if you accessed Reporter using your LDAP
access credentials. If you are unsure about this, contact your network security IT representative.
To change your access password (click to see screenshot):
1. In the upper-right corner of the Reporter interface, click Settings. Reporter displays the
General Settings tab.
2. Select Change Password.
3. Enter your initial password, followed by your new password twice.
4. Click Save.
10
Personal Settings
Specifying Your Reporter E-mail Address

Reporter enables you to e-mail generated reports to other people. The first time you perform this,
action the e-mail address you enter in the From address becomes your default Reporter e-mail
address. You can change it on a per-report e-mailing action basis without changing the default,
but you can also change the default.
To change the default e-mail address (click to see screenshot):
1. In the upper-right corner of the Reporter interface, click Settings. Reporter displays the
General Settings tab.
2. Select Email.
3. Enter the new e-mail address.
4. Click Save.
11
Administration
Database Management
About Databases
In Blue Coat Reporter, a database is a collection of processed access log data from which the
visual reports are generated. In a typical deployment, the Blue Coat ProxySG is configured to
send access logs (raw data) to folders on an FTP server. Reporter is installed either on this same
server or another dedicated Reporter server. The created databases point to the access log
folders, which are called log sources. When a database detects new data in the log source folder,
it processes the log data and populates the data fields that Reporters uses to generate each
report. Reporter users log into the Reporter user interface to view the reports. Click to display a
single-server concept diagram.
As the diagram indicates, a database can have multiple log sources. For example, you might
create one log source for each branch office and process all of the data together. Or you might
create one database for each branch location, but still have multiple ProxySG appliances serving
as Secure Web Gateways.
Note: There is a third Reporter connection method, which is to configure the ProxySG to stream
logs directly to Reporter. Blue Coat does not recommend this for a production deployment
because the access logs are not saved anywhere for archiving or reprocessing. This method is
better suited for demonstrations and trial periods. See the Blue Coat 9.x Initial Configuration
Guide.
Creating a database requires two steps:
1. Creating a database with a name, database expiration setting, and storage location.
2. Assign log sources (folders of raw access log data) to the database. Log sources can
exist on the system or Reporter can FTP them from a staging server.
The database creation process is flexible.
13
• You can assign log sources from the same database creation wizard. If the ProxySG is
already sending raw access log data to the FTP server, the database begins processing
data immediately.
• You can create databases first and assign log sources later. You follow this process if the
ProxySG is not yet configured to send access logs to the FTP server.
Additional Notes
• For this release, Reporter supports only HTTP and HTTPS data.
• Disk I/O might inhibit performance if log source files and databases are stored on the
same disk drive. Small log files and databases will more than likely run smoothly, but
larger systems perform best when databases are log files are separated onto different
drives.
• Processing log files and generating reports is fastest if performed at different times
(report generation can be scheduled).
14
Administration
Creating New Access Log Databases

As described in About Databases, creating a database requires two tasks: specifying database
parameters and assigning access log directories to the database. Options on the General
Settings > Reporter Settings > Data Settings > Databases page enable you to create a
database from which reports are generated.
Before creating databases, Blue Coat recommends planning and recording how databases will
reflect your enterprise. For example, you might create one database for each branch office or one
for each group of users (remember, multiple log sources can feed into a single database).
Database parameters can be altered after they are created, which means you can fine tune them
at any time.
Notes
• The second step in the database creation wizard allows you to assign a log source. If you
do not yet know log source directories or are purposefully delaying adding log files to
databases, skip this wizard step. The following procedure describes creating a database
with a log source.
• This procedure is for standard FTP Upload Client deployments. To configure Reporter to
process logs from the Blue Coat Reporter Client, see the Blue Coat Reporter 9.x Initial
Configuration Guide.
To create a database with a log source:
1. Click New. The Create New Database wizard displays.
2. Name the database (click to view screenshot):
a. In the Database Name field, enter a meaningful name.

b. Click Next to move to the next wizard page: Set Log Sources.
3. Configure Log Source options (click to view screenshot):
15
a. From the Check for new log files every drop-down lists, select the interval that
Reporter checks the log source for unprocessed log files.
b. Click New Log Source. The Create New Log Source wizard displays.
4. Select a source option:
• Local File Source: Select this option if Reporter is installed on the same system
to which the ProxySG is uploading log files.
• FTP Server Source: Select this option if Reporter is installed on a dedicated
system and must retrieve log files from another server.
• ProxySG Upload: This option is available for selection only if one or more
ProxySG appliances are configured to stream log data using the Blue Coat
Reporter Client and the ProxySG has not been assigned to a database. This
deployment type is designed for trial and demonstrations and is not
recommended by Blue Coat for normal production operation. For more
information, see the Blue Coat Reporter 9.x Initial Configuration Guide.
Note: You can assign multiple log sources and log source types to the same database
(see Managing Existing Database Profiles).
Click Next to move to the next wizard page: Set Description.
5. In the Log Source Description field, enter a name that describes the origination of these
log files. Click Next to move to the next wizard page: Set Location.
6. This page is dynamic, based on the log source type.
• For a local source (click to view screenshot):
16
Administration
a. In the Directory Path field, click the folder icon; navigate to the location
of the log files (or paste in the server path).
b. In the File Pattern field, the default value is *. Reporter detects all .log
and .log.gz (compressed) files. You can specify to only search for one
or the other by entering the value. See the Log File Wildcards section
below for more detailed information about this feature.
c. If your log directories contain multiple sub-folders, select Process
Subdirectories.
d. Click Next to move to the next wizard page: Set Post Processing Action.
Proceed to Step 7.
• For an FTP server source (click to view screenshot):
a. Enter the FTP server access credentials: Hostname/IP, Port number, Username, and
Password.
b. Enter the Directory Path to the log files.
c. In the File Pattern field, the default value is *. Reporter detects all .log and .log.gz
(compressed) files. You can specify to only search for one or the other by entering the value. See
the Log File Wildcards section below for more detailed information about this feature.
d. Click Done. This closes the Create New Log Source Wizard and returns you to the
Create New Database wizard. Skip to Step 8.
17
6. Specify post-processing action (local sources only):

a. Select an option:
• Rename: Append '.done' to filename: After Reporter processes a log
file, it adds .done to the existing .log or .gz suffix. When you browse
the directories with a file viewer, this is how you know when files have
been processed. Note: If you delete the .done suffix, Reporter
reprocesses the log file.
• Move to folder: After Reporter processes a log file, the file moves to the
specified directory (or subdirectory tree if Process Subdirectories was
selected in Step 6c. Should you ever require a reprocessing of log files,
you can copy the files back to the directory.
• Delete log file: After Reporter processes a log file, the file is deleted.
Select this option if you are certain you will never have the need to
process those log files again.
b. Click Done. This closes the Create New Log Source Wizard and returns you to the
Create New Database wizard.
7. Repeat Steps 3 through 7 to add another log source, or click Next to move to the next
wizard page: Set Expiration.
8. Specify when, if ever, database data automatically expires. Expiring data reduces the
amount of processed log data, which reduces the size of the database on the disk. In addition to
preventing disk threshold alerts (Configuring Reporter to Send Alerts), this might be required if
multiple databases cannot load at the same time or if additional log processing is not possible
because of limitations imposed by the currently installed license.
• To never automatically expire a database, clear the Expire database data older
than option. Reporter continues to display report data for all dates.
• To force Reporter to stop generating report data for dates beyond a specified
time frame, select Expire database data older than, specify when data expires,
and select the Frequency (when Reporter checks the database). For example, if
the database contains log files processed with March 1st as the earliest date, the
setting is 30 days, and the current date is April 1st, Reporter no longer generates
and displays report data for March 1st (Reporter deletes the data from the
database).
Click Next to move to the next wizard page: Set Directory.
10. By default, Reporter stores each database in a folder called databases, which is located
in the Reporter directory on the system. For example: Program Files/Blue Coat
Reporter 9/databases in Windows and /opt/bc/reporter/databases in Linux.
• To accept the default, click Done.
• Databases can grow to be quite large and you might elect to direct your database
to a larger disk. Also, if you store your database on a faster hard drive, you
should notice a better performance from Reporter. To specify an alternate
location, click folder icon and navigate to a new location. Click Done.
The new database displays. If you have specified log file sources and those sources contain log
files, the Reporter begins processing the data and populating the database. You can now click
View Reports (upper-right corner of the Management Console).
Log File Wildcards
This section describes the wildcard rules that are valid for Reporter 9.x log file searches.
18
Administration
• Unlike previous Reporter versions, only log sources only process files that end in .log or
.log.gz.
• Because .log and .log.gz are automatically appended by Reporter, you can only
allowed to configure the file name prefix.
• Wild cards consist of * and ?
• Any log files that end in .done are ignored and never processed.
By default, the Reporter configuration provides * for the default prefix search:
*.log and *.log.gz
EXAMPLES
If the name of the log file sent by the ProxySG is SG_Log101.log.gz, then:
matches (because file name on disk begins with SG and * allows for
SG*
zero or more subsequent chars)
matches (zero chars before SG allowed, existing SG matches, and

*SG*
zero or more chars after SG allowed)
matches (begins with SG and there are at least three (3) existing
SG_*???
prefix characters after the _)
?SG* does not match (there is no existing char before SG)
SG_?*?*?*?*?*?*?* does match (there are not seven (7) existing chars after the _)
S?_?o?1?1 matches (each characcter accounted for)
matches (caseless compare and zero more allowed after last

sg_log101*
matching character)
sg_log101? does not match (no existing character to match)
Note: To change the default location of where the database files are stored, see Managing Data
Directories.
19
Creating New Database Log Sources

