Which statement about WSA access logs that are to be processed by sawmill for cisco ironport is true?

Question

Options

• Athe default log format can be used
• Bthe fields"%XC%X n" must be appended to the default access log format
• Cany log format can beused , but all WSAs must use the same format
• Dany log format can be used. And different WSAs may use different formats

• A
  91% (49)
• B
  2% (1)
• C
  6% (3)
• D
  2% (1)

Explanation

Sawmill has built-in, native support for the Cisco IronPort WSA default access log format, meaning no customization or additional fields are required to parse and analyze the logs correctly. Option B is wrong because appending custom fields like %XC%Xn is unnecessary and could actually break Sawmill's expected parsing pattern. Option C is wrong on both counts - it incorrectly implies any format works and adds a false constraint that all WSAs must match; Sawmill specifically expects the default format, not an arbitrary one. Option D is similarly wrong because using different formats across WSAs would cause parsing inconsistencies and is not supported.

Memory tip: Think "Default = Done" - when Sawmill meets IronPort WSA, the default format is all you need. No tweaks, no tricks.

No community discussion yet for this question.