Cisco Cisco Web Security Appliance S670
4
Release Notes for Cisco IronPort AsyncOS for Web 7.5.2-118
7.5.2
Installation and Upgrade Notes
Compatibility with AsyncOS for Security Management
Features on AsyncOS 7.5.2-118 for Web are only supported by AsyncOS for Security Management
version 7.9.1 HP3 and above. The reverse is also true: AsyncOS for Security Management version 7.9.1
HP3 is only compatible with AsyncOS 7.5.2-126. For more information about compatibility between the
Web Security appliance and Security Management appliance, see the compatibility matrix in the release
notes for the Security Management appliance posted on the Cisco products web site:
version 7.9.1 HP3 and above. The reverse is also true: AsyncOS for Security Management version 7.9.1
HP3 is only compatible with AsyncOS 7.5.2-126. For more information about compatibility between the
Web Security appliance and Security Management appliance, see the compatibility matrix in the release
notes for the Security Management appliance posted on the Cisco products web site:
http://www.cisco.com/en/US/products/ps10155/prod_release_notes_list.html
New Features
Caching for Syslog Push Log Subscriptions
You can now use the logconfig command to configure a local disk buffer for a syslog push log
subscription to allow AsyncOS to cache log events when the remote syslog server is unavailable. When
the syslog server becomes available, AsyncOS begins sending all the data in the buffer for that log
subscription to the syslog server.
subscription to allow AsyncOS to cache log events when the remote syslog server is unavailable. When
the syslog server becomes available, AsyncOS begins sending all the data in the buffer for that log
subscription to the syslog server.
Before You Begin
•
Create the syslog push log subscription (use TCP for transport) if it does not already exist.
•
Ensure the syslog server is running before starting this procedure to avoid log data loss.
•
Determine the size of the local disk buffer, allowing enough space to accomodate the maximum
expected period of down time for the syslog server. This avoids loss of log data.
expected period of down time for the syslog server. This avoids loss of log data.
•
If you have a secondary log subscription for local retention, Cisco recommends you cancel the
secondary subscription to allow space for the local disk buffer for the primary subscription.
secondary subscription to allow space for the local disk buffer for the primary subscription.
•
Be aware that AsyncOS may not be able to cache the first several seconds of log data after loss of
connection to the syslog server. This is due to characteristics of syslog over TCP.
connection to the syslog server. This is due to characteristics of syslog over TCP.
•
Allow a buffer initialization period of 10 minutes per 50 GB of disk buffer size before sending data
to the Web Security Appliance.
to the Web Security Appliance.
Step 1
Use the logconfig CLI command to edit the syslog push log subscription:
mail3.example.com> logconfig
Choose the operation you want to perform:
- NEW - Create a new log.
- EDIT - Modify a log subscription.
- DELETE - Remove a log subscription.
- HOSTKEYCONFIG - Configure SSH host keys.
[]>edit
Step 2
Identify the log subscription by number.
Step 3
Accept the existing values for these options:
•
Log name
•
Log style
•
HTTP Error Status Codes