.

SAWMILL NEWS

Sawmill 8.0.0b1 ships (November 13, 2008)

Sawmill 8.0.0b1 is now available. Sawmill 8 is a major release of Sawmill, featuring a new web interface, support for Microsoft SQL Server and Oracle, role-based authentication, real-time reporting, and much more. This is the first beta beta version, and is not yet ready for production use. It may contain bugs which will be resolved by the final 8.0.0 release (in December, 2008).

Sawmill 7.2.15 ships (May 16, 2008)

Sawmill 7.2.15 is now available. Sawmill 7.2.15 is a minor upgrade, and is free for all Sawmill 7 users.

See the version history for complete details of all bugs fixed and features added in this release and earlier releases.

Sawmill 7.2.14 ships (March 26, 2008)

Sawmill 7.2.14 is now available. Sawmill 7.2.14 is a minor upgrade, and is free for all Sawmill 7 users.

Sawmill 7.2.14 improves performance of most table reports, by making the new "compute totals row from overview" functionality optional. It also fixes an issue with large database files on 64-bit Windows.

See the version history for complete details of all bugs fixed and features added in this release and earlier releases.

Sawmill 7.2.13 ships (February 22, 2008)

Sawmill 7.2.13 is now available. Sawmill 7.2.13 is a minor upgrade, and is free for all Sawmill 7 users.

Sawmill 7.2.13 fixes a new bug introduced in 7.2.12, which prevented scheduled tasks from running in some cases.

See the version history for complete details of all bugs fixed and features added in this release and earlier releases.

Sawmill 7.2.12 ships (February 15, 2008)

Sawmill 7.2.12 is now available. Sawmill 7.2.12 is a minor upgrade, and is free for all Sawmill 7 users.

See the version history for complete details of all bugs fixed and features added in this release and earlier releases.

Sawmill 7.2.11 ships (November 30, 2007)

Sawmill 7.2.11 is now available. Sawmill 7.2.11 is a minor upgrade, and is free for all Sawmill 7 users.

See the version history for complete details of all bugs fixed and features added in this release and earlier releases.

Sawmill 7.2.10 ships (August 4, 2007)

Sawmill 7.2.10 is now available. Sawmill 7.2.10 is a minor upgrade, and is free for all Sawmill 7 users.

See the version history for complete details of all bugs fixed and features added in this release and earlier releases.

Sawmill 7.2.9 ships (February 9, 2007)

Sawmill 7.2.9 is now available. Sawmill 7.2.9 is a minor upgrade, and is free for all Sawmill 7 users.

This version adds support for Datagram Syslog, Metavante CEB Failed Logins, LRS VPSX Accounting, qmail-scanner with dd/mm/yyyy format dates, Limelight Flash, OpenBSD Packet Filter (tcpdump -neqttr) Firewall, IronPort logging to a syslog, TACACS Accounting, and Sidewinder Firewall log formats.

This version also enhances Cisco PIX/ASA/Router/Switch, Juniper Secure Access SSL VPN, Microsoft Media Server, Interscan Messaging Security Suite, Snare, ISA CSV, IronPort, Ironmail Spam, Juniper Secure Access SSL VPN, MDaemon 8, Zywall, Firewall-1 NG, and MAILsweeper log formats.

This version fixes bugs in Rendering tables with subtables, referrer tracking, report filters containing $'s, task scheduling, month names in non-English installations, action emails, report emails, charset conversion, command-line options containing plusses, command-line options containing spaces on Windows, display of three-digit negative integers, and EPOC date handling.

This version fixes bugs in high memory usage during report generation, Blue Coat W3C (ELFF), Free Radius, Interscan Messaging Security Suite, Postfix, dumpevt, and isco PIX/ASA/Router/Switch, log formats.

See the version history for complete details of all bugs fixed and features added in this release and earlier releases.

