Cisco Cisco Web Security Appliance S690 User Guide
26
S A W M I L L F O R I R O N P O R T 7 . 3 . 3 U S E R G U I D E
WO R K I N G W I T H T I M E Z O N E S
The Web Security appliance access logs record log times in UNIX time, which uses no time
zone information. The times recorded in the access logs are independent of the time zone
setting on each Web Security appliance.
zone information. The times recorded in the access logs are independent of the time zone
setting on each Web Security appliance.
Therefore, if you want to the reports in Sawmill for IronPort to display the local time on the
Web Security appliance from which the access logs came, you need to manually adjust the
time zone in the Sawmill Profile. Do this in the “Date offset” field on the Config page > Log
Data > Log Processing.
Web Security appliance from which the access logs came, you need to manually adjust the
time zone in the Sawmill Profile. Do this in the “Date offset” field on the Config page > Log
Data > Log Processing.
For example, if the Web Security appliance is in the Pacific Standard Time zone, enter “-8” in
the “Data offset” field. Note that the Web Security appliance uses the POSIX-style method of
indicating the time zone using a GMT offset. So, for the Pacific Standard Time zone, the Web
Security appliance is configured for GMT+8, and the Sawmill Profile is configured for “-8.”
the “Data offset” field. Note that the Web Security appliance uses the POSIX-style method of
indicating the time zone using a GMT offset. So, for the Pacific Standard Time zone, the Web
Security appliance is configured for GMT+8, and the Sawmill Profile is configured for “-8.”
WSA_Sawmill.book Page 26 Tuesday, February 22, 2011 2:54 PM