Options on the General Settings > Reporter Settings > Data Settings > Log Sources page
allow you to add directories that contain log files to an existing databases. If you have not added
log sources to your databases, this is required to generate reports (see About Databases). This
procedure also allows you to add additional log sources to databases. On the General Settings
> Reporter Settings > Data Settings > Log Sources page, if you see a database that lists No
Log Source in the Log Sources column, you must add a new log source.
To add new or additional log sources to a database:
1. Click New. The Create New Log Source wizard displays.
2. Select a source option:
• Local File Source: Select this option if Reporter is installed on the same system
to which the ProxySG is uploading log files.
• FTP Server Source: Select this option if Reporter is installed on a dedicated
system and must retrieve log files from another server.
• ProxySG: This option only displays if one or more ProxySG appliances are
configured to stream log data using the Blue Coat Reporter Client and the
ProxySG has not been assigned to a database. This deployment type is
designed for trial and demonstrations and is not recommended by Blue Coat for
normal production operation. For more information, see the Blue Coat Reporter
9.x Initial Configuration Guide.
Click Next to move to the next wizard page: Set Description.
3. Name the log source (click to view screenshot):
a. In the Log Source Description field, enter a name that describes the origination
of these log files.
b. Click Next to move to the next wizard page: Set Database.
4. Select a database (click to view screenshot):
20
Administration
a. From the Database drop-down list, select an existing database to which Reporter
assigns this log source.
b. Click Next to move to the next wizard page: Set Location.
5. This page is dynamic, based on the log source type.
• For a local source (click to view screenshot):
a. In the Directory Path field, click the folder icon; navigate to the location
of the log files.
b. In the File Pattern field, the default value is *. Reporter detects all .log
and .gz (compressed) files. You can specify to only search for one or
the other by entering the value.
c. If your log directories contain multiple sub-folders, select Process
Subdirectories.
d. Click Next to move to the next wizard page: Set Post Processing Action.
Proceed to Step 6.
• For an FTP server source (click to view screenshot):
21
a. Enter the FTP server access credentials: Hostname/IP, Port number, Username, and
Password.
b. Enter the Directory Path to the log files.
c. In the File Pattern field, the default value is *. Reporter detects all .log and .gz
(compressed) files. You can specify to only search for one or the other by entering the value.
d. Click Done. This closes the Create New Log Source Wizard and returns you to the
Create New Database wizard; this procedure is complete. If you navigate to the General
Settings > Reporter Settings > Data Settings > Databases page, the selected database now
points to the log source.
6. Specify post-processing action (local sources only):
a. Select an option:
• Rename: Append '.done' to filename: After Reporter processes a log
file, it adds .done to the existing .log or .gz suffix. When you browse
the directories with a file viewer, this is how you know when files have
been processed. Note: If you delete the .done suffix, Reporter
reprocesses the log file.
• Move to folder: After Reporter processes a log file, the file moves to the
specified directory. Should you ever require a reprocessing of log files,
you can copy the files back to the directory.
• Delete log file: After Reporter processes a log file, the file is deleted.
Select this option if you are certain you will never have the need to
process those log files again.
b. Click Done. This add the new log source to the selected database. If you
navigate to the General Settings > Reporter Settings > Data Settings >
Databases page, the selected database now points to the log source.
22
Administration
Managing Existing Databases

After you create databases and assign log sources, you might have a requirement to alter
database parameters, change some default values, halt processing actions, or delete obsolete
databases.
Changing Existing Database/Log Source Parameters
When you created databases and assigned log file sources, you followed steps in a wizard. For
any database, you can access each of those wizard pages individually and change a parameter.
Database:
• Database name
• Log sources
• Database data expiration
Log Source:
• Description (name)
• Folder location
• Post-processing actions
Notes
• For the Blue Coat Reporter Client, you can only change the source ProxySG.
• Changing log source options requires halting the log source processing.
To change a parameter related to a local or FTP database:
1. Select General Settings > Reporter Settings > Data Settings > Databases.
2. In the row of the database to change, select the drop-down list in the Actions column (
click to see screenshot).
3. Select an option to change:

• Set Name -- Change the name of the database.
• Set Log Sources -- Add or delete the location of folders that feed log data into
the database.
23
• Set Expiration -- Change the expiration time frame of access log data.
Note: For more detailed descriptions of these options, see Creating New Access Log
Databases.
4. Change the parameter.
5. Click Save.
Note: Clicking Reset reverts the parameters to their previously saved values.
To change a log source parameter:
1. Select General Settings > Reporter Settings > Data Settings > Log Sources..
2. You cannot change log source parameters while the log source is operating (click to view
screenshot):
a. In the row of the log source to change, select the drop-down list in the Actions
column.
b. Select Stop Log Source. Notice that the status column displays unloaded. If the
log source is processing a log file when you select Stop Log Source or unload
its database, it immediately stops processing the current log file. If you later
reload the database or restart the log source, the log source locates the
unfinished log file and completes its processing first, then resumes normal
operation.
3. Re-select the drop-down list in the Actions column and select an option to change:
• Set Description -- Change the description of the log source.
• Set Location for Local/FTP File Source -- Change the location of this specific
log source.
• Set Processing Action -- Change what happens to log files after Reporter
processes them.
Note: For more detailed descriptions of these options, see Creating New Database Log
Sources.
4. Click Save.
Note: Clicking Reset reverts the parameters to their previously saved values.
5. Select the drop-down list in the Actions column again and select Start Log Source.
Reporter beings processing logs from the new or additional locations.
Changing Default Cost Calculators
24
Administration
In some reports, Reporter displays data that estimates how much user browsing activity
translates to costs. By default, Reporter estimates the costs at .1 United States dollar per MB and
20 United States dollars per hour. If you do believe that these values accurately represent your
enterprise costs, you can change the calculation rates. For localization, you can also change the
type of currency.
To change the default cost calculators:
2. In the row of the database to change, select Set Other Options from the drop-down list
in the Actions column. The Set Other Options for Name Database displays.
3. In the Cost Calculations area, alter options, as required (click to view screenshot):
a. From the Currency drop-down list, select the monetary value for your country.
b. Cost per MB field: Reporter uses this value to calculate the cost based on the
amount of downloaded content by each user.
c. Cost per Hour field: Reporter uses this value and estimated user browse time to
calculate how money each user cost the company.
4. Click Save.
Clicking Reset reverts the values to their previously saved values.
Changing Default Report Row Limits
Reporter enables users to e-mail reports to others, download reports to local systems, and store
archived versions on the Reporter server. In some enterprises, access log databases can grow
very large, which means performing any of the aforementioned actions can clog exceed system
capabilities and storage capacities. You can impose limits on how much of a report is sent or
stored.
To impose report generation limits:
2. In the row of the database to change, select Set Other Options from the drop-down list
in the Actions column. The Set Other Options for Name Database displays (click to view
screenshot).
25
3. In the Report Generation Limits, alter options, as required.

4. Click Save.
Clicking Reset reverts the values to their previously saved values.
Unloading Databases to Conserve Resources
Unloading the database takes it offline. You might encounter a scenario where a database is not
currently necessary, but you are not ready to completely remove it from the system because it
might be required at a later time. You cannot view reports for this database (and scheduled
events for that database will not run) while it is unloaded.
To unload a database:
2. In the row of the database to change, select Unload Database from the drop-down list in
the Actions column (click to view screenshot).
The Status column changes from Loaded to Unloaded (depending on the size of the
database, this process might require several minutes to complete)
To reload the database, repeat the procedure and select Load Database (if the database is
currently unloading, this option is not available).
26
Administration
Deleting Databases
If you are certain you will no longer require a database, delete it from the Reporter server.
To delete a database:
2. In the row of the database to change, select Deletefrom the drop-down list in the Actions
column.
27
User Management
About Creating New Users
The Blue Coat Reporter installation process creates a default administrator user, which allows the
installer (presumably a network administrator) access to the Reporter user interface.
There are three types of Reporter users:
• Default Administrator: This is the Reporter administrator account that is created when
Reporter is installed. The default administrator has access to all Reporter functions,
including administration options and all reports. This user can be deleted by another
administrator, but a user cannot delete themselves, and the last administrator on the
system cannot be deleted.
• Administrator: The default administrator can create additional administrator users. Like
the default administrator, these users have access to all Reporter functions, including
administration options and all reports.
• User: A standard user who logs into reporter has access to the report databases to which
they are assigned. Standard users do not have access to the Administration link, but
they can change their Reporter access password and e-mail identity.
Warning: Be advised that administrator identification information is stored on a configuration file
in the Blue Coat Reporter directory. Take care to protect this file from access by unauthorized
users.
Only users with administrative credentials can create users and define access control parameters
for those users. Defining user access control requires up to three steps:
a. Create a role within the enterprise (for example Human Resources, Information
Technology) and assign log fields to that role. See Creating User Roles.
b. Create a user account, specify access credentials, and assign the user to a role. See
Creating Admin and Standard Users.
c. (Optional) Assign an Lightweight Directory Access Protocol (LDAP) group to a role, which
allows you to assign LDAP groups to specific Reporter roles. See Applying LDAP
Authentication to Roles.
Note: To specify how long user connections to remain before timing out, see Managing Reporter
Server Connections.
28
Administration
Creating User Roles

