Blue Coat Reporter 9.2.

x Release Notes

Version: 9.2.1.1
Release Date: 05/17/2010
Document Revision: 1.0 on 05/17/2010

Introduction
Before beginning the installation process, please review the following sections:
❐ "Reporter 9.2.x Feature Matrix" on page 2—Provides a quick reference for
features introduced in each release, with links to full feature descriptions.
❐ "Installing/Upgrading Information" on page 2—Provides a quick reference
that links to descriptions of customer-reported Service Requests (SRs).
❐ "About Licensing" on page 3—Provides information about the various
Reporter licenses.
❐ "System Compatibilities" on page 4—Lists which versions of various third-
party products are compatible with Reporter 9.x.
❐ "Global Reporter Limitations" on page 6—Provides any limitations that
apply to all Reporter 9.x releases.
❐ "Reporter Documentation" on page 7—Lists and describes the Reporter
documentation suite.
❐ "Release Note Directory" on page 7—Quick access links to the incremental
information sections for Reporter 9.2.x releases.

Support
Direct support questions regarding this release to:
http://www.bluecoat.com/support/contact.html
For questions or comments related to these Release Notes or any Reporter
documentation, send an e-mail to: documentation@bluecoat.com

1
Blue Coat Reporter 9.2.x Release Notes

Reporter 9.2.x Feature Matrix

The following table lists the features introduced in Reporter 9.2.x releases, with cross-
reference links to feature descriptions.

Table 1-1. Reporter 9.x Feature Introduction Matrix

Introduced In
Component Feature
9.2.1

"Reporter Improvement X
Program" on page 8

Administration "Audit Logging" on page 8 X

User Access "LDAP Nested Groups Support" X

on page 9

"Role-Based: Allowing Managers X

to View Direct Report Data" on
page 9

"Role-Based: Allowing Reporter X

Users Access to Their Personal
Data" on page 9

Log Source "Custom Calendar" on page 10 X

"UNC Paths" on page 10 X

Reports "Threat Protection X

Enhancements" on page 10

"Network Errors Category" on X

page 11

"Search Engine Keywords X

(Report)" on page 11

Custom Report "Web API" on page 11 X

Scripting

Installing/Upgrading Information
This section discusses upgrading to Reporter 9.2.x from previous releases.

Database Sizes
Because of the new log data indexing that enables faster reporter generation
times, Reporter 9.x databases can be anywhere from 1.5 to 3-times larger than
previous versions (7.x/8.x). The size increase is highly dependent on the log data.
For complete estimates, refer to the Reporter Sizing Guide.

Upgrading from v9.2 Beta Releases

Blue Coat recommends not upgrading from Beta releases.

2
Blue Coat Reporter 9.2.x Release Notes

Upgrading From v9.1.x

Re-install the Reporter 9.2.x application in the same directory. No special actions
are required; however, be advised of the known issue described here: "Installing/
Upgrading" on page 13.

Upgrading From a Previous Release (7.x or 8.x)

Reporter 9.2.x is a new Reporter product that features an architecture that is not
compatible with pre-9.1.x Reporter versions . Therefore, you cannot perform an
upgrade to Reporter 9.2.x from previous Reporter versions. To view reports that
contain older data, you must reprocess legacy/archived log files into Reporter
9.2.x databases. You can, however, run these previous Reporter version on the
same server as Reporter 9.2.x. This enables you to create new databases for data
going forward and transition legacy data into new databases at your own pace.

Important:To accommodate the use of 64-bit operating systems, databases

populated by Reporter 9.x processes can grow from 100 to 200 percent larger
when compared to the same data set processed in Reporter 8.x. Blue Coat strongly
recommends that you consult the Blue Coat Reporter 9.x Sizing Guide to verify that
your Reporter system allotment is adequate
• https://bto.bluecoat.com/documentation/pubs/view/Reporter 9.x
• https://bluesource.bluecoat.com/technicalresources/productmanuals

The following features and tools associated with previous releases are not
available in Reporter 9.2.x:
❐ IM/Streaming/Chat reports (to retain these databases, you can simultaneous
run Reporter 8.3.x and 9.2.x).
❐ CIFS log support
❐ CLI administration/report generation
❐ HTML e-mail reports
❐ Custom log formats
❐ Any v7 reports

About Licensing
Reporter 9.2.x features three available licenses:
❐ Standard (default)—Installing and running Reporter requires no license;
however, the default mode (also known as Standard License) limits log
processing to 50 million concurrent log lines. If log processing reach this limit,
Reporter halts processing until lines are removed from databases (or you
install a higher level license).
❐ Enterprise—Purchasing and installing an Enterprise License enables Reporter
to process up to 2.5 billion concurrent log lines.

