Reporter10 can't create report at trigger of "authentication_failed"

Products

• Reporter
• Reporter-S500
• Reporter-VA

Issue/Introduction

My ProxySG's accesslog has some "Authentication_failed" such below.

2019-XX-XX 09:23:38 1 XXX.XXX.XXX.XXX - - - - None - authentication_failed PROXIED "Search Engines/Portals" -  407 TCP_DENIED GET

My Reporter is loading accesslog and never error in Reporter Event logs.
I search verdict of "Authentication_failed" my database however Reporter never list it.

Environment

Reporter10.2.x.x

Reporter10.3.x.x

Cause

Reporter makes the assumption that log line with 407 sc-status are not interesting because it just means the user needs to authenticate and then if successful, the same request will be repeated and succeed.
Filtering these lines by default is just an attempt to increase scalability and improve report data by removing lines.

 

Resolution

This is expected behavior for current Reporter. 

For more infomation please see TECH243083.

Reporter is only load sc-status equals 401 authentication_failure from accesslog.