Sawmill 7.2.8 ships (November 6, 2006)

Sawmill 7.2.8 is now available. Sawmill 7.2.8 is a minor upgrade, and is free for all Sawmill 7 users.

This version adds support for Separ URL Filter, Netgear FVL328, Web Sense, FortiGate 200A, Aventail Web Access, IBM Tivoli Access Manager WebSEAL, and SiteMinder Policy Server log formats.

This version also enhances Helix Universal Proxy, Argosoft Mail Server, Backup Exec, Sidewinder Firewall, and Sidewinder Syslog log formats.

This version fixes bugs in pie charts, reporting of large numerical values (a new bug introduced in 7.2.7), internationalization of the Use Sawmill button, password-protected share access, use of Sawmill as a service in 64-bit Windows, and screen depth reporting.

This version fixes a bug in Netgear Security log formats.

See the version history for complete details of all bugs fixed and features added in this release and earlier releases.

Sawmill 7.2.7 ships (October 6, 2006)

Sawmill 7.2.7 is now available. Sawmill 7.2.7 is a minor upgrade, and is free for all Sawmill 7 users.

This version fixes a problem with firewalls which introduce extra spaces in the HTTP headers; improves graphing of hour, minute, and second data; and improves expiration of data from a MySQL database.

This version also adds support for Juniper Netscreen Secure Access, SafeSquid Combined, SonicWall TZ 170, TFS MailReport Extended, Nortel SSL VPN, WinRoute Connection, WinRoute Web, Symantec Mail Security Syslog, CWAT, Syslog NG, Cisco VPN Concentrator, Fiserv Financial Easy Lender - Unsuccessful Login Audit, Apache/NCSA Combined Log Format with Syslog, Intersafe HTTP Content Filter, Squid Common Log Format - Syslog Required, Kernun DNS Proxy, Kernun HTTP Proxy, Kernun Proxy, Kernun SMTP Proxy, IBM HTTP Server, Piolink Network Loadbalance, Datagram Syslog Agent, and Sharetech Firewall log formats.

This version also enhances Cisco PIX, Symantec Gateway Security, Squid (syslog required), Zone Alarm, IronPort, InterScan Viruswall, Steel Belted Radius, SonicWall 5, Nagios, Juniper/Netscreen Secure Access, Backup Exec, Postfix, IMSS, Snare, WebNibbler, Fortigate, Border Manager, Fortinet, and IIS SMTP W3C log formats.

This version fixes bugs in time reporting, dd/mm/yy date handling, the send_email() function, the FAQ, the log filter GUI, rekeying (which could causes crashes with certain plug-ins), "max" and "min" field tracking, the report editor, console output on non-latin Windows systems, recentdays:N filters, UTF-16 parsing, parsing of very long lines, reporting of spaces and punctuation in search phrases, sending email, action emails, error reporting, empty table display, MySQL queries, report filters, FTP, and reporting of long durations.

This version fixes bugs in IceCast, Blue Coat W3C, Exim 4, Symantec Security Gateways, Netgear Security, and IronPort log formats.

See the version history for complete details of all bugs fixed and features added in this release and earlier releases.

Sawmill 7.2.6 ships (June 9, 2006)

Sawmill 7.2.6 is now available. Sawmill 7.2.6 is a minor upgrade, and is free for all Sawmill 7 users.

This version adds an Intel/Mac build of Sawmill, builds the "recent Linux" builds on CentOS for better compatibility, adds a "maximum concurrent sessions" item to the Sessions Overview, adds support for table columns computed by arbitrary user-defined expressions, and adds filter_initialization_syslog and filter_finalization_syslog expressions for better syslog plug-in initialization.

This version also adds support for Firewall-1 Binary (detection only), SpamFilter ISP, Cisco NetFlow (flow-export), RAIDiator Error, Metavante, Sonic Wall TZ 170, Bind Update, Event Reporter v6, and MDaemon 8 log formats.