Blue Coat Reporter allows you to restrict user access to all but the reports they require for their
positions within the enterprise. In Reporter, a role is defined by access permissions. The options
on the General Settings > Access Control > Roles page allow you to create roles to which non-
admin users are assigned. These permissions can be as broad as access to an entire database
or as granular as access to specific data fields within generated reports.
Defining user roles requires planning. Before creating roles, Blue Coat recommends creating a
list of roles within your enterprise and a list of users who requires access to specific report data.
For example, if you have an IT person who is dedicated to managing network intrusion
prevention, you can create a Reporter role that generates reports based only on malware-related
fields in the database. The Blue Coat Reporter 9.x Administrator's Guide provides more details,
suggested fields based on role-type, and example planning tables.
To create roles for Reporter user access:
1. On the Administration > General Settings page, select Access Control > Roles.
2. Click New. The Create New Role wizard displays.
3. Define the role (click to view screenshot):
a. In the Role Name field, enter a name for the role; the more specific the name,
the easier it will be to assign your users to their correct roles. Click Next to move
to the next page of the wizard: Permissions.
b. Select the databases that users in this role can access.
29
c. By default, the role has access to all database fields. To limit the fields that
reports in this role display, clear the unnecessary field options (or select No
Fields to clear all options, then select the required options).
d. (Optional) To further limit report data, apply a filter to the role. For example, you
want a role that is limited to report data indicating which users experienced
content filtering and policy denials.
e. Click Done. The new role displays on the Roles page.
4. Add users to the roles. See Creating Admin and Standard Users.
30
Administration
Creating Administrator and Standard Users

Any Reporter user who has administrative credentials can create new administrative and
standard users. For optimal security, Blue Coat strongly recommends limiting the number of
users who have administrative credentials.
You can create new administrator users and standard users anytime. Typically, creating standard
users follows the creation of roles because during the user creation process, you are able to
assign users to existing roles. See Creating User Roles. However, you can create users and
return another time set their access permissions.
To create a new user:
1. On the Administration > General Settings page, select Access Control > Local
Users.
2. Click New. The Create New User wizard displays.
3. Define the user properties (click to view screenshot).
a. In the Username field, enter the name the user enters to access Reporter. If you
have a planning sheet with names, be sure to enter them exactly as printed. Click
Next to move to the next page: Set Password.
31
b. In the New Password field, enter the access credential password for this user;
repeat in the Validate Password field. Again, if you are following a planning
sheet, enter the password exactly as printed. If you are creating the passwords,
record them accurately. Click Next to move to the next page: Set Permissions.
c. Select the user type:
• Administrator: User has full access to Reporter and all roles.
• User: User has limited access to Reporter. If you select this option,
select the role(s) to which this user belongs.
d. Click Done. The new user displays on the Local Users page (click to view
screenshot).
Created users can now access Reporter when you give them the network address to the
Reporter server.
If you have LDAP directories and want Reporter to link to an LDAP database, continue to
Applying LDAP Authentication to Roles
32
Administration
Applying LDAP Authentication to Roles

If your enterprise uses Lightweight Directory Access Protocol (LDAP) compatible database, you
can assign LDAP groups to specific Reporter roles. This allows the security network administrator
to maintain a single-source authentication directory. For example, if the LDAP database has a
user group named HR, you assign the HR LDAP group to the HR role you created in Reporter
(see Creating User Roles). When a user from the HR group enters their username and password
into Reporter, they are authenticated and allowed access to the reports you assigned to that role.
Prerequisite: You must configure Reporter to communicate with your LDAP servers. See
Connecting Reporter to External Authentication Servers.
To assign an LDAP directory group to a role:
1. On the Administration > General Settings page, select Access Control > LDAP
Groups.
2. Click New. The Create New Item wizard displays.
3. Reporter detects the present LDAP groups. Select a group and click Next to move to the
next wizard screen: Set Permissions.
4. Select an option (click to view screenshot):
• Select LDAP Group and select the roles to which this group has access.
• Select Administrator to give this group full access to Reporter.
5. Click Done. The new group displays on the LDAP Groups page.
33
Reporter Application Management

Managing the Reporter License
You can operate Reporter without a license. This is called Standard Mode or Standard License,
which is the default mode. However, Standard Mode enforces a hard limit on how log lines
Reporter can process. Furthermore, Standard Mode is limited to 32-bit systems.
You can purchase an Enterprise or Premium Reporter license from Blue Coat. Refer to the Blue
Coat Reporter 9.x Release Notes for the most current list of Reporter license types and limits
(Reporter also displays the current license type and log-line limit under the license field). If you
run Reporter in Standard Mode and reach the log line limit, the event log begins logging errors for
each line over the limit that is processed.
The Reporter installation process provided an opportunity to enter in a license. If a purchased a
license but did not enter it during the installation or are upgrading the license, the General
Settings > About/Licensing page provides a field to enter the key.
34
Administration
Managing Reporter Server Connections

The General Settings > Systems Settings > Server Settings page allows you to customize
Blue Coat Reporter network connections.
Notes
• Reporter users cannot e-mail reports or schedule an e-mail event until these settings are
configured.
• If you make any changes to these settings, you must restart Reporter for them to take
effect.
Changing Web Server Settings
The options in the Web Server Settings area enable you to configure Web connections
(HTTP/HTTPS) for browsers.
Specifying Browser Access Options
The IP and Port options in the Web Server Settings are for browser access configuration. The
host where Reporter is running might have multiple IP addresses assigned to it, especially if it
has multiple network interface cards and communicates (or routes) on multiple networks. You can
limit Reporter's Web server to only accept browser connections from the host console
(127.0.0.1), a single network, or all networks configured on the host. The port number can be
modified If your enterprise firewall deployment requires Reporter to communicate over a different
port, change the default port value (8081).
To restrict Reporter to a specific listening IP address (click to view screenshot):
35
1. From the IP drop-down list, select the IP address or network to which Reporter listens.
2. (Optional) Specify in an alternate port in the Port field.
3. Click Save.
Securing the Transport Protocol
By default, Reporter communicates with the Web server through the HTTP protocol. For
increased security, you have the option to configure Reporter to use HTTPS as the transport
protocol. In the Protocol area, you must either accept the default certificate or specify a location
that a signed server certificate and private key (2048 byte key). Consult with your security
administrator concerning the creation of these.
The default certificate is a Reporter generated self-signed test certificate. Most browsers correctly
warn you to avoid using self-signed certificates. The default certificate is configured with the hosts
IP address. If you ever change your host IP address, you will also need to generate a new default
certificate to prevent browsers from rejecting the improper default certificate. This is
accomplished by changing the host IP address (using the host's configuration tools), then
configuring Reporter to use HTTP and restarting Reporter (to remove the old default certificate),
configuring back to HTTPS and restarting again (to create the new default certificate).
Note: For instructions on how to create a certificate, including a demonstration certificate, see the
Blue Coat Reporter 9.x Administrator's Guide.
To configure HTTPS with the default certificate (click to view screenshot):
36
Administration
1. In the Protocol area, select HTTPS. The area expands to displays certificate options.
2. Select Use default certificate.
3. Click Save.
4. You must restart Reporter. See Shutting Down or Restarting Reporter.
To configure HTTPS with a selected certificate (click to view screenshot):
1. In the Protocol area, select HTTPS. The area expands to displays certificate options.
2. Select Enter Certificate; the Server Certificate and Private Key fields become active.
3. Click the folder icons to navigate to their stored locations and select them.
4. (Optional, recommended) Click Test Certificate and Key to test their validities. If the test
fails, work with your security administrator to create valid files.
5. Click Save.
6. You must restart Reporter. See Shutting Down or Restarting Reporter.
Specifying How Long Reporter Users Remain Connected
37
By default, the Reporter Management Console remains indefinitely connected for all users. For
more security control, you can set a time value after which the Management Console
disconnects, which forces users to re-log in with their access credentials.
To change the time out value, slide the adjust bar and click Save.
Changing the Direct Reporter Connection Port
The options in the Direct ProxySG Port area apply if the Blue Coat ProxySG is configured to use
the Blue Coat Reporter Client to communicate with Reporter, which acts as a server. As a
server, Reporter is configured to accept connections and data from the client (ProxySG). Both the
client and Reporter must be configured to use the same port.
38
Administration
Connecting Reporter to Mail Servers

The options on the General Settings > System Settings > External Servers > Email page
allow you to specify which primary and backup SMTP servers that Reporter connects to when
sending e-mails.
To configure these options, you must know:
• The IP address of the primary and backup SMTP servers.
• The authentication credentials to these servers.
To connect Reporter to a mail server (click to view screenshot):
1. In the Server field, enter the IP address or valid hostname of the SMTP server (must be
able to connect).
2. In the Form field, enter the e-mail address that the recipient sees as the sender of the
message.
3. In the Username field, enter an account name that the SMTP server accepts.
4. In the Password and Verify Password fields, enter the authentication challenge
password that the SMTP server accepts.
5. Specifying a backup SMTP server connection is optional, but recommended by Blue
Coat. Enter the server IP address and authentication credentials.
39
40
Administration
Connecting Reporter to External Authentication Servers

The options on the General Settings > System Settings > External Servers > LDAP/Directory
page allow you to specify the Lightweight Directory Access Protocol (LDAP) that Reporter uses to
authenticate users.
Reporter supports Microsoft Active Directory and Novell eDirectory, with pre-configured settings.
You can also create your a custom LDAP server connection.
To configure these options, you must know:
• The IP address of the primary LDAP server (secondary optional, but recommended).
• LDAP searching access credentials (if required).
• Naming attributes.
• Base DN information.
To configure Reporter to connect to an LDAP server:
1. Select General Settings > System Settings > External Servers > LDAP/Directory.
The Create New LDAP Realm.
2. Select the LDAP directory system that your enterprise employs:
• Microsoft Active Directory
• Novell eDirectory
• Other LDAP
Click Next to move to the next wizard screen: Set Name.
3. In the Realm Name field, enter the realm that contains the list of users who will have
access to the roles. By default, Reporter allows disconnected logins, which means that
users are able to connect to Reporter when their systems (laptops are most common) are
not able to connect to LDAP servers. For the highest security level, clear the Allow
Disconnected Login option. Click Next to move to the next wizard screen: Set Servers.
4. Enter server information (click to view screenshot):
a. In the Host field under Primary Server, enter the IP address or hostname of the
main LDAP server.
41
b. (Optional) In the Host field under Secondary Server, enter the IP address or
hostname of a backup LDAP server, which takes over should the primary server
become unavailable.
c. For either server, you have the option to select Use SSL, which secures the
connection from the Reporter server to the LDAP server. If you select Use SSL,
notice that the default port changes from 389 to 636.
Click Next to move to the next wizard screen: Set Search Credentials.
5. Specify whether user credentials are required to search the LDAP directory (click to view
screenshot):
• No Credentials Required: The LDAP server does not require a password for
search access.
• Use Credentials: Selecting this displays more fields. Enter the Fully Qualified
Domain Name (FQDN) of the LDAP server and the password required for search
access.
Click Next to move to the next wizard screen: Set Naming Attributes.
6. Verify or enter the user attribute:
• If you selected Microsoft Active Directory or Novell eDirectory, Reporter
populates the naming attributes with default LDAP realm values. If your realm
information differs, enter the correct attributes. Otherwise, click Next to display
the next wizard screen: Set Base DNs.
• If you selected Other LDAP, you must enter the naming conventions that match
your custom LDAP configuration, then click Next to display the next wizard
screen: Set Base DNs.
7. Enter all User Base DNs and Group Base DNs that are searchable (click to view
screenshot). Click the + button to add more lines.
42
Administration
Click Next to move to the next wizard screen: Test Connection.

