Cisco Cisco Web Security Appliance S670 User Guide

You can optimize Sawmill for IronPort when it processes access log files. You do that on the 
Log Data > Log Processing page. 

Figure 5-2 shows the Log Processing page. 

Figure 5-2 Log Processing Page

The most common settings to change on this page include the following fields:

• Log processing threads. When the machine hosting Sawmill for IronPort has multiple 

processors, you can configure Sawmill for IronPort to take advantage of the extra 
processing power. For more information, see “Working with Multiple CPUs” on page 64.

• Skip processed files on update by pathname. Sawmill for IronPort skips files which have 

already been processed during a database update or add operation. It considers the log 
file pathname to determine which files to skip. Whether or not you should enable this 
setting depends on where the access logs are stored:

• On the Web Security appliance. Do not enable this option. The access log file is 

changing on the appliance, and this option should not be enabled when the log 
source is changing.

• On an FTP server. Enable this option to increase performance.

If the machine hosting Sawmill for IronPort has multiple CPUs or CPU cores, consider 
configuring each profile to take advantage of each CPU or CPU core. To do this, go to Config 
> Log Data > Log Processing. In the “Log processing threads” field, enter the number of CPUs 
or CPU cores. 

For one CPU or core, leave the default value of zero (0). Entering “1” to indicate one CPU or 
core decreases performance.

WSA_Sawmill.book  Page 64  Monday, March 15, 2010  10:31 AM