Cisco Cisco Web Security Appliance S160 User Guide
40
S A W M I L L F O R I R O N P O R T 7 . 3 . 3 U S E R G U I D E
WO R K I N G W I T H P R O F I L E S
You can create a profile at any time. The number of profiles you can create is determined by
the license you purchase. Some of the profile options define the following:
the license you purchase. Some of the profile options define the following:
• Log source to analyze. A single profile can analyze one or more access logs.
• Log database. Profiles create and use a database containing the processed log data. Use
the internal Sawmill database with Sawmill for IronPort.
• Reports. Each profile includes reports that display the data using tables and graphs.
Sawmill for IronPort uses reports defined by IronPort, and the included reports depend on
the profile type, either Sec Ops of HR. You can create new and modify existing reports, if
necessary.
the profile type, either Sec Ops of HR. You can create new and modify existing reports, if
necessary.
After you create a profile, you can view its reports on the Reports page. Sawmill reads and
processes the log data to build its database, and then displays the reports. You can also
configure the different profile options on the Config page.
processes the log data to build its database, and then displays the reports. You can also
configure the different profile options on the Config page.
Creating a Profile
To create a profile:
1. Go to the Admin page.
2. Click Create New Profile.
The New Profile Wizard appears in a separate browser window.
3. On the Log Source screen, enter the following information:
Field
Description
Log source
Specify how Sawmill should access the access log file:
• Local disk. Click Browse to locate the path on the local machine.
• FTP server. Enter the host name of the FTP server and the user name
• Local disk. Click Browse to locate the path on the local machine.
• FTP server. Enter the host name of the FTP server and the user name
and password used to access the server.
• HTTP server. Enter the host name of the HTTP server.
The source type you choose depends on how you choose to deploy
Sawmill for IronPort. For more information choosing how to deploy
Sawmill for IronPort, see “Deployment Planning” on page 9.
The source type you choose depends on how you choose to deploy
Sawmill for IronPort. For more information choosing how to deploy
Sawmill for IronPort, see “Deployment Planning” on page 9.
Pathname
Enter the directory path on the machine hosting the access log file that
contains the access log file. If the access log file is on a local or network
drive, you can use the Browse button to navigate to the directory.
contains the access log file. If the access log file is on a local or network
drive, you can use the Browse button to navigate to the directory.
Process subfolders
Choose whether or not to also process data in sub directories of the path
specified in the pathname field. This field only applies to log files stored
on the machine hosting Sawmill.
specified in the pathname field. This field only applies to log files stored
on the machine hosting Sawmill.
WSA_Sawmill.book Page 40 Tuesday, February 22, 2011 2:54 PM