staylor_ironport Sun, 02/22/2009 - 23:20
User Badges:

Hi BigDave,
There are multiple options available when configuring Sawmill, I believe that the preferred option is to configure each WSA to push the logs to a remote server via FTP, this remote server could be the same system hosting Sawmill.
Doing it this way will ensure that there are the most up to date logs on the sawmill server. Or if you prefer you can configure Sawmill to FTP to the WSA and collect that way.

jowolfer Mon, 02/23/2009 - 15:46
User Badges:

Staylor pretty much summed it up. The most common is to have each WSA push to the same FTP server. This FTP is typically the Sawmill server.

dmiller227 Wed, 02/25/2009 - 20:05
User Badges:

What's the best way to "prepare" the WSA to send its logs to an external FTP server? I did see where they are stored on the appliance itself.

jowolfer Thu, 02/26/2009 - 18:23
User Badges:

BigDave,

There isn't much that needs to be done. Just setup the access logs, under log subscriptions. You can change it to ftp to a server.

dmiller227 Thu, 02/26/2009 - 21:05
User Badges:

As opposed to what it says now? For instance, change ftp:///accesslogs to ftp:///accesslogs.

jowolfer Fri, 02/27/2009 - 18:32
User Badges:

You just need to change it under "Retrieval Method" from

"FTP on "

to

"FTP on Remote Server"

dmiller227 Fri, 02/27/2009 - 18:41
User Badges:

Awesome. Thanks Josh. I also just pointed the Sawmill profile to the WSA's FTP server. For now at least. This was to just show the customer what it looked like. Tey are going to implement a remote FTP server.

Actions

This Discussion