This version also enhances Juniper SSL, Microsoft Media Format, Oracle Failed Logins, Apache Custom, Symantec Gateways Security, SQL Profiler, Unix Syslog, Shoutcast 1.8+, ISC DHCP, SHOUTcast W3C, Microsoft Exchange 2000, and Watchguard log formats.

This version fixes bugs in page view and file type reporting in firewall and proxy formats, the paths through a page report, reporting of errors when an unknown item was entered in the Filters window, zooming on main-table-based reports, numerical fields with "minimum" aggregation operator, repeated session reporting in sessions overview, autodetection on Alpha/Linux platforms, crashes during report display and database builds, and the report editor.

This version fixes bugs in Cisco VPN Concentrator, Unix Syslog, and Quicktime Streaming Server log formats.

See the version history for complete details of all bugs fixed and features added in this release and earlier releases.

Sawmill 7.2.5 ships (May 8, 2006)

Sawmill 7.2.5 is now available. Sawmill 7.2.5 is a minor upgrade, and is free for all Sawmill 7 users.

This version fixes bugs in profile deletion through the web interface, Antispam SMTP Proxy, session logouts via a "(logout)" page, documentation search, report filter case sensitivity, database updates from tens of thousands of files, MySQL report generation, the Sawmill service on some Windows 2003 Enterprise systems, license key capitalization, "maximum" and "minimum" fields with MySQL, and CSV export on Windows.

This version also adds support for Flash Media Player, nmap, PeopleSoft AppServer, and Applied Identity WELF log formats.

This version also enhances Cisco PIX, Barracuda Spam Firewall, Microsoft Exchange 2000/2003, Symantec Gateway Security, Kiwi mm/dd/yyyy, and Unix syslog log formats.

See the version history for complete details of all bugs fixed and features added in this release and earlier releases.

Sawmill 7.2.4 ships (April 7, 2006)

Sawmill 7.2.4 is now available. Sawmill 7.2.4 is a minor upgrade, and is free for all Sawmill 7 users.

This version fixes bugs in memory allocation (memory leaks), sorting by "average" columns, zooming on session users and date/time values together, drive mapping, CSV file processing, LogAnalysisInfo relocation, previously-seen data skipping, Apache Custom log format, charset conversion, filtering Single-page summary on Windows, W3C parsing, reporting of number of lines processed, the service on x64 Windows, processing log data into MySQL, and Cisco Voice Router log data processing.

This version also adds support for Aventail Client/Server Access, Instagate Syslog, RACF Security, SmartFilter (Bess), Kiwi Syslog (Logged to Access MDB, then exported tab-separated), log4j, EventReporter, iptables config, Netscreen Neoteris Web Client Export, and Barracuda Spyware Firewall log formats.

This version also enhances Cisco PIX, dumpel, EIMS 24-hour, Microsoft Media Player, Symantec SGS, IceCast, Free Radius Detail, Mail Enable, sendmail, and RADIUS Accounting log formats.

This version also adds wildcard expressions in "session contains" filters, an -sb (sort_by) option to easily override sort direction and field from the command line, a feature to jump right to a mapped drive or share right after defining/mapping it, support for a date-time field in W3C, better operating system detection, display of number of lines matched in Show Matching Files, an -er option to specify the ending row in CSV export, a -tr option to turn on a Totals line in CSV export, an -of option to specify an output file for CSV export, and an -eol option to specify end-of-line character for CSV export

See the version history for complete details of all bugs fixed and features added in this release and earlier releases.

Sawmill 7.2.3 ships (March 6, 2006)

Sawmill 7.2.3 is now available. Sawmill 7.2.3 is a minor upgrade.

This version fixes a bug could cause an error "Unknown variable 'lang_admin.log_filters. simplify_referrer_label' in expression" when viewing Log Filters for web server profiles. It also fixes two bugs in internationalization.

This version also enhances Exim 4, Mail Enable, Coradiant Object v2, and Cisco PIX log formats.

