Proxy Configuration for Cisco WSA (Legacy)

Add and Edit Log Subscriptions

1. Go to System Administration > Log Subscriptions.
   
2. To add a log subscription, click Add Log Subscription. Or, to edit a log subscription, in the Log Name field, click the name of the log file. The New Log Subscription page or Edit Log Subscription displays.
3. From the Log Type field, select the type of log to associate with this subscription. Choose W3C Access Log.
4. In the Log Name field, enter a name for the log subscription. This name is used for the directory on the appliance that will contain the log file.
5. Choose the fields you want to include in the W3C access log. Select a field in the Available Fields list, or enter a field in the Custom Field box and click Add.
6. To edit the fields in the Selected Log Fields list:
   • The order of the fields in the list determine the order of fields in the W3C access log file. To change the order, use the Move Up and Move Down buttons.
   • To remove a field, in the Select Log Fields list, select it and click Remove.
   • You may enter multiple user-defined fields in the Custom Fields field and add them simultaneously, as long as each entry is separated by a new line (press Enter) before you click Add.
7. Add these fields:
   
   1. c-ip %a Client IP Address.
   2. cs(User-Agent) %u User agent. This field is written with double-quotes in the access logs.
   3. cs-byte s %q Request size (headers + body).
   4. cs-mime-type %c Response body MIME type. This field is written with double-quotes in the access logs.
   5. cs-url %Y The entire URL.
   6. cs-username %A Authenticated user name. This field is written with double-quotes in the access logs.
   7. s-hostname %d Data source or server IP address.
   8. s-ip %k Data source IP address (server IP address).
   9. sc-bytes %s Response size (header + body).
   10. sc-http-statusß %h HTTP response code.
   11. sc-result-code %w Result code For example: TCP_MISS, TCP_HIT.
   12. sc-result-code-denial %W Result code denial.
   13. timestamp %t Timestamp in UNIX epoch.
8. In the File Name field, enter a name for the log file.
9. In the Maximum File Size field enter the maximum possible file size of the log file in bytes. After the number, enter the appropriate letter:
   • G for Gigabytes
   • M for Megabytes
   • K for Kilobytes
10. In the Log Compression field, select Enable to compress log files after they have been rolled over.
11. In the Retrieval Method field, select a method to retrieving the log file from the appliance.
12. Click Submit to commit your changes.
13. If you chose SCP as the retrieval method, the appliance displays an SSH key you must add to the SCP server host.

Configure Log Retrieval

There are four options for log retrieval, as shown. FTP is the default option.