Cisco Cisco Web Security Appliance S160 User Guide

.

.

Be aware that this method of viewing is for log files that are stored on the appliance. The process of 
viewing files stored externally goes beyond the scope of this documentation.

Choose System Administration > Log Subscriptions. 

Click the name of the log subscription in the Log Files column of the list of log subscriptions. 

When prompted, enter the administers username and passphrase for accessing the appliance.

When logged in, click one of the log files to view it in your browser or to save it to disk.

Refresh the browser for updated results.

If a log subscription is compressed, download, decompress, and then open it.

.

.

Access log files provides a descriptive record of all Web Proxy filtering and scanning activity. Access 
log file entries display a record of how the appliance handled each transaction. 

Access logs are available in two formats: Standard and W3C compliant. W3C-compliant log files are 
more customizable with regard to their content and layout than standard Access logs.

The following text is an example access log file entry for a single transaction: 

1278096903.150 97 172.xx.xx.xx TCP_MISS/200 8187 GET http://my.site.com/ - 

DIRECT/my.site.com text/plain 

DEFAULT_CASE_11-PolicyGroupName-Identity-OutboundMalwareScanningPolicy-DataSecurityPolic

y-ExternalDLPPolicy-RoutingPolicy 

<IW_comp,6.9,-,"-",-,-,-,-,"-",-,-,-,"-",-,-,"-","-",-,-,IW_comp,-,"-","-","Unknown","Un

known","-","-",198.34,0,-,[Local],"-",37,"W32.CiscoTestVector",33,0,"WSA-INFECTED-FILE.p

df","fd5ef49d4213e05f448f11ed9c98253d85829614fba368a421d14e64c426da5e”> -