This version also adds verification that LogAnalysisInfo version matches the binary version, to help troubleshoot upgrade problems.

See the version history for complete details of all bugs fixed and features added in this release and earlier releases.

Sawmill 7.2.2 ships (March 3, 2006)

Sawmill 7.2.2 is now available. Sawmill 7.2.2 is a minor upgrade to 7.2.

This version fixes bugs with DNS lookup, verbose debugging output, building on SPARC, FTP passwords containing plusses, a crash during large database builds, LogAnalysisInfo directory relocation with LogAnalysisInfoDirLoc, web server timeouts (causing crashes), display of information about corrupt databases, CSV exports in CGI mode, report viewing (causing crashes),

This version also adds or extends support for DansGuardian 2.9, IMSS, Mailman Post, Watchguard XML, Windows FIrewall, Amavis, ISA/CSV, Cisco As5300, MacAfee WebShield XML, XWall, Snare, Snare for AIX, Internet Security Systems Network Sensors, Domino Access, Juniper Secure Access SSL VPN, ISA W3C, Argsoft Mail Server, Sourcefile IDS, AutoAdmin, Symantec Security Gateways, Symantec Antivirus, Annex Term Server, IAS CSV, Flex/JRun, Netscreen Web Client Export, Kerio Mailserver Mail, Bintec VPN 25 or XL, Novell Border Manager, Backup Exec, Argosoft Mail Server, MPS, IAS, TippingPoint IPS, Cisco PIX, Watchguard, Barracuda Spam Firewall, Unix Syslog, Cisco Switch/Router, Cisco Voice Router, openldap, Barrier Group, Nortel Networks Instant Internet, Performance Monitor, and Cisco WLAN Controller Log Formats.

This version also adds a "Printer Friendly" button to reports, adds support for per-user languages and per-scheduled-task languages, enhances the "Map Drives" button to allow access to unmapped password-protected shares, adds support for \t and %% in Apache LogFormat directives, add support for syslog device logs with no syslog headers, adds support for direct serving of static files through Sawmill's web server, changes log processing order from most recent to oldest, enhanced automatic date detection, and enhances the TaskLog messages from the end of builds/updates.

See the version history for complete details of all bugs fixed and features added in this release and earlier releases.

Sawmill 7.2.1 ships (February 2, 2006)

Sawmill 7.2.1 is now available! Sawmill 7.2.1 is a minor upgrade to 7.2.

This version fixes bugs with DNS lookup, "average" database fields, millisecond duration displays, "auto" time formats, Tru64 UNIX, MySQL reports, "Show Matching Files", the Scheduler, multiprocessor builds, Sawmill's web server, PIX log format support, NetApp log format support, filesystems with 32-character filename limits, Apache LogFormat directive handling, case-insensitive fields.

This version adds or extends "beta" support for Lancom Router, Sophos Antispam Message, Sendmail (an improved plug-in), msieser SMTP, praudit, Solaris SNARE, PIX, Windows Event (dumpevt), Zyxel WELF, and Scanmail for Exchange.

This version adds an Active Tasks and Task Log sections to the Admin page, adds a limited version of the Sawmill Scheduler to Sawmill Lite, and adds an Italian translation.

This version also adds binary downloads for FreeBSD 6, OpenBSD 3.8, and adds an x64 Windows binary to the standard Windows distribution, for full 64-bit operation on 64-bit x64.

See the version history for complete details of all bugs fixed and features added in this release and earlier releases.

Sawmill 7.2 ships (December 19, 2005)

Sawmill 7.2 is now available! Sawmill 7.2 is a significant upgrade to Sawmill, including a greatly improved Create Profile Wizard, a simplified user interface with much more context-sensitive help, greatly expanded documentation for custom log formats, greatly expanded flexibility in log format plug-ins, support for mapping drives directly from Sawmill in Windows, a new Report It feature for reporting error, simplified CGI mode operation, support for many new log formats, other features, and many bug fixes.

