Cisco Cisco Web Security Appliance S690 User Guide
16
S A W M I L L F O R I R O N P O R T 7 . 3 . 2 U S E R G U I D E
[Defect ID: 55242]
Fixed: Sawmill for IronPort Does Not Allow Users to Enable WBRS in the Summarized
Logs Report
Logs Report
Sawmill for Ironport is not allowing a user to enable the WBRS variable from the Table
Options menu in the User Interface. Additionally, you cannot go to the profile.cfg for
Summarized Logs, and change the field_wbrs_value to True.
Options menu in the User Interface. Additionally, you cannot go to the profile.cfg for
Summarized Logs, and change the field_wbrs_value to True.
[Defect ID: 55664]
Fixed: Sawmill for IronPort Incorrectly Reports Page View Calculations Due to MIME
Type Entries
Type Entries
Page view calculations include log lines that have MIME types. However, in some cases,
MIME types show up empty or with a ‘-‘. In Sawmill for IronPort version 7.3.1, these log lines
were not included in the page view calculations resulting in under-reported data. In Sawmill
for IronPort version 7.3.2, this has now been corrected. As a result some of the calculations
will show better accuracy resulting in different “time spent" numbers.
MIME types show up empty or with a ‘-‘. In Sawmill for IronPort version 7.3.1, these log lines
were not included in the page view calculations resulting in under-reported data. In Sawmill
for IronPort version 7.3.2, this has now been corrected. As a result some of the calculations
will show better accuracy resulting in different “time spent" numbers.
[Defect ID: 66678]
Multiple Log Formats in Same Directory Not Supported
If the log directory contains both logs in W3C format and logs in Squid format, reports may
display incorrect data. Workaround: Avoid mixing log formats in the log directory; put the
W3C logs in a separate directory. Sawmill for Cisco IronPort officially supports the Squid
format. [Defect ID: 53890]
display incorrect data. Workaround: Avoid mixing log formats in the log directory; put the
W3C logs in a separate directory. Sawmill for Cisco IronPort officially supports the Squid
format. [Defect ID: 53890]
“Date Offset” Supports Whole Hours Only
If you enter fractional hours (for example, 9.5) when manually adjusting the time zone (“Date
offset”) in the Sawmill Profile, Sawmill for IronPort reports do not display the correct time.
[Defect ID: 43693]
offset”) in the Sawmill Profile, Sawmill for IronPort reports do not display the correct time.
[Defect ID: 43693]
Generating “All Reports” Does Not Always Work if the Database Is Large
Attempting to generate all reports at once sometimes causes errors if the database is large.
Workaround: Schedule reports to be generated individually. [Defect ID: 49122]
Workaround: Schedule reports to be generated individually. [Defect ID: 49122]
Zoomed Reports Show Zero Results When Using Global Filters in Some Cases
When you zoom in on data using a Global Filter that uses an expression with an OR clause,
the data sometimes erroneously shows zero results.
the data sometimes erroneously shows zero results.
Workaround: Rewrite the expression so it does not use an OR clause.
Custom URL Category Number Erroneously Appears as Access Policy Name
In versions of AsyncOS for Web before version 6.0, when an Access Policy allowed a
transaction due to an allowed custom URL category, the custom URL category number
appears as the Access Policy name in Sawmill for IronPort. For example, the Web Security
transaction due to an allowed custom URL category, the custom URL category number
appears as the Access Policy name in Sawmill for IronPort. For example, the Web Security
WSA_Sawmill.book Page 16 Monday, March 15, 2010 10:31 AM