3
Blue Coat Reporter 9.2.x Release Notes

❐ Premium—Purchasing and installing an Enterprise License enables Reporter to

process up to 10 billion log lines.
After purchasing an Enterprise or Premium license, refer to the installation
procedure in the Blue Coat Reporter 9.x Initial Configuration Guide.

System Compatibilities
Reporter 9.2.x supports the following 3rd party systems and products.

Note: Blue Coat Reporter 9.x can run on VMware systems. To be precise, Reporter
runs on supported Windows or Linux platforms, which might themselves be
running on VMware systems. Reporter does not require awareness of VMware.

Servers
General
❐ 32-bit operating systems
❐ 64-bit operating systems

Important: 64-bit databases are not compatible with 32-bit databases.

Therefore, if you process logs on a 32-bit system and migrate to a 64-bit
system, you must reprocess all of your logs to generate new, compatible
databases.

FTP Servers
❐ Windows FTP (through IIS)
❐ Linux: VSFTPD
These are the FTP server types that Blue Coat uses to test. Other FTP servers
might function correctly, but they are not officially supported by Blue Coat.

Windows
❐ Windows Server 2003
❐ Windows Server 2008

Notes
• Supports Intel x86 and AMD processors; Reporter does not support Intel
RISC processors.
• For 32-bit servers, Blue Coat recommends Windows 2003 users use the /
3GB switch option to allocate more memory to the Reporter service. For
details of how to accomplish this (with the boot.inifile), see:
http://www.microsoft.com/whdc/system/platform/server/PAE/
PAEmem.mspx

4
Blue Coat Reporter 9.2.x Release Notes

Linux
❐ 32-bit: Red Hat Enterprise AS/ES 4 and AS/ES 5.
❐ 64-bit: Red Hat Enterprise AS release 4 and AS 5 (Nahant Update 4 or 5)

Note: Reporter only works with Very Secure FTP Daemon (VSFTPD).

The following are the Linux Reporter Binary Library Dependencies:

ldd bcreporter
libpthread.so.0 => /lib64/libpthread.so.0 (0x00002ba56fc38000)
libdl.so.2 => /lib64/libdl.so.2 (0x00002ba56fe52000)
libstdc++.so.6 => /usr/lib64/libstdc++.so.6 (0x00002ba570056000)
libm.so.6 => /lib64/libm.so.6 (0x00002ba570357000)
libgcc_s.so.1 => /lib64/libgcc_s.so.1 (0x00002ba5705da000)
libc.so.6 => /lib64/libc.so.6 (0x00002ba5707e8000)
/lib64/ld-linux-x86-64.so.2 (0x00002ba56fa1c000)

Browsers
Blue Coat recommends the following browsers for Reporter access:

❐ Mozilla Firefox 3.x

❐ Internet Explorer 8.x
Other browsers, such as Firefox 2.x and IE 7.x, will work, but Reporter users
might experience slower performance.

Languages
Reporter 9.x supports English, Chinese Traditional, Chinese Simplified, and
Japanese. While you might run Reporter on a system that supports user interaces
in your language, Reporter is able to support only the specified languages.

5
Blue Coat Reporter 9.2.x Release Notes

Global Reporter Limitations

This section provides known Reporter system operational limits that apply to all
Reporter 9.x releases.

Recommended Limits
Do not exceed the following established limits in Reporter 9.2.x:

Limit Recommended

Realms 10

Users 100

Roles 100

Groups 100

Databases 50

Log Sources 150

Custom Reports (per user) 250

Templates/Named Filters (per user) 25

Panes (per user) 25

Scheduled Events 5000

Rows in Report 25000

Archived Reports No limit; based on disk space capacity.

Concurrent Users 50

Pending ProxySG appliances 150

PDF exports • Dashboard/Overview Charts: 10

entries + an others entry for pie charts.
• Summary Charts: 25 entries, plus an
others entry for pie charts.