With Sawmill 7.2, we introduce Sawmill Lite, a simplified version of Sawmill intended to provide the fastest and easiest path to your reports.

Sawmill 7.2 is a free upgrade for all Sawmill 7.0 and 7.1 users; existing Sawmill 7 license keys will unlock Sawmill 7.2.

See the version history for complete details of all bugs fixed and features added in this release and earlier releases.

Sawmill 7.1.14 ships (September 8, 2005)

Sawmill 7.1 is now available (the latest minor bug-fix release is 7.1.14). Sawmill 7.1 is a significant upgrade to Sawmill 7, including greatly improved MySQL performance and robustness, a new Report Editor and Report Menu Editor for creating and editing custom reports from the web interface, a new non-technical User's Guide, and charset conversion for better support of non-English character sets. With the new log formats added in this version, Sawmill now supports 600 different log formats.

This version (download) also adds a display/output editor, adds a graphs display editor, improves graphing, adds more graphing options, improves support for use of profile labels with -p, improves support for empty log sources, adds a Cancel button to progress pages, and adds support for a global filter affecting all reports.

This version adds support for MDaemon 7 (All), FileZilla, Cisco 3750, Windows 2003 DNS, Web Washer, Kaspersky Labs for Mail Servers, NEMX PowerTools for Exchange, Nokia IP350/Checkpoint NG (fw log export), MailStripper, Borderware runstats, Cisco Secure Server (RAS Access), Microsoft Port Reporter, GNAT Box Syslogger (v1.3) Syslog, Bulletproof/G6 FTP Log Format (yyyy/mm/dd dates), Coradiant Object Log Format v2.0, SMTP (24 hour) Log Format, Mailman Subscribe, Symantec Mail Security, Kerio Network Monitor HTTP, SmoothWall SmoothGuardian 3.1, Cisco NetFlow (FlowTools ASCII Export), Easy Syslog Server, Groupwise Post Office Agent, Web Logic 8.1, WebSphere Business Integration Message Brokers User Trace, Watchguard Historical Reports Export, Cisco CE, IronPort Bounced, Useful Utilities EZproxy, Windows NT Scheduler, SecureIIS (LogExporter.exe), Click To Meet, NetScreen Traffic Log Format (get log traffic), and Web Seal CDAS log formats.

This versions adds detection (but not support, because Sawmill does not support binary log formats) for the following binary file formats: Sidewinder Raw, Nortel Networks RouterARN, Windows Event .evt, SecureIIS Binary, NetFlow Binary (DAT), Clavister Firewall Binary, and Ethereal Binary log formats.

This version improves support for NetScreen, Critical Path, Wall Watcher, Webtrends, GnatBox, Generic W3C, Postfix, Helix (type 5), Interscan Security Suite, qmail-scanner, EIMS, NetCache NetApp 5.5, Cisco VPN Concentrator, Exchange 2000 CVS, Symantec Gateway Security, Interscan Viruswall, Snort 2, GNAT Box, Kerio Network Monitor HTTP, Cisco Pix/IOS, Webtrends Extended, ntsyslog, Windows XP Event Log (Microsoft LogParser CSV Export), NetApp Filers Audit, Anti-Spam SMTP Proxy (ASSP), Enhanced Cisco 3750, iptables, Radius Accounting, NetCache NetApp, ISA W3C, Symantec Antivirus Corporate Edition, Netegrity Siteminder Access, Cisco VPN Concentrator, Fortigate, LogSat SpamFilter ISP, and Helix Universal log formats.

This version also fixes bugs (most of these were fixed in earlier 7.0.10 patch release) in report filters, profile line endings on Windows, the v6-to-v7 configuration converter, the scheduler, command log sources, file browsing, the admin interface, temporary file cleanup, default report creation, multiprocessor builds, the individual sessions report, command line authentication, memory usage, building from source on IA64, database updates, GeoIP, date/time sorting, the "build indices during log processing" option, SPARC support, xref tables, MacOS support, shared databases, mmm-dd-yy dates, zooming, progress reporting, hanging processes, autodetection, the session users report, the "automatically update when older than" feature, escaping of unusual characters, the log filter editor, static HTML generation, CSV export, the licensing page, the user editor, the overview report, and the date range picker.