8. Testing the LDAP server connection is optional but recommended to verify functionality
before entering into production. Click Test LDAP Settings. If any errors occur, click
Previous to return to the problematic setting screen and correct the information.
When the test succeeds, click Done.
You can now add LDAP groups to your user roles.
43
Sending Resource Alert E-mails

The options on the General Settings > Systems Settings > Alerts page allow you to configure
Reporter to send an alert e-mail to specified recipients when report processing on a Reporter
system (server or user) breaches a system resource threshold setting. Reporter monitors the
following resources:
• Disk Storage: The current amount of filled disk space (GBs) and total capacity on the
system.
• Virtual Memory: The current amount of MBs used by virtual memory and total capacity of
the Reporter process.
Use this data to adjust system resources. For example, if the same system consistently sends
disk space alert messages, either increase the disk space of that system or re-assign it a smaller
database profile to process.
Note: Reporter cannot monitor disks it is not installed on. For example, you might have
configured Reporter to create a database on a different disk.
Prerequisite: Configure Reporter to connect to one of your enterprise's SMTP (mail) servers.
See Connecting Reporter to Mail Servers.
To configure Reporter to send alerts:
1. Specify the contact settings (click to view screenshot):
a. Enter the e-mail addresses of the alert recipients. Typically, this is an IT member
who is responsible for managing Reporter and/or network efficiency.
b. By default, Reporter sends notifications when either the Warning or Critical
thresholds are breached. You have the option to clear one or both (clear both
prevents any notification).
c. (Optional, recommended) To verify that Reporter sends notifications to the
correct addresses, click Test Alert Email.
d. When you verify the recipients received the test message, click Save.
Note: If there is a problem check the setting on the General Settings > Reporter
Settings > System Settings > External Servers > Email page.
2. Set the Warning and Critical thresholds that trigger the e-mails that are sent to the
recipients (click to view screenshot):
44
Administration
a. Review any current use and capacity levels (revisit this at any time to monitor
resource status).
b. Move the sliders to set the Warning and Critical threshold values.
c. (Optional) Setting a value to Never eliminates threshold checks.
d. Click Save.
45
Viewing Reporter Tasks That Are Currently Scheduled to Run

User have the ability to schedule various report tasks, such as setting specific generation times.
The System Overview > Reporter System Information > Scheduled Tasks page displays
pending tasks. This page also displays failed tasks, which allows you to monitor task efficiency.
You also have the ability to alter tasks.
Click to view screenshot.
Each column provides identification information.

a -- The Run Status field indicates upcoming scheduled tasks (Not Run). If the status is failed,
there was a problem with the report generation task. Notify the person listed in the User field so
they can investigate and re-configure the task.
b -- The Frequency field indicates how often this task is scheduled to perform.
c -- The Actions drop-down list enables you to alter the parameter of any task. If a task failed,
you might able to assist the user and troubleshoot the task settings.
46
Administration
Managing Data Directories

Reporter maintains data directories for created databases, journal files, and archived reports. By
default, these folders are located on the drive or mountpoint where Reporter is installed:
Windows: Program Files / Blue Coat Reporter 9/
Linux: /opt/bc/reporter
Directories:
• databases -- all created databases (General Settings > Reporter Settings > Data
Settings > Databases)
• journal -- all existing event log sessions (System Overview > Reporter System
Information > System Event Log).
• archive -- all reports that are currently archived on the Reporter server (any report, click
Archive).
The General Settings > System Settings > Directories page enables you to change the default
storage locations for any of these folders. Click any folder icon to navigate and select a new
location.
47
Viewing Archived Reports Currently Residing on the Reporter

Server
The System Overview > Reporter System Information > Archived Reports page displays any
report that has been archived by a user. Every report page contains an Archive button, enabling
Reporter users to save the file on the Reporter server. As a Reporter Administrator, you are
allowed to see who created the report, what database generated the reports, the format of the
report, and the creation date. You can also view the reports and delete reports from the archive. If
the archive list becomes too large, check with your users as to the requirement or justification to
keep the reports archived.
From the Actions drop-down list, select:

• View Report to display the archived report. The Format field indicates what applications
displays the report.
• Delete to removed the report from the archive.
48
Administration
Diagnostics/Troubleshooting
Uploading System Diagnostics to Blue Coat
If you call Blue Coat Technical Support to report a serious issue with Reporter, you might be
assigned a Service Request (SR) number by the Blue Coat support person, asked to enter that
number, and upload system diagnostics. The SR Number field is located on the System
Overview > System Diagnostics page. When you enter the number and click Upload, Reporter
sends comprehensive diagnostic data to Blue Coat for problem analysis.
Note: Reporter creates a .zip file named reporterdiags, which contains the diagnostic
information, and saves it on the system in the root Reporter 9 folder on the Reporter system. If
you cannot access the Upload function in the Reporter Management Console, forward this file in
an e-mail to you support representative.
49
Viewing System Diagnostics

Blue Coat Reporter system diagnostics on the System Overview > System Diagnostics page
provide an overview of your Reporter system information and resource consumption. This page
also provides a mechanism to upload diagnostic data to Blue Coat Technical Support should the
need arise.
The page contains three sections (click each heading to expand):
System Overview
This area provides system attributes. If you are in communication with Blue Coat Technical
Support, you might be asked to provide some of this information:
• Reporter Version: The current version of Reporter that is installed on the system.
• Build Number: Each version corresponds to a build number.
• Operating System: The current Windows or Linux operating system that is currently
running on the Reporter system.
• Number of CPUs: Reporter supports up to eight (8) CPUs.
• Web Server Port: The Reporter access URL requires a port number. For example:
http://127.0.0.1:8081. To change this port, see Managing Reporter Server
Connections.
• Direct ProxySG Port: If the ProxySG is configured to forward logs by way of the
bcreporter upload client, this is the port that is used.
• SSL: If you configured Reporter to be accessed over a secure connection (HTTPS; see
Managing Reporter Ports), this setting is enabled. For HTTP connections, it is disabled.
For the Upload Diagnostic feature, see the Uploading Diagnostics to Blue Coat section below.
System Resources
This area displays how much system resource that Reporter is currently consuming. If the Used
levels consistently approach the Capacity levels, you might consider consulting the Blue Coat
Reporter Sizing Guide. You might require a larger system for your processing load.
Database Overview
This table contains links to view log processing and the log source history pages
50
Administration
Reviewing Reporter Event Logs

In Blue Coat Reporter, an event log is a record of all Reporter transactions. These logs are
accessible on the System Overview > Reporter System Information > Event Log page and
reviewing them might assist you with Reporter troubleshooting.
Note: Reporter saves each session event log in the journal folder/directory in the Reporter 9
root folder/directory.
When you select a session event log, Reporter displays the Warnings, Errors, and Critical
levels of transaction data (click to view screenshot).
1 -- Select an even log session.

2 -- In the options header, select which details to display. In the data area, the symbols indicate to
the type of journal entry.
The header displays icons, which enables you customize which types of data are displayed:
• Info: Not selected by default in some modes. This options toggles the most verbose
event log records, as every type of Reporter transaction displays.
• Warnings: A light event that Reporter more often than not can overcome by re-
attempting later. For example, Reporter is not able to contact the SMTP server when
attempting to send an e-mail.
• Errors: Errors are messages indicate something went wrong, possibly resulting in data
loss. Continuing the SMTP example, Reporter reached the maximum retry attempts for a
non-responsive SMTP server. That message is not sent and Reporter logs an error.
• Critical: Critical errors messages should be rare. They occur when a Reporter system
crash is eminent. An example of this type of message is if your databases directory does
not have write permissions, Reporter cannot continue and shuts down. Critical messages
provide valuable information to a support person
Note: To change the default location of where the journal files are stored, see Managing Data
Directories.
51
Shutting Down or Restarting Reporter

