This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos UTM Log File

Hi all,

We are evaluating Sophos UTM (Version 9.310-11) and I'm trying to come to grips with a few things, in particular web caching and log files (specifically Web Filtering Log).

I found a .pdf document on the Sophos website (https://www.sophos.com/en-us/support/knowledgebase/115634.aspx) explaining many of the fields generated in a web filter log. However, it seems to be a little out of date.

For example, it states that if an object is returned from cache it will have a value of "1". However, I'm seeing values of cached="0", cached="4" and cached="8" in the web filtering log. Does anybody know the meaning of these values (I assume that "0" means that the object was returned from the Internet, not the cache) or is there a more up-to-date document outlining the fields in the various log files created by Sophos UTM?

Many thanks for your time and assistance,

John P.

This thread was automatically locked due to age.

0 teched_01 over 10 years ago

I asked much the same question last year and shared my observations.  https://community.sophos.com/products/unified-threat-management/astaroorg/f/53/t/34415  I have not checked 9.2 or 9.3 recently.

Give the knowledgebase article a bad score and mention the faults (incomplete, no longer current, etc) in the comments.

As you are evaluating can you ask your pre-sales contacts or reseller?  https://community.sophos.com/products/unified-threat-management/astaroorg/f/55/t/46255

Make or vote for an appropriate feature request at UTM (Formerly ASG) Feature Requests: Hot (2108 ideas) because it might get better visibility.

And a very tangental link:  https://community.sophos.com/products/unified-threat-management/astaroorg/f/51/p/22478/61160#61160
0 jperry_68 over 10 years ago

Hi Teched,

Thank you for your prompt and very helpful reply. We currently have MS TMG 2010 (with a GFI WebMonitor plugin) as a proxy. Sophos UTM goes some way towards being a candidate as a possible replacement, but falls short in a few areas. I have seen a heated discussion on this very forum (https://community.sophos.com/products/unified-threat-management/astaroorg/f/51/t/22667) in relation to this topic.
I will use the links you recommended to provide feedback to Sophos, hopefully they will eventually lead to some changes being made.

Thanks again and best regards,

John P.