Cisco Cisco Web Security Appliance S170 사용자 가이드
20
S A W M I L L F O R I R O N P O R T 7 . 3 . 2 U S E R G U I D E
O V E R V I E W
You can install Sawmill for IronPort on the following platforms:
• Microsoft Windows, 32-bit
• Microsoft Windows, 64-bit
• Red Hat Linux Enterprise, 64-bit
Sawmill for IronPort runs as a web server. You can access it by opening a web browser to the
following URL:
following URL:
http://<Sawmill_hostname_or_IP_address>:8987/
Note — On Windows, Sawmill for IronPort runs as the SYSTEM user by default, which is the
most secure approach, but restricts access to network shares or mapped drives. If Sawmill for
IronPort needs to access some mapped drives and have different network privileges, you can
run it as a different Windows user. For information on how to do this, see “Accessing
Windows Mapped Drives” on page 25.
most secure approach, but restricts access to network shares or mapped drives. If Sawmill for
IronPort needs to access some mapped drives and have different network privileges, you can
run it as a different Windows user. For information on how to do this, see “Accessing
Windows Mapped Drives” on page 25.
Installing and configuring Sawmill for IronPort is a multiple step process. You must complete
the following steps:
the following steps:
• Configure any antivirus software. If the machine that runs Sawmill for IronPort also runs
some antivirus software, then you need to configure the antivirus software to not interfere
with the Sawmill database files. To do this, configure the antivirus software to not scan the
LogAnalysisInfo directory in the Sawmill for IronPort installation directory. This can
potentially increase Sawmill for IronPort performance and can prevent inconsistent
behavior when the antivirus software tries to “cleanse” some of the Sawmill database files.
with the Sawmill database files. To do this, configure the antivirus software to not scan the
LogAnalysisInfo directory in the Sawmill for IronPort installation directory. This can
potentially increase Sawmill for IronPort performance and can prevent inconsistent
behavior when the antivirus software tries to “cleanse” some of the Sawmill database files.
WARNING: If an antivirus program scans the Sawmill for IronPort installation directory,
Sawmill for IronPort performance can be severely impacted and the main database might
become corrupt. Verify no antivirus program scans this directory.
Sawmill for IronPort performance can be severely impacted and the main database might
become corrupt. Verify no antivirus program scans this directory.
• Install and configure Sawmill for IronPort. Run the Sawmill installer and configure
Sawmill for your log data. For more information, see “Installing and Configuring Sawmill
for IronPort” on page 21.
for IronPort” on page 21.
WSA_Sawmill.book Page 20 Monday, March 15, 2010 10:31 AM