Sawmill Integration

Unanswered Question
Feb 22nd, 2009

Pardon if this is a bumb question, but how exactly does Sawmill "integrate" with the WSA? When creating a profile, where the logs? I would suspect on the WSA.

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
staylor_ironport Sun, 02/22/2009 - 23:20

Hi BigDave,
There are multiple options available when configuring Sawmill, I believe that the preferred option is to configure each WSA to push the logs to a remote server via FTP, this remote server could be the same system hosting Sawmill.
Doing it this way will ensure that there are the most up to date logs on the sawmill server. Or if you prefer you can configure Sawmill to FTP to the WSA and collect that way.

jowolfer Mon, 02/23/2009 - 15:46

Staylor pretty much summed it up. The most common is to have each WSA push to the same FTP server. This FTP is typically the Sawmill server.

dmiller227 Wed, 02/25/2009 - 20:05

What's the best way to "prepare" the WSA to send its logs to an external FTP server? I did see where they are stored on the appliance itself.

jowolfer Thu, 02/26/2009 - 18:23

BigDave,

There isn't much that needs to be done. Just setup the access logs, under log subscriptions. You can change it to ftp to a server.

dmiller227 Thu, 02/26/2009 - 21:05

As opposed to what it says now? For instance, change ftp:///accesslogs to ftp:///accesslogs.

jowolfer Fri, 02/27/2009 - 18:32

You just need to change it under "Retrieval Method" from

"FTP on "

to

"FTP on Remote Server"

dmiller227 Fri, 02/27/2009 - 18:41

Awesome. Thanks Josh. I also just pointed the Sawmill profile to the WSA's FTP server. For now at least. This was to just show the customer what it looked like. Tey are going to implement a remote FTP server.

Actions

This Discussion