See the version history for complete details of all bugs fixed and features added in this release and earlier releases.

Sawmill 7.0.10k ships (March 25, 2005)

Several bugs in 7.0.10 have been fixed in the latest version, 7.0.10k. See the version history for complete details of these patches. There is no need to upgrade to 7.0.10k if you are using a previous 7.0.10 version, unless you are having problems with your existing installation.

This version (download) adds a graphical Log Filters editor, adds a search feature to the documentation, improves report filter syntax, adds support for Unicode .cfg files, updates the GeoIP database, adds links to URL in tables, adds a Cancel button to progress pages, adds paging to reports, adds some additional Table Options, improves layout of "session paths" and "paths through a page" reports, improves report filter web interface, adds support for non-ASCII profile names, and adds German internationalization.

This version adds support for bpft4 without interface, Kiwi (yyyy-mm-dd dates), Cisco NetFlow (version 1), Neoteris, Cisco NetFlow (no dates), Microsoft Exchange Server 2000 Log Format (comma separated), Argus, Optima, SLNT4, Check Point SNMP, SafeSquid, DLink DI-804HV Ethernet Broadband VPN Router Log Format, log formats.

This version improves support for Cisco PIX, Unix Sendmail, IIS SMTP, Exim 4, NetApp55, NetScreen, Symantec Gateway Security, NTSyslog, Improved TrendMicro/eManager Spam Filter, FortiGate, Free Radius, Cisco VPN Concentrator, Merak SMTP, Syslog NG, log formats.

This version also fixes bugs in Common Access Log Format with full URLs, source code compilations, command-line report generation, MySQL reports, session filters, the v6-to-v7 profile converter, the file browser, The "paths through a page" report, database update memory usage, multiprocessor database updates, the progress page, licensing, multiple zoom, the scheduler, apache custom format string, report emails, sorting in Log Details, zoom on "user" field, log source error reporting, database building in low-memory conditions on MacOS, and others.

See the version history for complete details of all bugs fixed and features added in this release and earlier releases.

Sawmill 7.0.9 ships (November 24, 2004)

This version (download) adds support for zooming simultaneously to multiple fields, improves the interface of the "paths through a page" report and the "session paths" report, improves date display and global filter handling, and adds detection of Firefox in log data.

This version adds support for IP Sentry, Apache SSL Request, CiscoWorks, Gene6 FTP, Squid WELF, Clavister Firewall Syslog, Kerio Network Monitor HTTP, Cognos Ticket Server, Novell NetMail 3.5, Nortel Contivity, and Watchguard Firebox v60 log formats.

This version improves or fixes support for ipfw, Apache/NCSA Combined Format With Cookie Last, tcpdump, Serv-U FTPD, Cisco VPN Concentrator, Clavister Firewall, WebSTAR "common log format", iptables, Symantec Gateway Security, SHOUTCast W3C, Interscan E-mail Viruswall, Symantec Gateway Security, NTSyslog, NetApp 5.5, Netwall, Windows Event (Comma Delimited), tcpdump, and Exim 4 log formats.

This version also fixes bugs in MP builds, TaskLog logging, DNS lookup, the Scheduler, CSV parsing, session reports, building xrefs and indices during log processing, reports generated from xref tables, report filters, command line filters, x-timestamp fields, invalid license handling, 6.4 configuration conversion, desktop file browsing on Windows, W3C log parsing on update, the "paths through a page" report, display of long table items, error reporting, the date range picker, and MySQL database name validation.

See the version history for complete details of all bugs fixed and features added in this release and earlier releases.

