Sawmill Integration

dmiller227 · ‎02-22-2009

Pardon if this is a bumb question, but how exactly does Sawmill "integrate" with the WSA? When creating a profile, where the logs? I would suspect on the WSA.

staylor_ironport · ‎02-22-2009

Hi BigDave,
There are multiple options available when configuring Sawmill, I believe that the preferred option is to configure each WSA to push the logs to a remote server via FTP, this remote server could be the same system hosting Sawmill.
Doing it this way will ensure that there are the most up to date logs on the sawmill server. Or if you prefer you can configure Sawmill to FTP to the WSA and collect that way.

jowolfer · ‎02-23-2009

Staylor pretty much summed it up. The most common is to have each WSA push to the same FTP server. This FTP is typically the Sawmill server.

dmiller227 · ‎02-25-2009

Thanks guys. I'll make it so.

Take Care!

dmiller227 · ‎02-25-2009

What's the best way to "prepare" the WSA to send its logs to an external FTP server? I did see where they are stored on the appliance itself.

jowolfer · ‎02-26-2009

BigDave,

There isn't much that needs to be done. Just setup the access logs, under log subscriptions. You can change it to ftp to a server.

dmiller227 · ‎02-26-2009

As opposed to what it says now? For instance, change ftp:///accesslogs to ftp:///accesslogs.

jowolfer · ‎02-27-2009

You just need to change it under "Retrieval Method" from

"FTP on "

to

"FTP on Remote Server"

dmiller227 · ‎02-27-2009

Awesome. Thanks Josh. I also just pointed the Sawmill profile to the WSA's FTP server. For now at least. This was to just show the customer what it looked like. Tey are going to implement a remote FTP server.