Cisco Cisco Web Security Appliance S360 User Guide
K N O W N I S S U E S A N D L I M I T A T I O N S
C H A P T E R 1 : I N T R O D U C T I O N T O S A W M I L L F O R I R O N P O R T
19
Typo in the Daylight Savings Time Log Filter in the Online Help
The Daylight Savings Time log filter in the Sawmill for IronPort online help incorrectly refers
to
to
v.date_time_year
as
v_date_time_year
in a couple of places. All references in the
filter should read
v.date_time_year
; otherwise, a syntax errors occurs if you attempt to use
the filter.
[Defect ID: 49693]
Generating “All Reports” Does Not Always Work if the Database Is Large
Attempting to generate all reports at once sometimes causes errors if the database is large.
Workaround: Schedule reports to be generated individually.
Defect ID: 49122]
When Running on a 32-Bit Operating System, Sawmill for IronPort May Have Difficulty
Handling Access Logs Larger than 2G
Handling Access Logs Larger than 2G
When running on a 32-bit operating system, Sawmill for IronPort may have difficulty handling
access logs that are larger than 2G.
access logs that are larger than 2G.
Workaround: Set the maximum file size for access logs to 2G.
[Defect ID: 48407]
Custom URL Category Number Erroneously Appears as Access Policy Name
In versions of AsyncOS for Web before version 6.0, when an Access Policy allowed a
transaction due to an allowed custom URL category, the custom URL category number
appears as the Access Policy name in Sawmill for IronPort. For example, the Web Security
appliance access logs show “ALLOW_CUSTOMCAT-AccessPolicy1-1090519042” as part of
the ACL decision tag. In this example, “1090519042” appears as the Access Policy name
instead of “AccessPolicy1.”
transaction due to an allowed custom URL category, the custom URL category number
appears as the Access Policy name in Sawmill for IronPort. For example, the Web Security
appliance access logs show “ALLOW_CUSTOMCAT-AccessPolicy1-1090519042” as part of
the ACL decision tag. In this example, “1090519042” appears as the Access Policy name
instead of “AccessPolicy1.”
[Defect ID: 45336]
“Date Offset” Supports Whole Hours Only
If you enter fractional hours (for example, 9.5) when manually adjusting the time zone (“Date
offset”) in the Sawmill Profile, Sawmill for IronPort reports do not display the correct time.
[Defect ID: 43693]
offset”) in the Sawmill Profile, Sawmill for IronPort reports do not display the correct time.
[Defect ID: 43693]
Zoomed Reports Show Zero Results When Using Global Filters in Some Cases
When you zoom in on data using a Global Filter that uses an expression with an OR clause,
the data sometimes erroneously shows zero results.
the data sometimes erroneously shows zero results.
Workaround: Rewrite the expression so it does not use an OR clause.
WSA_Sawmill.book Page 19 Tuesday, February 22, 2011 2:54 PM