The General Settings > Shut Down/Restart page has two options:
• Shut Down Reporter: Halts the Reporter service (bcreporter.exe). Do not shut down
the Reporter server unless you have physical access to the machine. Physical access to
the Reporter server is required to restart the Reporter service.
• Restart Reporter: Stops and restarts the Reporter service (bcreporter.exe). You
must restart reporter when you perform configuration changes that require a restart; for
example, such as changing ports. When these changes require a restart, Reporter
notifies you with a message.
52
The Dashboard
About the Dashboard
The Reporter Dashboard is the first screen that displays when you click the Reports link or log
into Reporter. As the Reporter log sources detect new access logs, the reports automatically
refresh to reflect the current data. Click to display screenshot.
1 -- Your Reporter administrator gave you permissions to one or more databases. Databases
contain the employee access log data from which reports generate. The administrator might
create databases that collect data based on branch office location or employee group. If you have
access to more than one database, you can select another one from the Database drop-down
list.
2 -- Your logged-in name displays in the upper-right corner. If you have access to more than one
role, you can select another role from the drop-down list (Administrator users have access to all
roles).
3 -- The Settings link displays a page that enables you to change your Reporter password and e-
mail address. See:
• Changing Your Reporter Password
• Specifying Your Reporter E-mail Address
4 -- The Search field enables you to search reports for specific strings and values. See Searching
Reports.
5 -- The Dashboard displays various reports. To give you a high-level view of the most recently
processed access logs, each report provides up to the top ten lines of data (highest volume top to
bottom), or displays a graph. Click the Edit link to modify the appearance of these report graphs.
See Changing Report Attributes.
6 -- The Export to PDF button enables you to save the current Dashboard page as a PDF file,
which you can then print or send to someone.
53
7 -- The Add Report button enables you to add another available report to the Dashboard. See
Adding Reports to the Dashboard.
Note: If you do not have permissions to view certain report data types, the Dashboard does
not display data in the group.
8 -- For report groups displaying graphs, you can change the graphic type by selecting one from
the drop-down list.
9 -- Each report group contains a link that displays the report in more detail, including more rows
of data and more data columns. See Expanding Dashboard Reports.
10 -- Clicking the Reports tab displays all of the pre-defined data reports. See Viewing
Generated Reports.
Moving Reports
Reports that display in the Dashboard are movable, allowing you to customize the order. To move
a report, click the header of any report, hold, and move the report to a new location within the
Dashboard. Click to display screenshot.
Note: You can also click the triangle icon to collapse a report.
54
The Dashboard
Adding Reports to the Dashboard

By default, the Dashboard displays several common reports. Other reports are available to add,
which allows you to customize the Dashboard. For example, if your primary concern is to monitor
reports that display network integrity data, add those reports and move non-relevant reports
under them or removed the non-relevant reports from the Dashboard.
To add a report to the Dashboard (click to view screenshot):
1. Click Add Report. A drop-down list displays available categories associated with the
database.
2. Navigate the menus and select a report.
3. (Optional) The report displays at the bottom of the Dashboard (you might have to scroll
down). To create a customized Dashboard, move the report to a new location and/or
delete non-relevant reports.
55
Removing a Report from the Dashboard

You can remove any report from the Dashboard. Removing reports that do not contain
information relevant to your monitoring goals creates more room in the visible area to add other
reports that do interest you.
Note: The report itself is still available and can be re-added.
To remove a report from the Dashboard, click the X button in the upper-right corner of the report.
Click to see screenshot.
56
The Dashboard
Expanding Dashboard Reports

Dashboard reports display high-level data that allows you to quickly scan the status of your
network integrity and employee Web usage. Dashboard reports are also interactive and enable
you to view the full report or view a summary report based on a specific report data point.
Click any section below to expand.
Viewing a Full Report
Each Dashboard report contains a link that opens the fully generated report. From the full report,
you can apply attribute filters, save or download the report, schedule the report, and e-mail the
report.
In any Dashboard report, click the View full report link.
Viewing Summary Reports
57
Each data point in each Dashboard report is a live link. Clicking a link displays a new page with
summary reports that provide overviews of any data associated with the selection. For example,
the Users Behavior report lists the top ten users based upon the total number of page views.
You want more information about the top user, so you click the link.
58
The Dashboard
Reporter displays numerous reports that contain data related to that user. In this example, the
summaries relate to user browsing activities: browsing trends, associated groups, policy verdicts,
actual sites browsed, website categories, and encountered malware.
Note: The number of types of summary reports depend on the selected data point.
To view even more granular summaries, select any data point. For example, you notice a user is
browsing websites categorized as Personals/Dating and want to see a trend information and a
summary list of these sites.
59
Drilling down to various data summaries assists you in determining policies.
60
Reports
Viewing Generated Reports
The Reports tab displays report menus that are grouped by related data. Clicking each report link
generates the current log field data in the database and displays the report. Each pre-defined
report contains a Help (?) button, which displays a description of the report.
Expand the sections below to learn more about each report group.
User Behavior Reports
These reports reflect user Web activity and are most likely to be reviewed by HR personnel or
anyone who is interested in analyzing employee Web surfing trends.
• Report: Blocked Web Browsing Per User
• Report: Web Browsing per Category
• Report: Web Browsing per Day
• Report: Web Browsing per Day of Week
• Report: Web Browsing per Group
• Report: Web Browsing per Hour of Day
• Report: Web Browsing per Month
• Report: Web Browsing per Site
• Report: Web Browsing per User
• Report: Web Browsing per User and Category
Security Reports
These reports provide information related to network integrity, such as authentication incidents
and detected malware, spyware, and virus incidents. Most likely, the audience for these reports is
IT personnel who are responsible protecting the network from outside intrusions.
• Report: Blocked Web Browsing by User Agent
• Report: Blocked Web Sites
• Report: Filtering Verdict Trend by Day
• Report: Malware Requests Blocked by Site
• Report: ProxyAV Malware Detected: Client IP
• Report: ProxyAV Malware Detected: Names
• Report: ProxyAV Malware Detected: Sites
• Report: SSL Certificate Categories
• Report: SSL Certificate Errors
Bandwidth Usage Reports
61
These reports convey network consumption and protocol trends. Most likely, the audience for
these reports is IT personnel who are responsible managing network throughput.
• Report: Bandwidth Cost per User
• Report: Bandwidth Cost per User and Site
• Report: Bandwidth Used per Day
• Report: Bandwidth Used per Day of Week
• Report: Bandwidth Used per Hour of Day
• Report: Bandwidth Used per Month
• Report: Requests per Content Type
• Report: Requests per Protocol
• Report: Web Requests per Client IP
Base Reports
These reports provide basic report templates for you to customize. For example, the Category
link displays every Web page category that was browsed by any user. From that report, you can
customize the report by drilling down on a specific data point or applying filters.
For main access log formats, the reports are grouped as follows:
• First group: Reports related to user Web browser activities,
• Trend Reports: Presents data according to various time frames. This allows you to
analyze trends such as peak Web sue periods.
62
Reports
• Full Log Detail: This report provides a full breakdown of data according to each log field
present in the log files.
The Show Hidden link expands to area to include reports that are not as commonly accessed,
such as
Most Used Reports
This is a dynamic area. Reporter keeps track of how many time that you access each report and
displays the top five in the Most Used Reports group.
Most Recent Reports
This is a dynamic area. Reporter keeps track of the most recent reports that you accessed and
displays the top five in the Most Recent Reports group. The reports are accessible from the
links.
Favorite Reports
This area displays all of the reports that you have tagged as favorites. This allows you to create a
custom area for quick access to the reports you access the most.
To add a report to the Favorite Reports area (click to view screenshot):
63
On the main Reports tab, each report has an Actions link. Click it and select Favorite.
The report displays in the Favorite Reports area (click to view screenshot).
To remove a report as a favorite, click Actions and clear the Favorite Report option. You can do
this from Favorite Reports area or the native area.
Scheduled Reports
If you have configured the scheduler to generate a report at a specific time, that report displays in
this area.
See the Scheduling a Report to Generate section in Managing Reports.
Unfiled Reports
When you save a custom report, that report name displays in the Unfiled Reports area. Click
Actions and select a group for the report.
64
Reports
About Overview Reports

As you browse generated reports, notice that the report criteria values are links. Clicking any link
displays an overview report. Overview reports display more data that is specific to clicked link.
Each overview report varies depending on the architecture of the main report. User behavior
reports might display trend data, while security reports might display group and malware data.
Use Case
On the Blocked Web Browsing per User report, you want to view more data for user
ethan.henry. Clicking that user link displays the Blocked Web Browsing per User Summary
report, which displays more reports, such as Trend of last 7 Days.
65
Searching Databases
The top of each report, including the Dashboard, has a Search field. This enables you to search
all records in the currently selected database for any string or value you enter. For example, if
you are looking for access to a specific site and you know it has the word xxx in the site name,
you can quickly find a link to all the sites with xxx in them.
66
Reports
Bandwidth Usage Reports

Report: Bandwidth Cost per User
The data is this report approximates the cost accrued per user based on total bytes of throughput.
By default, Reporter lists each user, sorted by the total number of gigabytes (GB) of Internet
throughput. Reporter calculates the cost at the rate of 1 consumed MB = $0.01 (one penny in US
currency) and the cost per hour is $20.
Note: The default cost values can be changed by your Blue Coat Reporter administrator. Before
analyzing report data, verify the actual cost amount with the administrator.
Intended audience: IT; persons responsible for monitoring network efficiency.
1 -- Requests: The number of requested Web pages. For example, www.cnn.com. By default,
the displayed graph uses this formulated data.
2 -- Total Bytes: How much Web throughput in gigabytes that the user consumed.
3 -- Costs (Bytes): The estimated cost based on consumed byte volume. By default, the formula
is one cent ($0.01 US) per MB. Verify with your Reporter administrator that this is configured
formula.
Use Case
In an IT role, you are responsible for determining how much to back-bill internet use costs to
various departments. To generate reports per group, you must apply a filter.
1. In the Report Data area, click the Options link (click to view screenshot).
67
2. Click Add Criteria.

