Cisco Cisco Web Security Appliance S190 Guía Del Usuario
66
S A W M I L L F O R I R O N P O R T 7 . 3 . 3 U S E R G U I D E
Log Processing Options
You can optimize Sawmill for IronPort when it processes access log files. You do that on the
Log Data > Log Processing page.
Log Data > Log Processing page.
Figure 5-2 shows the Log Processing page.
Figure 5-2 Log Processing Page
The most common settings to change on this page include the following fields:
• Log processing threads. When the machine hosting Sawmill for IronPort has multiple
processors, you can configure Sawmill for IronPort to take advantage of the extra
processing power. For more information, see “Working with Multiple CPUs” on page 66.
processing power. For more information, see “Working with Multiple CPUs” on page 66.
• Skip processed files on update by pathname. Sawmill for IronPort skips files which have
already been processed during a database update or add operation. It considers the log
file pathname to determine which files to skip. Whether or not you should enable this
setting depends on where the access logs are stored:
file pathname to determine which files to skip. Whether or not you should enable this
setting depends on where the access logs are stored:
• On the Web Security appliance. Do not enable this option. The access log file is
changing on the appliance, and this option should not be enabled when the log
source is changing.
source is changing.
• On an FTP server. Enable this option to increase performance.
Working with Multiple CPUs
If the machine hosting Sawmill for IronPort has multiple CPUs or CPU cores, consider
configuring each profile to take advantage of each CPU or CPU core. To do this, go to Config
> Log Data > Log Processing. In the “Log processing threads” field, enter the number of CPUs
or CPU cores.
configuring each profile to take advantage of each CPU or CPU core. To do this, go to Config
> Log Data > Log Processing. In the “Log processing threads” field, enter the number of CPUs
or CPU cores.
For one CPU or core, leave the default value of zero (0). Entering “1” to indicate one CPU or
core decreases performance.
core decreases performance.
WSA_Sawmill.book Page 66 Tuesday, February 22, 2011 2:54 PM