Cisco Cisco Web Security Appliance S670 User Guide

Avoid creating multiple logging subscriptions and using high detail levels when possible, as these 
can adversely affect system performance.

A log type defines the range of activity that is recorded in log files of that type. The Web Security 
appliance provides numerous log types, each of which logs activity related to a specific area. 

Two of the main log types that administrators use for normal appliance monitoring are the Access logs 
and Traffic Monitor logs. Access logs record activity related to client access through the web proxy, 
including filtering and scanning activity. Traffic Monitor logs record activity related to Layer-4 traffic 
monitoring.

Access logs are further divided into standard Access logs and W3C compliant access logs. Both can 
record the same range of activity but do so in different formats. W3C are also more customizable with 
regard to their content and layout than standard Access logs.

1

Plan logging tasks:

Review the best practices for logging

Review logging concepts

2

Create or change logging subscriptions 

3

View log files

4

Understand Access logs

5

Understand W3C compliant Access logs

7

Customizing Access and W3C Access logs

7

Understand Traffic Monitor logs

8

Find log file reference information