Sawmill for ironport integration

Unanswered Question
Jan 3rd, 2011

Hi,

   I want to configure sawmill 7.3.2 for ironport S160. Does anybody have sample template to configure it and specially how to use log_format while creating profile, i tried many times but it always fails. Do i have to configure something on WSA as well ?

Please let me know the hardware requirement for installing sawmill for organization having 200 users.

Look forward to hearing from someone.

Thanks & Regards

Ahmed

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Average Rating: 0 (0 ratings)
josedia Tue, 01/18/2011 - 22:33

If you already downloaded Sawmill from Cisco's website you already should have all you may need.

Install it in an suitable computer and determine whether you are pushing the logs from the appliance or you are pulling them from sawmill. I would recomend the first option as it is regular log rotation that forces the appliance to drop a  the rotated and closed logs.

Read the included essential documentation on the package. Define the logs and the profile on the sawmill  setup and you are done once you are able to have the files on the sawmill machine. Usually you shold do nothing beyond defining the way you are rotating and pushing the logs. Check WSA manuals as well as Sawmil.

ahmed.gadi Wed, 01/19/2011 - 00:58

Thanks you Jose..

I managed to integrate sawmill with ironport and its working very well. Actually i was little confuse while selecting LOG FORMAT (HR or SEC_OP), but now its working fine and even got license from ironport for 5 profiles.

Thanks...

mkimatl230 Tue, 01/25/2011 - 17:32

Thinking about possibly using Sawmill in our office.  Is this a free install if you already own Ironport web appliance?

Thanks,

Mike

jowolfer Wed, 02/09/2011 - 11:18

Michael,

The Sawmill for IronPort license is a separate purchase than the other licenses. If you already own Sawmill, you can likely get the WSA logs to import, but you will not have the Sawmill for IronPort specific reports.

Josh

Actions

Login or Register to take actions

This Discussion

Posted January 3, 2011 at 10:19 AM
Stats:
Replies:4 Avg. Rating:
Views:1186 Votes:0
Shares:0

Related Content

Discussions Leaderboard