topic Re: Sawmill Integration in Web Security

Sawmill Integration

dmiller227 — Mon, 23 Feb 2009 02:43:00 GMT

Pardon if this is a bumb question, but how exactly does Sawmill "integrate" with the WSA? When creating a profile, where the logs? I would suspect on the WSA.

Re: Sawmill Integration

staylor_ironport — Mon, 23 Feb 2009 07:20:46 GMT

Hi BigDave,
There are multiple options available when configuring Sawmill, I believe that the preferred option is to configure each WSA to push the logs to a remote server via FTP, this remote server could be the same system hosting Sawmill.
Doing it this way will ensure that there are the most up to date logs on the sawmill server. Or if you prefer you can configure Sawmill to FTP to the WSA and collect that way.

Re: Sawmill Integration

jowolfer — Mon, 23 Feb 2009 23:46:48 GMT

Staylor pretty much summed it up. The most common is to have each WSA push to the same FTP server. This FTP is typically the Sawmill server.

Re: Sawmill Integration

dmiller227 — Wed, 25 Feb 2009 23:20:26 GMT

Thanks guys. I'll make it so.

Take Care!

Re: Sawmill Integration

dmiller227 — Thu, 26 Feb 2009 04:05:39 GMT

What's the best way to "prepare" the WSA to send its logs to an external FTP server? I did see where they are stored on the appliance itself.

Re: Sawmill Integration

jowolfer — Fri, 27 Feb 2009 02:23:39 GMT

BigDave,

There isn't much that needs to be done. Just setup the access logs, under log subscriptions. You can change it to ftp to a server.

Re: Sawmill Integration

dmiller227 — Fri, 27 Feb 2009 05:05:32 GMT

As opposed to what it says now? For instance, change ftp:///accesslogs to ftp:///accesslogs.

Re: Sawmill Integration

jowolfer — Sat, 28 Feb 2009 02:32:16 GMT

You just need to change it under "Retrieval Method" from

"FTP on "

to

"FTP on Remote Server"

Re: Sawmill Integration

dmiller227 — Sat, 28 Feb 2009 02:41:19 GMT

Awesome. Thanks Josh. I also just pointed the Sawmill profile to the WSA's FTP server. For now at least. This was to just show the customer what it looked like. Tey are going to implement a remote FTP server.