Utilizing Cisco WSA Proxy Track Stats Log to Troubleshoot/Monitor Prox

[kostasthedelegate]

Hello 

Does anyone knows more about WSA Proxy Track Stats Log 

How we enable it or how to view it

Thanks and regards, 

Konstantinos 

[balaji.bandi]

Do you have SMA to manage this, so you can use reporting tool to generate reports.

or you can do Log subscription get information.

https://www.cisco.com/c/en/us/support/docs/security/web-security-appliance/117830-qanda-wsa-00.html

there is good presentation Cisco Live - BRKSEC-3303

[fw_mon]

Hello @kostasthedelegate 

this is exactly what you're looking for: 

Cisco Web Security Appliance Insight

https://splunkbase.splunk.com/app/5524/ 

Visualize hidden Cisco Web Security Appliance (WSA) statistics, simplify troubleshooting, find performance issues.

The most important system log for performance troubleshooting on Cisco WSA is a "hidden" track_stats / prox_track log. It is not mentioned in official user guides. While it contains a lot of very helpful information, it cannot be configured, modified or pushed like other default log types, it must be retrieved using FTP/SCP. Cisco WSA Insight Splunk App provides visualization of prox_track and System Health (shd) logs, assists with troubleshooting of performance issues and gives insights into OS metrics. It can be used for ad-hoc troubleshooting or for continious monitoring of Cisco WSA.

How to enable and view: https://splunkbase.splunk.com/app/5524/#/details

How to get a most recent prox_track.log from WSA for an ad-hoc analysis: 

scp admin@wsa.example.com:/track_stats/prox_track.log .

Step-by-step Installation and configuration: https://youtu.be/aAUpTvLUI8A

Cisco Talk: https://www.ciscolive.com/c/dam/r/ciscolive/us/docs/2018/pdf/BRKSEC-3771.pdf (page 81)