Cisco Cisco Web Security Appliance S670 User Guide

If you find that the application is not indexing files for any type of configured input because of a 
checksum error, add the line 

crcSalt = <source>

 to each input stanza in the 

inputs.conf

 file. (The 

following section, 

, describes 

editing the 

inputs.conf

 file.)

If the file 

inputs.conf

 does not exist in the directory 

<install_home>/cisco_wsa_reporting/etc/apps/cisco_wsa_reporting/local/

, create the 

input-configuration file: 

<install_home>/cisco_wsa_reporting/etc/apps/cisco_wsa_reporting/local/inputs.conf

. 

Using a text editor, open 

<install_home>/cisco_wsa_reporting/etc/apps/cisco_wsa_reporting/local/inputs.conf

. 

Add a segment as below:-

[batch:///home/logger/incoming/wsa176.wga/accesslogs/*]

host_segment = 4

disabled = false

sourcetype = wsa_accesslogs

move_policy = sinkhole

Where the first line is the FTP directory path where WSA logs are sent. The second line is the part of 
the FTP path containing the host name. The third line enables this FTP input. The fourth line specifies 
the source of this input. The final line, 

move_policy = sinkhole

, enables deletion of the original data 

once it is indexed. 

Save the 

inputs.conf

 file and then restart the Advanced Web Security Reporting application by 

navigating to Settings > System > Server controls and clicking Restart.

Know the path to your log files: 

.

Log into the Advanced Web Security Reporting application as 

admin

.