Cisco Cisco Web Security Appliance S160 Betriebsanweisung

Cisco

iv

S A W M I L L F O R I R O N P O R T 7 . 3 . 2 U S E R G U I D E

Fixed: Inaccurate Page View Statistics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .  15
Fixed: Log Entries Containing Spaces in Usernames Do Not Appear in Reports . . . . . . . . . . . . .  15
Fixed: HR Profile Erroneously Displays a “FIELD: Auth User” Report . . . . . . . . . . . . . . . . . . . . .  15
Fixed: Scheduling Database Updates in the Sawmill CLI Can Cause Sawmill for IronPort to Crash

Fixed: Importing Access Logs Can Cause Sawmill for IronPort to Crash . . . . . . . . . . . . . . . . . . . 15
Fixed: Updating the Database in Sawmill for IronPort May Throw an Application Error at the End of

the Update . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15

Fixed: Sawmill for IronPort Discards Session that are Over Two Hours Long . . . . . . . . . . . . . . . 15
Fixed: Sawmill for IronPort Does Not Allow Users to Enable WBRS in the Summarized Logs Report

Fixed: Sawmill for IronPort Incorrectly Reports Page View Calculations Due to MIME Type Entries

Multiple Log Formats in Same Directory Not Supported. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .  16
“Date Offset” Supports Whole Hours Only  . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .  16
Generating “All Reports” Does Not Always Work if the Database Is Large . . . . . . . . . . . . . . . . .  16
Zoomed Reports Show Zero Results When Using Global Filters in Some Cases . . . . . . . . . . . . .  16
Custom URL Category Number Erroneously Appears as Access Policy Name  . . . . . . . . . . . . . .  16
When Running on a 32-Bit Operating System, Sawmill for IronPort May Have Difficulty Handling

Access Logs Larger than 2G . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17

Typo in the Daylight Savings Time Log Filter in the Online Help . . . . . . . . . . . . . . . . . . . . . . . .  17
Disabling the Rewrite URL Feature Causes Sawmill for IronPort to Stop Functioning Properly . .  17
The Default Pathname Suggested in the New Profile Wizard is Problematic  . . . . . . . . . . . . . . .  17
Sawmill for IronPort Incorrectly Reports CONNECT Log Entries . . . . . . . . . . . . . . . . . . . . . . . . .  17

2. Installation and Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19

Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
Installing and Configuring Sawmill for IronPort . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21

Step 1. Install Sawmill for IronPort . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
Step 2. Configure Sawmill for IronPort Setup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
Step 3. Log In and Create a Profile . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21

Working with Time Zones . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24
Accessing Windows Mapped Drives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25

3. Navigating Sawmill for IronPort . . . . . . . . . . . . . . . . . . . . . . . . . . . 27

Sawmill Web Interface Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
Reports Page . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29

Reports Header  . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .  29
Reports Toolbar . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .  30
Reports Menu  . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .  30
The Report . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .  30

Config Page . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33

Profile Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
Log Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33

WSA_Sawmill.book Page iv Monday, March 15, 2010 10:31 AM