Cisco Cisco Content Security Management Appliance M390 User Guide

AsyncOS generates the following log types:

The authentication log records successful logins and unsuccessful login attempts, 
for locally and externally authenticated users, for both GUI and CLI access to the 
Security Management appliance. 

In Debug and more verbose modes, if external authentication is turned on, all 
LDAP queries appear in these logs. 

Backup logs record the backup process from start to finish. 

Information about backup scheduling is in the SMA logs. 

The CLI audit logs record all CLI activity on the system. 

Configuration history logs record the following information: What changes were 
made on the Security Management appliance, and when were the changes made? 
A new configuration history log is created each time a user commits a change.

FTP logs record information about the FTP services enabled on the interface. 
Connection details and user activity are recorded. 

GUI logs include a history of page refreshes in the web interface, session data, 
and the pages a user accesses. You can use the gui_log to track user activity or 
investigate errors that users see in the GUI.  The error traceback will normally be 
in this log. 

GUI logs also include information about SMTP transactions, for example 
information about scheduled reports emailed from the appliance. 

HTTP logs record information about the HTTP and secure HTTP services 
enabled on the interface. Because the graphical user interface (GUI) is accessed 
through HTTP, the HTTP logs are essentially the GUI equivalent of the CLI audit 
logs. Session data (for example, new sessions and expired sessions) are recorded, 
as well as the pages accessed in the GUI. 

Haystack logs record web transaction tracking data processing. 

Text mail logs record information about the operations of the email system (for 
example, message receiving, message delivery attempts, opening and closing 
connections, bouncing messages, and so forth). 

For important information about when attachment names are included in mail 
logs, see 

.

Use these logs to debug problems when you are configuring LDAP in System 
Administration > LDAP. 

For example, these logs record the results of clicking the Test Server and Test 
Queries buttons. 

For information about failed LDAP authentications, see the Authentication logs. 

NTP logs record the conversation between the appliance and any configured 
Network Time Protocol (NTP) servers. For information about configuring NTP 
servers, see 

. 

Reporting logs record actions associated with the processes of the centralized 
reporting service.