How to – Cisco Web Security Reporting with Webspy Vantage

Below is a series of videos that walk you through the process of Cisco Web Security Reporting with WebSpy Vantage, including importing your Cisco Web Security (IronPort) log files, and configuring the entire reporting process with WebSpy Vantage. But first, WebSpy Vantage needs to be able to access compatible Cisco WSA log files.

Configure Cisco WSA’s Logging

WebSpy Vantage can import multiple log files simultaneously using its multi-threaded architecture. Unfortunately, the IronPort FTP server does not handle multiple connections well, and as such can cause issues for Vantage during import.

WebSpy recommends configuring your Cisco Web Security appliance to log to a separate FTP server, then import the text files into Vantage. This has the added benefit of increasing the speed at which the logs get imported as importing over FTP can be very slow.

Note: You can import directly from the IronPort’s internal FTP server, however we recommend you disable multi-processing in Tools | Options | Performance while importing. To configure IronPort’s logging options:

  1. Click Log Subscriptions on the ‘System Administration’ drop down menu.

    Cisco Web Security Reporting (IronPort) Log Subscription Settings

    Cisco Web Security (IronPort) Log Subscription Settings

  2. Click on accesslogs under the ‘Log Name’ column.
  3. Set the log style to ‘Squid Details’
  4. WebSpy supports some custom fields that you can add to your log file. Authenticated Username (%A), Group (%g), Request Body Size (%q) and Response Body Size (%b). You can enter these fields as required in the Custom Fields edit box. Just make sure that Request Body Size precedes Response Body Size.
  5. Set the Retrieval Method to FTP on Remote Server.
  6. Leave the Maximum Time Interval between Transferring as the default (3600). Enter the FTP Host, Directory, Username and Password of the Remote FTP server that you will transfer the log files to. WebSpy recommends installing an FTP server on the same machine running WebSpy Vantage, and transferring the log files to that machine. The closer the log files are to WebSpy Vantage, the faster the import will be.

    Cisco IronPort Logging Settings

    Cisco IronPort Logging Settings

  7. Click submit to save your changes.

How to – Cisco Web Security Reporting (IronPort) with Webspy Vantage

Once you have exported your IronPort access logs, this series of videos takes you through importing your logs into WebSpy Vantage, analyzing data on the Summaries screen, creating department reports and publishing them to the right person in your Organization using the Vantage Web Module.