FTP
On some Windows servers, the firewall might prohibit large FTP file transfers.
This causes FTP Log Sources to abort log processing and unload because of the
fatal error. Disabling the FTP firewall, or possibly increasing a restrictive custom
timeout, allows the Log Source to download the entire log file.
For more information, see the Microsoft Knowledge Base Article ID:
931130 "Error message when you use and FTP client to download a large
file from an FTP server: "Connection closed by remote host"

6
Blue Coat Reporter 9.2.x Release Notes

Double-byte Characters
Double-byte characters in access logs are currently not supported in Reporter 9.x.

Note: The Reporter Management Console supports Chinese/Japanese Operating

Systems and also supports Chinese/Japanese display in the Reporter user
interface, but the required double-byte characters are not stored or processed.

Reporter Documentation
This section lists the current Blue Coat Reporter 9.x Documentation Suite:
❐ Blue Coat Reporter 9x. Sizing Guide—Use this reference to determine asset
requirements for your particular Reporter deployment.
❐ Blue Coat Reporter 9.x Initial Configuration Guide—Describes how to install
Reporter, how configure the ProxySG to upload access logs to a dedicated
server, and how to create a profile and user role. Also includes installation
best practices and troubleshooting.
❐ Blue Coat Reporter 9.x Administrator’s Guide—Provides tasks and best practices
for Blue Coat Reporter administrators. Tasks include policy for backing up
access logs, alternative methods, and troubleshooting.
❐ Online Help System—The Reporter 9.x user interface features a context-
sensitive Online Help System. An administrator logging into Reporter has
access to all topics. Non-admin users have access only to topics related that
are related to the Report Dashboard and general report information.
PDF versions of these manuals are available on the Blue Coat resource sites:
❐ https://bto.bluecoat.com/documentation/pubs/view/Reporter 9.x
❐ https://bluesource.bluecoat.com/technicalresources/productmanuals

Release Note Directory

These release notes present information organized by each release in the Reporter
9.2.x software line. Each section provides feature descriptions, fixes, known
issues, and compatibility notes.
❐ Section A: "Reporter 9.2.1.1, build 45741" on page 8—Provides information
about the 9.2.1.1 release.

7
Blue Coat Reporter 9.2.x Release Notes

Section A: Reporter 9.2.1.1, build 45741

Release Date: 05/17/2010
Compatible with: SGOS 4.2.x, 4.3.x, 5.3.x, 5.4.x, 5.5.x

Reporter 9.2.1 Contents.

This section contains the following Reporter 9.2.1 topics:
❐ "New Features in v9.2.1"
❐ "Fixes in v9.2.1" on page 12
❐ "Limitations in v9.2.1" on page 12
❐ "Known Issues in v9.2.1" on page 13

New Features in v9.2.1

Reporter 9.2.1 introduces the following new features.

Reporter Improvement Program

After it completes the installation process, Reporter displays a dialog that
discusses the Blue Coat Reporter Improvement Program. As described in the
dialog, Reporter sends anonymous information to Blue Coat to assist Blue Coat
personnel in analyzing how Reporter is used. This basic information includes
your license, server specifications, system resource use, and Reporter
configuration and use. No private, enterprise-sensitive data is transmitted.
Although this feature is enabled by default, you have the option to decline
sending this information. The General Settings > Systems Settings > Server Settings
page provides the Send anonymous system data to help improve Reporter option; clear
this option and click Save.

Audit Logging
Enables Reporter administrators to analyze when users access Reporter and what
actions they take within. When enabled, audit logging records actions such as
Reporter log ins and log outs, changed settings, role assignments, and report
generations. Log entries display in the following format:
<134>1 2009-09-23T20:22:40.0Z [system name] Reporter 56301 USR001 - User
user_admin logged in
This is the syslog format as specified by RFC 3164 (http://www.ietf.org/rfc/
rfc3164.txt). Any reader that can parse it can be used to consume these logs,
which are saved on disk.

Reporter User Interface/Help Location

Administrator credentials: General Settings > System Settings > Log Settings area >
Audit Logging area.

8
Blue Coat Reporter 9.2.x Release Notes

LDAP Enhancements
Reporter 9.2 provides the following LDAP features.