3. Create a filter; for example, filter for users in the Engineering group (click to view
screenshot):
a. From the first drop-down list, select Group.

b. From the second drop-down list, select Is.
c. From the third drop-down list, select Engineering (Reporter populates the drop-
down list with all valid group names, based on the database).
d. Click Apply to add the filter.
Reporter re-generates the report with the filtered data, which is all users in the Engineering
group (click to view screenshot).
68
Reports
According to the Total column, you now know that this group accrued $539.78 dollars in
bandwidth use cost.
69
Report: Bandwidth Used per Day

This report lists total byte data for each date processed in the access logs. By default, Reporter
begins with the earliest date.
1 -- Total Bytes: How much Web throughput, in gigabytes, that the user consumed. By default,
the graph uses this formulated data.
2 -- Bytes Received: Inbound bytes to the client.
3 -- Bytes Sent: Outbound bytes sent from the clients.
4 -- Requests: The number of requested Web pages. For example, www.cnn.com.
70
Reports
Report: Bandwidth Used per Hour of Day

This report lists byte data according to each hour of the day for the dates reported in the
processed access logs. For example, every throughput that occurred between 9 AM and 10 AM,
10 AM and 11 AM, and so on. This allows you to analyze which hours are consistently the
heaviest with traffic. By default, Reporter lists each hour, beginning at midnight.
Intended audience: IT; persons responsible for monitoring network efficiency. Network
administrators might use this data to adjust bandwidth policy for peak hours.
71
Report: Requests per Content Type

This report lists byte data separated according to Web content types, such as specific image or
video types. By default, Reporter lists the entries by the total number of HTTP requests.
72
Reports
Report: Web Requests per Client IP

This report lists each client IP address by the number of total requests initiated by the client. This
report is valuable if your enterprise does not report authenticated user names.
Intended audience: IT; persons responsible for maintaining network efficiency.
1 -- Requests: The number of requested Web pages. For example, www.cnn.com.

2 -- Total Bytes: How much Web throughput in gigabytes that the user consumed.
73
Security Reports
Reports: Blocked Web Browsing by User Agent
This report calculates the total of all of the blocked (denied) Web page requests and lists the
totals according to the user agent that was used for the request. By default, Reporter sorts the
data by the number of requests per agent.
Intended audience: IT; anyone persons who are members of the security team and tasked with
searching for rogue user agents (malware installed on desktops)
Use Case
You want to view which types of browsers and other media applications your users are employing
to access Web content. This information might be useful when refining use agent policy on the
ProxySG.
74
Reports
Report: Blocked Web Sites

This report lists the Web sites that users attempted to access but were denied by Web-use
policies. By default, Reporter lists each site ranked by the highest number of requested Web
pages.
Intended audience: IT; persons who are responsible for creating policy that enforces the
company's Web use policies.
Use Case
If you have created and installed policies that block questionable website categories that are not
deemed appropriate for your particular enterprise, you might on occasion generate this report to
review what specific sites are constantly requested by users (and subsequently denied). The
constant presence of specific inappropriate website requests might require a severe coaching
mechanism or other communicated bulletin to the employees. Click to view screenshot.
1 -- Requests: The number of HTTP requests (can be any HTTP object).
75
Report: Filtering Verdict Trend by Day

This report lists the HTTP requests that triggered specific policy verdicts. By default, Reporter
breaks out request totals for each day that the log file(s) contain and categorizes the daily totals
according the verdict name.
Intended audience: IT; persons responsible for monitoring traffic network integrity and security.
76
Reports
Malware Requests Blocked by Site

This report lists all URLs that were blocked because of suspected malware presence. By default,
Reporter lists each URL ranked by the number of times it was requested by clients. When
possible, Reporter lists the Web content category associated with the URL.
Intended audience: IT; persons on the security team.
Use Case
Review this report if malware or other malicious content is discovered on your internal network
and adjust your content category policies to prevent further intrusions.
77
Report: Potential Malware Infected Clients

This report lists all client IP addresses that might be infected by malicious content. This data is
derived by the URLs requested by each client. By default, Reporter lists each IP address, sorted
by the number of requests to possible URLs that are known sources of malware/spyware.
Intended audience: IT; security team members can use this report as a to do list to visit infected
machines and run anti-malware cleaners.
Use Case
You have discovered that user browsing activity is allowing malware to infiltrate your network and
you want to see how many users are responsible. In the following example, one user is
responsible for 33% of the malware invasion. For further analysis, you apply a filter to review the
which sites contained the potential malware . Click to view screenshot.
The filtered report displays the top malware-source sites, ranked by HTTP requests. Click to view
screenshot.
78
Reports
Use this information to adjust your Web content access policies.
79
Report: ProxyAV Malware Detected: Client IP

If your enterprise deployed Blue Coat ProxyAV as the Web anti-virus (AV) platform, this report
lists each instance of malware encountered during employee Web browsing, based on the client
IP address that browsed the URL. By default, Reporter sorts malware listings by the total number
of requests sent to the source website of the virus.
Intended audience: IT; persons responsible for maintaining the Secure Web Gateway.
1 -- Each detected virus/malware filename displays.

2 -- Client IP: The enterprise client that requested the Web content that contained the malware.
3 -- Requests: The number of HTTP requests (can be any HTTP object).
4 -- In this example, multiple clients were exposed to the same malware code.
Note: If your enterprise deployed a non-Blue Coat AV scanning platform, see the following topics.
80
Reports
Report: ProxyAV Malware Detected: Names

lists the name of each malware code encountered during employee Web browsing. By default,
Reporter sorts malware listings by the total number of requests sent to the source website of the
virus.
This report is similar to the Report: ProxyAV Malware Detected: Client IP report, but does not
include user IP addresses.
81
Report: ProxyAV Malware Detected: Site

lists all URLs that were detected as suspected malware sources. By default, Reporter lists each
URL ranked by the number of times it was requested by clients. When possible, Reporter lists the
Web content category associated with the URL.
Use Case
Review this report if malware or other malicious content is discovered on your internal network
and adjust your content category policies to prevent further intrusions.
82
Reports
Report: SSL Certificate Categories

This report lists all detected Certificate Authority (CA) categories and all certificates in each
category that were used to authenticate users. By default, Reporter sorts each certificate
category by the sum of all requests using the certificate(s). Use this information to adjust SSL
certificate category policy on the ProxySG.
83
Report: SSL Certificate Errors

This report lists all detected Certificate Authority (CA) domains and all instances of certificate
errors. This report might indicate a rogue site or application that is not using valid SSL
certificates. By default, Reporter sorts each certificate category by the sum of all requests using
the certificate(s).
84
Reports
User Behavior Reports

Web Browsing per Category
When an employee requests (browses) to a Web site, that site is rated and matched to a
category (for example, news/media, business/economy, mature, and so on). This report lists all of
the Web site categories that were browsed by employees, sorted by the highest Page Views per
category.
Intended audience: IT, HR; persons who are responsible for monitoring Web use compliance
and/or responsible for creating Web use policies (allowing or blocking Web categories).
Use Case
You review the report and notice that the Shopping category results are large, which indicates
that employees are consuming too much time on non work-related websites. The person who
manages Web access policy can adjust the policy or provide a coaching mechanism for
employees. Click to view screenshot.
1 -- Page Views: The number of requested Web pages. For example: www.cnn.com. By default,
the graph displays according to this formulated data.
2 -- Browse Time: Reporter estimates how much total time was spent viewing content in this
category.
85
Report: Web Browsing per Day

This report separates Web browsing activity (page views and page requests) by the dates
reported in the processed access logs. By default, Reporter list each day, beginning with the
earliest day. Click to view screenshot.
2 -- Requests: The total number of additional content--such as Web pages, picture files, sound
files--as requested by the original page. For example,
www.cnn.com/media/flashlive.stream-=stream.4.
Use Case
86
Reports
You notice that one day has what you consider to be a larger than number of page views than
normal.
1. You wonder if there was a particular event or reason and apply the Category filter. Click
to view screenshot.
1 -- Select Drill in and select a filter option; in this example: Category.

2. Reporter displays the category data for the selected date. Because of the many
categories, you switch to the Pie Chart, which is easier to read. In this example, there
was a large spike in business/economy page browsing. Click to view screenshot.
87
Report: Web Browsing per Day of Week

This report separates Web browsing totals (page views and page requests) according to the day
of the week for the dates reported in the processed access logs. For example, every Web page
request that occurred on Mondays, Tuesdays, and so on. Click to view screenshot.
1-- Page views: The number of requested Web pages. For example: www.cnn.com.
files--as requested by the original page. For example:
Use Case
You notice that Web browsing on one day of the week spiked higher than usual.
1. You apply a User filter to that day to see if one or more employees are responsible for
the spike. Click to view screenshot.
88
Reports
1 -- Select Drill in and select a filter option; in this example: User.

