Cisco Cisco Web Security Appliance S160 User Guide
G L O B A L F I L T E R S
C H A P T E R 4 : R E A D I N G A C C E S S L O G S W I T H S A W M I L L F O R I R O N P O R T
47
The three radio buttons are the three options for the way in which Sawmill can match what
you want to see in the reports. Select the one you want to use, type in the search string, and
click OK. These are examples of what you will see:
you want to see in the reports. Select the one you want to use, type in the search string, and
click OK. These are examples of what you will see:
The Name filter will match exactly what you type in, so if you type in “192.168.1.200” as the
client IP address, Sawmill will look for that string and show you all matches for it in the
report.
client IP address, Sawmill will look for that string and show you all matches for it in the
report.
The Wildcard Expression filter matches using the standard Windows wildcard characters (*
and ? among others). If you type “192.168.1.2*” as the MIME type, Sawmill will return all
MIME types that start with “192.168.1.2“.
and ? among others). If you type “192.168.1.2*” as the MIME type, Sawmill will return all
MIME types that start with “192.168.1.2“.
The Regular Expression filter matches using a regular expression processor. Regular
expressions are more powerful and flexible than wildcard expressions.
expressions are more powerful and flexible than wildcard expressions.
Consider the following regular expression:
WSA_Sawmill.book Page 47 Tuesday, February 22, 2011 2:54 PM