LDAP Nested Groups Support

Some LDAP directories, such as Active Directory, allow a group to contain
members that are also groups. When a group is a member of another group, it is
called nested group. With nested groups, the groups a user is associated with are:
❐ Any group that the user is a member of;
❐ Any groups those groups are a member of; and
❐ Any groups those groups are a member of and any groups those groups are a
member of.
The nesting continues for as many layers of groups exist.
For example, the enterprise contains a group called Engineering, which contains
members Engineering A, Engineering B, and Engineering C, all of which are also
groups containing members (users). With nested groups, a member of Engineering
A also becomes a member of Engineering. When nesting is enabled on Reporter, all
members of Engineering A, Engineering B, and Engineering C have access to the role.

Reporter User Interface/Help Location

Administrator credentials: General Settings > System Settings > Access Control > LDAP
Groups:
in the wizard, select the nesting option assign a role to nested groups.

Role-Based: Allowing Managers to View Direct Report Data

This feature enables the Reporter administrator to grant specific users, such as
managers, access to data about the employees who report to that user. The
ProxySG logs cs-username from the same LDAP realm. You can define ProxySG
policy to override cs-username with another field such as cs-userdn or cs-user.

Reporter User Interface/Help Location

Administrator credentials: General Settings > System Settings > Access Control > Roles:
Add the reports to filter by selecting the following criteria: Username, Reports To,
and CURRENT USER.

Important: The ProxySG and Reporter must be configured to use the same
LDAP realms for user identification and authentication. The user naming
attribute and user base DNs must also be configured the same on both sides.

Role-Based: Allowing Reporter Users Access to Their Personal

Data
This feature enables the Reporter administrator to grant users access to data about
themselves when they log into Reporter. The administrator creates a role filter
that dynamically restricts the database rows accessible to only those containing
information for the currently logged in Reporter user. This applies only to role
filtering, not report level filtering.

9
Blue Coat Reporter 9.2.x Release Notes

Section A: Reporter 9.2.1.1, build 45741

Reporter User Interface/Help Location

Administrator credentials: General Settings > System Settings > Access Control > Roles:
Add the self role filter by selecting the following criteria: Username, Is, and
CURRENT USER.

Important: The ProxySG and Reporter must be configured to use the same
LDAP realms for user identification and authentication. The user naming
attribute and user base DNs must also be configured the same on both sides.

Log Sources
Reporter 9.2 provides the following Log Source features.

Custom Calendar
The Log Source wizard provides the ability to use a calendar-based schedule that
allows you to set what time Reporter performs a check for new log data. For
example, you want checking to always occur during off-peak hours or not during
a scheduled maintenance cycle.
Reporter User Interface/Help Location
Administrator credentials: General Settings > Reporter Settings > Data Settings >
Databases tab; create a new database/log source or edit the log source options of a
current database.

UNC Paths
Reporter 9.2 supports locating log sources on a share. In the New Database/New
Log Source wizards, the Directory Path fields support entering a share format path
(for example, \\path\path.).

Important: While other, similar fields allow you to enter UNC paths, Blue Coat
strongly recommends against locating other Reporter components (such as
databases, journals, archives) on shares. You will not be able to use the Upload
Diagnostics feature should a problem arise.

Threat Protection Enhancements

Reporter 9.2 provides the following Threat Protection reporting features.

Threat Protection Report (Dashboard)

The Dashboard contains a new report group named Potential Threats. This report
provides summary information about potential threats caught either by Blue Coat
Web Filter (BCWF) and WebPulse or ProxyAV.

Potential Threats (Report)

The full report version of the Threat Protection report.

10
Blue Coat Reporter 9.2.x Release Notes

Section A: Reporter 9.2.1.1, build 45741

Risk Groups (Report)

This report aggregates several groups identified as risks to network integrity or
enterprise employee conduct codes. All of this report data is available in other
reports, but combining risk data provides an effective summary.

Trend of Potential Threats (Report)

This report present Web threat data in an alternate format. Potential threats
display according to each day in the database, grouped by BCWF/WebPulse and
ProxyAV. The by-day bar graph format enables you analyze heightened patterns
of threats.

Network Errors Category

When Reporter processes a log file that contains some lines with an empty (-)
category rating and sc-status codes in the 400 or 500 range (HTTP response error
codes), Reporter changes the category to Network Errors. This allows you to
separate uncategorized requests that were errors versus uncategorized requests
that resulted in content sent to end users.

