Cisco Cisco Web Security Appliance S360 User Guide
D E B U G G I N G T H E S C H E D U L E R
C H A P T E R 4 : R E A D I N G A C C E S S L O G S W I T H S A W M I L L F O R I R O N P O R T
57
then the Single-page summary of the past 30 days will be sent to HRManager@example.com,
from IT@example.com, using the SMTP server at smtp.example.com. A list of available
reports can be displayed by running Sawmill from the command line with the “-p profilename
-a lr” options.
from IT@example.com, using the SMTP server at smtp.example.com. A list of available
reports can be displayed by running Sawmill from the command line with the “-p profilename
-a lr” options.
Debugging the Scheduler
Sawmill creates a file called TaskLog, in the LogAnalysisInfo directory, which contains a log of
all scheduled tasks that have run, as well as logs of all other actions Sawmill has taken, such
as view statistics or build database from the web interface. This log can be very helpful if you
are trying to debug a problem with the Scheduler.
all scheduled tasks that have run, as well as logs of all other actions Sawmill has taken, such
as view statistics or build database from the web interface. This log can be very helpful if you
are trying to debug a problem with the Scheduler.
Removing Database Data
When Sawmill for IronPort removes database data, it performs the following actions:
• Copies the main database table. Sawmill for IronPort creates a copy of the main database
table with some entries removed. If very little data is being removed, then the database
temporarily takes up almost two times the disk space that it normally does. This step is
relatively fast, especially if there is enough space on the storage device.
temporarily takes up almost two times the disk space that it normally does. This step is
relatively fast, especially if there is enough space on the storage device.
• Rebuilds the indices and cross references. After it finishes copying the main database
table and removing data, Sawmill for IronPort rebuilds the table’s indices and cross
references. These steps take about as long as they do during a database rebuild.
references. These steps take about as long as they do during a database rebuild.
Removing database data can last about 60% - 70% as a rebuild database operation if only a
small amount of data is being removed. The more data that is removed, the faster this
operation is. Therefore, IronPort recommends to not remove data from the database more
often than necessary. For example, do not remove data daily.
small amount of data is being removed. The more data that is removed, the faster this
operation is. Therefore, IronPort recommends to not remove data from the database more
often than necessary. For example, do not remove data daily.
Depending on the size of the database and the amount of data to remove, it might be faster to
rebuild the database without importing the older data you do not want instead of removing
the old data from the current database.
rebuild the database without importing the older data you do not want instead of removing
the old data from the current database.
WSA_Sawmill.book Page 57 Monday, March 15, 2010 10:31 AM