2. Reporter displays a bar graph and report data that indicates individual user activity for the
selected day, sorted alphabetically by user first name. In the following example, the Page
Views column was clicked to sort the data by the highest number of requested pages.
User brian.underwater displays as the most active user. Also notice that the bar graph
changes to reflect the new sorting order. Click to view screenshot.
89
Report: Web Browsing per Group

If your enterprise assigns employees to login groups (for example, Engineering, Sales, and so
on), this report totals Web page requests for those groups.
Intended audience: IT; persons who are responsible for monitoring network efficiency.
Use Case
You want to analyze group use data and determine if one or more particular groups requires
additional network resources. In the following example, the Engineering group alone accounted
for approximately 25% of all Web requests. Compare this data against the network resources
allocated to the Engineering group. Click to view screenshot.
category.
90
Reports
Report: Web Browsing per Hour of Day

This report totals Web browsing requests (page views and page requests) according each hour of
the day for the dates reported in the processed access logs. For example, every Web page
request that occurred at 9am, 10am, and so on. This allows you to analyze which hours are
consistently the heaviest with Web requests. Network administrators might use this data to adjust
bandwidth policy.
files--as requested by the original page. For example:
For a similar use case, see Report: Web Browsing per Week.
91
Report: Web Browsing per Month

This report totals Web browsing requests (page views and page requests) according each month
for the dates reported in the processed access logs. For example, every Web page request that
occurred January, February, and so on. This allows you to drill down each month and analyze
trends.
1 -- Page Views: The total number of individual Web pages that were browsed. For example,
www.cnn.com.
2 -- Requests: The number of requests initiated by Web browsing. For example, www.cnn.com
requests content from internal media servers.
92
Reports
Report: Web Browsing per Site

This report displays every URL requested by a user reported in the processed access logs,
sorted by the total number of requested pages.
Intended audience: IT, HR; persons who are interested in viewing exactly which URLs employees
are requesting. Click to view screenshot.
category.
93
Report: Web Browsing per User

This report displays every user reported in the processed access logs who requested Web
content, sorted by the total number of requested pages.
Intended audience: HR; persons who are interested in viewing individual user Web browsing
activity.
Use Case
In reviewing this page, you notice two users--brian.underwater and christpher.lewis--requested

a noticeable higher number of Web pages than other users. Their position within the enterprise
might warrant such activity, but they might also need to be coached on company Web use policy.
category.
94
Reports
Report: Web Browsing per User and Category

This report lists each user and lists each website category from which they requested content. By
default, Reporter ranks the categories within each user module by total page views.
Intended audience: HR; persons who are interested in viewing individual user Web browsing
activity.
1 -- Category: As determined by rating services, the website categories of website content

browsed by the user. For example, www.cnn.com is News/Media.
2 -- Page Views: The total number of individual Web pages that were browsed. For example,
www.cnn.com.
3 -- Browse Time: The estimated amount of time that the user browsed content in this category..
95
Report Management
Tasks on the Reports Tab
The Reports tab displays report groups. Next to each report name is an Actions link. This link
displays various tasks that you can perform for each report. Different reports have different
actions.
1 -- Move to Group: Allows you to move the report from one group to another.
2 -- Favorite Report: Shows this report in your Favorites group. See the Favorite Reports
section on the Viewing Generated Reports page.
3 -- Delete: Deletes this report.
4 -- Archive to Server: Runs this report and saves it on the server as either a PDF or CSV file,
which can then be viewed through the Archived Reports group. See the Archiving a Report
section on the Managing Reports page
5 -- Download: Runs this report as either a PDF or CSV file and then downloads it to the client
for viewing. See the Downloading Reports section on the Managing Reports page
6 -- Schedule: Allows you to schedule the report to run at a certain time or interval. See the
Scheduling a Report to Generate section on the Managing Reports page.
7 -- Email: Runs the report as either PDF or CSV and e-mails the report to someone.
Prerequisite: SMTP must be set up by your Reporter Administrator before this option is available.
See the E-mailing Reports to Another Person section on the Managing Reports page.
8 -- Hide in Group: Hides the report in the group so it is not always displayed.
97
Adding a New Report Group

By default, Blue Coat Reporter display report links in several report groups. Some groups are pre-
populated (such as User Behavior); others populate as you access reports (such as Most
Used).
For further flexibility, Reporter allows you to create custom report groups and add reports to that
group.
To create a new report group (click to view screenshot):
1. In the Reports header on the Reports tab, click Add Report Group and select New
Group. The Add Group dialog displays.
2. Name your group. For example, My Role.
3. Click OK. The new report group displays on the Reports tab.
4. To add reports to you the new group, select the Actions drop-down list next to any report
name and select Move to > Group Name.
98
Report Management
Changing Databases
As a Blue Coat Reporter user, you might have access to more than one access log database. In
Reporter, a database is collection of data culled from user-generated access. Your network
administrator creates a database and assigns access logs to that database.
Use Case
One database represents a company branch office and the database generates report data for
the users in each location. You are in Human Resources and are tasked with analyzing user
browse habits in two branches: Campbell and San Jose. When you log in to Reporter, the
Campbell database reports display by default. To switch to a different database to which you
have permissions, select it from the Database drop-down list at the top of the Reporter interface.
99
Applying a Filter to a Report

Applying a report filter allows you to narrow the scope of displayed data, based on a specific time
frame or another data point, such as a specific user. The filtering mechanism adapts to the data
in the report, which enables you to quickly select one or more attributes to include or exclude
from a report.
To access the filter options, click the Report Options link in any Report Data area header. Click
to view screenshot.
The area expands to display the Filter By and Summarize By areas.
Filter Options
There are two filter components: date and criteria. You can select either or both to create a report
filter.
Date Filter
The default date filter displays data for all dates (that are processed in the database). To restrict
the report data to specific time frames, select an option from the Date is drop-down list:
• Custom: Allows you to specify a date range.
• Since: Displays all data from the specified date to current (or the final date in the access
log database).
100
Report Management
• Current: Displays data only from the current hour, day, week, month, or year (select
one).
• Previous: Displays data going back the specified time frame: hours, days, weeks,
months, or years (select one). Partial times are not displayed. For example, if you select
the previous week, no current days from the current week display.
• Current and Previous: Displays data beginning today and going back the specified time
frame: hours, days, weeks, months, or years (select one). Partial time periods are
included. For example, if you select current and previous week, days in the current week
display.
As you select each Date is option, the field options change. Some fields require you to enter
values, such as 4 to indicate how many previous days. The other fields display interactive
calendars that enable you to quickly select date ranges. Click to view screenshot.
Criteria Filter
The default criteria filter displays all data points; for example, every user name, every category,
every user agent, and so on. Adding a criteria filter either restricts data to values or excludes
data. For example, you want to see only one user or you want see every user but one. Or you
want to see every instance of malware with the keyword of trojan.
To restrict report data to specific criteria (click to view screenshot):
101
1. From the first drop-down list, select data point.

2. From the second drop-down list, select a qualifier (Is , Is not, Contains, Does not
contain).
3. From the third drop-down list, select (or enter) a value. Depending on the data point you
selected, this drop-down list populates with valid choices.
Note: If you know the name of the value and begin entering characters, the field auto-
populates with a list of choices present in the database.
4. (Optional) Click the + symbol to add additional value fields. All value matches are
displayed in the report.
5. (Optional) Click the Add Criteria link to add additional criteria lines. All criteria filters are
displayed in the report.
6. (Optional) If you believe you will have future need for this custom filter, select the Save
as Template link and name the filter. The next time you have need for the same filter,
click Load Template and select it.
7. Click Apply.
Use Case
You want to generate a report that displays which users have browsed website categories that
are known sources of spyware/malware. On the Web Browsing per User and Category report,
you add a criteria filter that searches for the Spyware Effects and Spyware/Malware Sources
categories. Click to view screenshot.
102
Report Management
The report regenerates to display all users who have browsed sites in those categories.
103
Changing Report Attributes

You are able to customize the appearance of Dashboard and generated reports.
Changing the Graphic
Most reports display a default graphic type. The graphic presents the default sorting attribute in
the report. For example, the Web Browsing per User report displays as the Report Graph a pie
chart with a name legend to the right. To change the graphic, select an alternate from the drop-
down list. Click to view screenshot.
Changing and Adding Report Data Columns
The Report Data area in each default report displays data in at least one column and usually in
multiple columns. Again using the Web Browsing per User report example, the data columns by
default are Page Views and Browse Time, with the data sorted by Page Views. The following
are options that change how data is displayed:
• To change the sorting to the opposite order (descending to ascending), click the data
column head. The arrow switches to indicate direction. Also, the graph redraws to reflect
the new sorting order.
• To change the focus of the report to another type of data, click that column head. Again,
the graph redraws to display the new data points.
104
Report Management
• Reporter also allows you to add more data columns to default reports. To add a new data
column, right-click anywhere in the column header and select a column. The new column
and data displays.
• You can also drag a column to a new location.
Use Case
in the Web Browsing per User report you notice that the top user has a spent quite a bit of time
browsing the Web and you want to view the estimated cost of this activity. Right-click anywhere in
the column header and select the Cost (time) column. Click to view screenshot.
The report displays the new data. Click to view screenshot.
105
Changing How Many Lines of Data are Displayed
See Applying a Filter to a Report.
106
Report Management
Managing Reports
Every report page (excluding Dashboard reports) contains management options (click to view
screenshot).
Report Management Options
1 -- E-mail this report to another person.

2 -- Archive this report to the Reporter server.
3 -- Download this report to your local system.
4 -- Schedule this report to run at specific times.
Expand any of the following sections to learn about these options.
E-mailing Reports to Another Person

As you are reviewing reports, you might see data that you feel someone else in your organization
should see. Each single-level report contains an Email button. Reporter enables you to send to a
report (as a PDF or a spreadsheet-compatible database file) to other recipients.
Note: If the Email button is greyed out, Reporter is not configured to or able to communicate with
the mail server. Contact your network administrator.
To e-mail a report (click to view screenshot):
1. Click Email. A new e-mail option screen displays.

2. Select which format the file is attached as:
• PDF: Reporter attaches a PDF file to the e-mail. The recipient must have Adobe
Acrobat to view the file.
• CSV: Reporter attaches a file, which contains the report data, in a file with a
.csv extension. The recipient can open the file with a spreadsheet application,
such as Microsoft Excel.
3. From the Report Data drop-down list, select how many rows of the report the sent file
includes.
4. In the To field, enter the valid e-mail address of the intended recipient. Separate multiple
recipients with commas (,).
5. The default value in the Subject field is the full name of the report. Accept this value or
enter a new subject line.
6. The CC (carbon copy) and BCC (blank carbon copy) fields are optional.
7. The default value in the Message Body field is the name of the report, plus the word
attached. Accept this value, modify the text, or enter a new message body.
8. Click Email. Reporter forwards the report to the recipient(s).
Archiving a Report
107
As you are reviewing reports, you might determine that a specific generated report needs to be
permanently stored for future reference. Your Reporter administrator might have configured
Reporter to not process access log data that is older than a specific time frame; archiving a report
is a way to preserve that generated data. Consider, however, that the Reporter administrator has
the ability to delete archived reports to maintain disk space capacity. Communicate with your
administrator if there is a report that absolutely must remain archived.
Reporter enables you to archive to a report as a PDF or a spreadsheet-compatible database file.
Note: Your Reporter administrator determines where the reports are archived; you cannot specify
the location.
To archive a report (click to view screenshot):
1. Click Archive to Server. A new archive option screen displays.