Search Engine Keywords (Report)

Allow Reporter users to view report data based on terms entered by users in
common search engines; not all reports support the search engine keyword. A
new canned report is available in the Reports tab that displays the search engine
terms from all users. You can also drill to a specific user's search terms.
This release supports searches entered in the following search engines:

• Ask • Bing • Google • Yahoo

Web API
The Web API feature makes available a public API of HTTP endpoints (as
opposed to private HTTP endpoints that are used by the JavaScript client). This
public API allows you to script report creation. The reports, returned in an HTTP
response, support PDF and CSV (Microsoft Excel-compatible) file formats.
The Web API supports report generation, but does not support settings and
configuration management.

Additional Support
❐ Blue Coat provides a Perl script that you can use as a base template to
customize. This script, viewable with a text editor, is packaged with the
Reporter application. Assuming you installed Reporter in the default
directory:
• Windows: C:\Program Files\Blue Coat Reporter 9\utilities\samples
• Linux: opt/bc/reporter/utilities/samples

11
Blue Coat Reporter 9.2.x Release Notes

Section A: Reporter 9.2.1.1, build 45741

❐ For more detailed information and a list of supported HTTP endpoints, see
Chapter 5: Web API in the Reporter 9.x Administrator’s Guide.

Fixes in v9.2.1
Reporter 9.2.1 is a new release that contains the following fixes first reported in
v9.1.x.

Exporting
❐ Generating a monthly report displayed different totals in CSV format versus
PDF format. (SR 2-289899956)
❐ Attempting to export a PDF, ordered by requests, does not download the file
(and corrupts the file). (SR 2-260346482)

Filtering
❐ Despite applying a custom date filter for multiple days, reports displayed
data for only one day. (SR 2-286866344)
❐ When the Previous month filter is applied, Reporter included days from two
months prior. (SR 2-289940942, 2-290368462)

FTP
❐ FTP log source configurations did not accept hostnames—only IP addresses—
and Reporter did not display the lack of DNS resolution. (SR 2-291219812)

Limitations in v9.2.1
This section lists issues known by Blue Coat for which near-time solutions are not
planned.

Browsers
Internet Explorer v8: Attempting to download a report might cause Reporter to
display the following message similar to the following: “To help protect your
computer, IE has blocked the download. Right-click and select the option to download the
file.”
Selecting this option refreshes the Reporter page and disrupts the download
process. To prevent this, in Internet Explorer 8:
1. Select the Tools > Internet Options > Security tab.
2. In the Security Level for This Zone area, click Custom Level; the Security Settings -
Internet Zone dialog displays.
3. Scroll down to the Downloads area; for the Automatic prompting for file downloads
option, select Disable.
4. Click OK in both dialogs.

12
Blue Coat Reporter 9.2.x Release Notes

Section A: Reporter 9.2.1.1, build 45741

Exporting
From any report page Graph Options area: if you select to graph more than one
column and export the report to PDF, only the first data column is graphed.

Known Issues in v9.2.1

This section lists all knows issues with this release.

Exporting
❐ Adding the Bandwidth Used by Day report to the dashboard and then exporting
it to a PDF report results in different data on the graph. (SR 2-282515062)
❐ If the Dashboard is exported as a PDF and then canceled, it might crash the
Reporter service.

Filtering
❐ Generating a report with Category and the IS NOT criteria filters displays more
data, not less. (SR 2-289956880, 2-293156542)

Installing/Upgrading
❐ Upgrading Reporter fails when roles are present but not assigned to a
database. Reporter successfully loads after you paste the roles.cfg file back into
the directory, but still errors out because the path names in the preference.cfg,
log_sources.cfg, and database.cfg files are not valid for the server. (SR 2-
295280962)

LDAP
❐ Using LDAP authentication might cause unnamed binds to secondary
servers. Users are not able to log in or receive a password prompt indicating a
group not found. Consult the team responsible for managing Active Directory
in your enterprise; use the Global Catalog as the AD server.
❐ Extremely large AD trees might cause Reporter to hang while searching. (SR
2-243124032).

Reports
❐ Page view counts for Web 2.0 sites might be inaccurate. (SR 2-295967234)

13
Blue Coat Reporter 9.2.x Release Notes

Section A: Reporter 9.2.1.1, build 45741

14