Information to Access-Log on WSA

[podhovnik]

Hi,

I have a question about the WSA access-log. There are a lot of "skipped" markings in the log.

What does that mean?

1295865776.044 118 10.100.1.221 TCP_MISS/200 21615 GET http://eicar.org/image/about_us/hgk_about_us.jpg - DIRECT/eicar.org image/jpeg DEFAULT_CASE_11-normal_User-normal_user-NONE-NONE-NONE-DefaultGroup <Comp,-,"Skipped","-",-,-,-,"Skipped","-",-,-,-,"-","Skipped",-,"-","-",-,-,Comp,-,"-","-","-","-","-","-",1465.42,0,-,"-","-"> -

1295865780.566 88 10.100.1.221 TCP_DENIED/403 2244 GET http://www.eicar.org/download/eicar.com - DIRECT/www.eicar.org application/octet-stream BLOCK_AMW_RESP_11-normal_User-normal_user-NONE-NONE-NONE-DefaultGroup <Comp,-,"Skipped","-",-,-,-,"Virus","-",0,1,6,"EICAR test file","Skipped",-,"-","-",-,-,Comp,-,"Virus","-","-","-","-","-",204.00,0,-,"-","-"> -
secproxy1.intra.graz.at>

regards

Andreas

[mart.pirita]

Are You using IronPort URL Filters or Cisco IronPort Web Usage Controls.

I'm using Cisco IronPort Web Usage Controlsand it shows:

IW_csec,-,"Unknown","-","Unknown","Unknown","-","-",462.00,0,-,"-","-">

Seems Your does not handle categorization and skips that part.

[jowolfer]

The first log line is for a .jpg image. Images are not sent through the scanning engines, so the engines were "skipped".

The second one was matched and detected by Mcafee. A decision to block the file was made after this detection, so the other scanning engines were skipped.