2. Select which format the file is archived as:
• PDF: Reporter archives the report as a PDF file.
• CSV: Reporter archives a file, which contains the report data, with a .csv
extension. Opening the file requires a spreadsheet application, such as Microsoft
Excel.
3. From the Report Data drop-down list, select how many rows of the report are archived.
4. Click Archive.
The report is archived on the Reporter server and also displays in the Archived Reports group
on the main Reports tab. From there, you can access or delete the report from the archive (click
to view screenshot).
Downloading a Report
Each top-level report has an Download button. Reporter enables you to immediately generate a
report as a PDF or a spreadsheet-compatible database file to your local system. After it displays,
you can save the PDF, print it, or perform any task afforded by the Acrobat application.
108
Report Management
To download a report (click to view screenshot):
1. Click Download. A new download option screen displays.

2. Select which format the file is downloaded as:
• PDF: Reporter downloads the report as a PDF file.
• CSV: Reporter downloads a file, which contains the report data, with a .csv
Excel.
3. From the Report Data drop-down list, select how many rows of the report are
downloaded.
4. Click Download.
Scheduling a Report to Generate

Reporter enables you to schedule when a specify report generates. The scheduling tool provides
many options that allow you create a schedule task that is very specific to your needs.
• Generate the report at a specific date and time, or periodically.
• E-mail or archive the report as a PDF file or a spreadsheet-compatible file.
• Generate the entire report or limit the report to limited row numbers or specific filter
criteria.
Note: If you create a custom report (for example, apply a filter), you must save that report before
you can create a schedule task. See Saving Reports.
To schedule a report (click to view screenshot):
1. Each top-level report contains a Schedule button. Clicking it displays a schedule option
screen.
109
2. Select the report format:

• PDF: Reporter generates the report as a PDF file.
• CSV: Reporter generates a file, which contains the report data, with a .csv
Excel.
3. From the Report Data drop-down list, select how many rows of the report are generated.
4. Select which action occurs (click to view screenshot):
• Archive report to server: Saves the report to the Reporter server. Access the
report from the Archived Reports group on the main Reports tab (see the
Archiving a Report section above).
• Send report by email: Selecting this option expands the field and displays fields
to enter e-mail recipient information (see the E-mailing Reports to Another
Person section above).
5. Specify how often the report generates (click to view screenshot):
• From the Frequency drip-down list, select Once (for a one-time generation) or
select another recurring option.
• Depending on the frequency option you selected, different specific time fields
display. Click the symbols to display calendar and/or clock tools; select the time
frames for report generation.
110
Report Management
6. In the Description field, accept the default, which is the report name, or enter a custom
string.
7. (Optional) Apply a filter to the generated report (click to view screenshot).
If you have only one filter, the report generates with that filter. If you select multiple filters,
Reporter creates a scheduled task for each value. For example, if you select Category is
Business and add the category value Web Advertisements, Reporter creates two
scheduled tasks. One runs the report with the first filter, the second runs the report with the
second filter.
Use Case: You want to run the User Behavior report each week for five different users.
Schedule the User Behavior report and add the filter user is user1, user2, user3, user4,
user5.
This behavior applies only to scheduled reports. For more information about filters, see
Applying a Filter to a Report.
111
Creating New Reports

Although you can modify any pre-defined report with filters and save it as a custom report, you
might elect to create a report that contains specific data rows and columns. The upper right-hand
portion of the main Reports tab contains a New Report button, which begins a wizard.
Before creating custom reports, Blue Coat recommends browsing pre-defined report data to
understand the elements that comprise a report.
Use Case
Your enterprise has multiple branch log sources feeding into a database to which you are
assigned. You want to create a custom report that lists a few specified browsed illicit categories
per log source, based on group name. You plan to generate the report once a month and you
want to the report to reflect only the previous 30 days.
1. On the Reports tab, click New Report. The Create a Report From Scratch wizard
displays to the first page, Report Information (click to view screenshot):
a. In the Name field, enter a name that describes the data in this report.
b. The Summarize By area is where you specify which type of displays in the
report. Click Add Level to add up to three data points and specify how many
rows of data display in each attribute row.
c. Click Next to displays the next screen in the wizard: Set Report Filter.
2. On this page, specify the database dates and time frames that this report recognizes
(click to view screenshot):
112
Report Management
a. The default date filter is process every date recorded in the access logs for this
database. For this use case, you select Current and previous from the Date is
drop-down list and enter 30 as the day value.
b. Adding a filter criteria is optional. For this use case, you want to filter for
Adult/Mature Content and Gambling. Click Add Criteria to display filter
options. From the drop-down lists, select the matching criteria. Click the + button
to add more criteria.
c. Click Next to displays the next screen in the wizard: Set Columns.
3. This page enables you to add the data value columns and specify which column serves
as the default sorted column (click to see screenshot):
113
a. The Display the following area provides all of the selectable columns. Notice
that the three data points selected for this report in Step 1 are selected and
greyed out. Select and/or clear your column choices. In this use case, you want
to see values for Requests and Browse Time.
b. From Sort by drop-down lists, select which data Reporter uses as the default
sorting column and select which order: Descending (highest to lowest) or
Ascending (lowest to highest). In this use case, you want to see values sorted
by Browse Time in Descending order..
c. Click Next to displays the next screen in the wizard: Save and Run.
4. This page provides an option to save the report before running (click to view screenshot):
114
Report Management
a. If you select Save report to report list for running later, Reporter saves this report
and displays in the Unfiled Reports on the main Reports tab. If you are satisfied
with the report data, you can edit the report attributes and re-save the report. If
you clear this option, the report runs but does not save. You can, however, use
the options on the generated report to alter the filters, save the report, e-mail the
report, and schedule the report.
b. Click Run Report to generate the report data and display the results.
115
Saving Reports
As you apply filters and change report parameters, you might decide that you want to save a
report to a custom name. Each top-level report has a Save button.
Use Case
After applying a filter that generates a Web Browsing per User report for the top two users, you
want to save the report under a new name: Top 2 Web Browsers. Click Save As and name the
report (click to view screenshot).
The report changes name. Also, when you return the main Reports tab, the new report displays
in the Unfiled Reports area. To move the report to another group, select Actions > Move to
Group > Group Name (click to view screenshot).
116
Report Management
117

Blue Coat Reporter 9.x Online Help System - PDF Version

Hochgeladen von

Dokumentinformationen

Copyright

Verfügbare Formate

Dieses Dokument teilen

Dokument teilen oder einbetten

Freigabeoptionen

Stufen Sie dieses Dokument als nützlich ein?

Sind diese Inhalte unangemessen?

Copyright:

Verfügbare Formate

Blue Coat Reporter 9.x Online Help System - PDF Version

Hochgeladen von

Copyright:

Verfügbare Formate

Reporter 9.1.

x Online Help System

Archiving a Report................................................................................................................ 107

Task Category How do I...? See...

Database- I want to understand what About Databases

How do I create a new Creating New

I have an existing Creating New

Can I temporarily stop log Managing Existing

User-Related How do I create a new • About Creating

I want to create a new • About Creating

Is it possible to configure • About Creating

Report-related How do I change the Managing Existing

Reporter uses to estimate (Changing Default

How do I change how Managing Existing

Application- Where can I see which Viewing System

Where do I enter the Managing the

Is it possible to secure the Managing Reporter

I want Reporter to be able Connecting Reporter

I will be enabling LDAP Connecting Reporter

How do I change which Changing the

Troubleshooting Blue Coat wants me to Uploading System

How can I review Viewing System

Is there a way to monitor Reviewing Reporter

Component How do I...? See...

Dashboard What do the Dashboard About the Dashboard

What other reports are Adding Reports to the Dashboard

Can I change the pie chart to Changing Report Attributes

I want to remove the charts in About the Dashboard

I want to remove the grids in Changing Report Attributes

How do I drill down a Expanding Dashboard Reports

How do I delete reports I am Deleting a Report from the

Generated Reports How do I view detailed report About Overview Reports

How do I change to another Changing Databases

I want to add a new report Adding a New Report Group

How do I search reports for a Searching Reports

How do I limit or target report Applying a Filter to a Report

For future reference, I have a Managing Reports (Archiving a

How do I e-mail a report to Managing Reports (E-mailing

How do I schedule reports to Managing Reports (Scheduling a

How do I download a report to Managing Reports (Downloading a

General How do I change the password Changing Your Reporter Password

How do I change the e-mail Specifying Your Reporter E-mail

Changing Your Reporter Password

Specifying Your Reporter E-mail Address

Creating New Access Log Databases

a. In the Database Name field, enter a meaningful name.

6. Specify post-processing action (local sources only):

Log File Wildcards

matches (zero chars before SG allowed, existing SG matches, and

?SG* does not match (there is no existing char before SG)

S?_?o?1?1 matches (each characcter accounted for)

matches (caseless compare and zero more allowed after last

sg_log101? does not match (no existing character to match)

Creating New Database Log Sources

Managing Existing Databases

Changing Existing Database/Log Source Parameters

3. Select an option to change:

Changing Default Cost Calculators

Changing Default Report Row Limits

3. In the Report Generation Limits, alter options, as required.

Unloading Databases to Conserve Resources

Creating User Roles

Creating Administrator and Standard Users

Applying LDAP Authentication to Roles