Cisco Cisco Email Security Appliance C160 Mode D'Emploi

Log files can be retrieved based upon one of the following file transfer protocols. You set the protocol 
while creating or editing the log subscription in the GUI or via the 

logconfig

 command during the log 

subscription process.

AsyncOS creates a directory for each log subscription based on the log subscription name. The actual 
name of the log file in the directory is composed of the log filename specified by you, the timestamp 
when the log file was started, and a single-character status code. The filename of logs are made using 
the following formula: 

/LogSubscriptionName/LogFilename.@timestamp.statuscode 

Status codes may be 

.current

 or 

.s

 (signifying saved). You should only transfer or delete log files with 

the saved status. 

Log files are created by log subscriptions, and are rolled over (and transferred, if a push-based retrieval 
option is selected) based on the first user-specified condition reached: maximum file size or scheduled 
rollover. Use the 

logconfig

 command in the CLI or the Log Subscriptions page in the GUI to configure 

both the maximum file size and time interval for scheduled rollovers. You can also use the Rollover Now 
button in the GUI or the 

rollovernow

 command in the CLI to rollover selected log subscriptions. See 

 for more information on scheduling rollovers.

Logs retrieved using manual download are saved until they reach the maximum number you specify (the 
default is 10 files) or until the system needs more space for log files. 

This method lets you access log files at any time by clicking a link to the log directory 
on the Log Subscriptions page, then clicking the log file to access. Depending on your 
browser, you can view the file in a browser window, or open or save it as a text file. This 
method uses the HTTP(S) protocol and is the default retrieval method. 

Using this method, you cannot retrieve logs for any computer in a cluster, 
regardless of level (machine, group, or cluster), even if you specify this method 
in the CLI. 

This method periodically pushes log files to an FTP server on a remote computer. The 
subscription requires a username, password, and destination directory on the remote 
computer. Log files are transferred based on a rollover schedule set by you. 

This method periodically pushes log files to an SCP server on a remote computer. This 
method requires an SSH SCP server on a remote computer using the SSH1 or SSH2 
protocol. The subscription requires a username, SSH key, and destination directory on 
the remote computer. Log files are transferred based on a rollover schedule set by you.

This method sends log messages to a remote syslog server. This method conforms to 
RFC 3164. You must submit a hostname for the syslog server and choose to use either 
UDP or TCP for log transmission. The port used is 514. A facility can be selected for the 
log; however, a default for the log type is pre-selected in the dropdown menu. Only 
text-based logs can be transferred using syslog push.