Sawmill 7.0.8 ships (October 22, 2004)

This version (download) adds a web interface to the Preferences, adds Preference-level selection of the charset for the web interface, improves the reports menu for offline viewing, adds a -df option for specifying date filters from the command line, and adds field names to the Log Filters editor.

This version adds support for Bindview Windows Event, Syslog NG (no timezone), Exim 4, Clavister Firewall, and Symantec Gateway Security 2 (CSV) log formats, and improves Serv-U FTP log format.

This version also fixes problems with the eSafe, Netscreen, LSMS Admin, Raptor, Cold Fusion Application (CSV), and Aladdin ESafe Sessions (with category) log formats.

This version also fixes bugs in the following: network timeouts (affected FTP and other network operations), -f command line option, the Scheduler, log formats using the entire_line keyword, the Profiles list, the Log Filters editor, offline filter display with the -f option, action emails, display of tables from empty databases, report email subjects, average numerical field calculations, and CSV export in multi-table reports.

See the version history for complete details of all bugs fixed and features added in this release and earlier releases.

Sawmill 7.0.7 ships (October 7, 2004)

This version (download) enhances the Scheduler interface to provide graphical versions of the most common "extra options", greatly improves performance of internal language parsing and report generation, adds support for embedding the interface in a larger frameset, improves the Overview to report averages-per-day and date range information, improves MySQL xref build performance, reduces database size on disk, improves memory usage for certain queries, and adds a default_report_on_zoom option to each report to allow the default zoom report to be customized.

This also adds support for the following new log formats: mailscanner, Cisco ACNS with SmartFilter, PsLogList, SNMP Manager, Trend Micro Interscan Web Security Suite, Argsoft Mail Server, Essbase, PIX Firewall Syslog Server (with no year), Cisco ACNS SmartFilter, and Watchguard Firebox V60.

This also improves support for the following log formats: Free Radius, SonicWall, 3COM, Symantec Gateway Security, ServU FTP, Firewall-1, Cisco VPN Concentrator, NetScreen, and Plesk.

This also fixes bugs in the following log formats: ServU FTP, Firewall-1, Microsoft Media Server, and Blue Coat Squid.

This also fixes bugs in the following: action emails, report cancellation, non-administrative report viewing, default log filters, report zooming, yyyy/mm/dd hh:mm:ss time format, session report inclusion, session filter editing, profile conversion, log source editing, sorting, progress page charset selection, "process subdirectories" in a log source, MySQL Overview report visitor count, screen information, scheduler reloading, zoom on individual sessions, radio buttons in report filters, display of empty reports, excessive memory usage in several cases, and FTP.

See the version history for complete details of all bugs fixed and features added in this release and earlier releases.

Sawmill 7.0.6 ships (September 6, 2004)

This version (download) improves MySQL cross-reference table generation performance, improves the User editor to allow full editing of all user attributes, improves progress reporting for better interactivity, improves CSV export sorting, and improves CSV export performance. This version adds support for Digital Insight Magnet, Aladdin eSafe with URL category, and Bindview User Reporting log formats. This version improves Apache Custom, Helix, Fortinet, WELF, Snort Standalone, and ISA log format support. This version fixes bugs in the following: paths through a page, microsecond display, configuration-to-profile converter, CSV export from single-page summary, multiprocessor builds, hierarchy grouping order, single quotes in the Scheduler, generate_all_report_files, zooming with session filters, zooming to Single-page summary in Windows, HTTP log sources on Windows, session filters on Windows, dollar signs in log filter labels and comments, multiple HTTP log sources, and report group arrows. See the version history for complete details of all bugs fixed and features added in this release and earlier releases.

Sawmill 7.0.5 ships (August 28, 2004)

This version (download) improves performance with large numbers of profiles. It also adds support for Bindview Reporting, ISS, and Cisco AS5300 log formats, and improves support for Microsoft Media, Exchange 2000, GTA GBWare, and Netscape log formats. This version also fixes the MacOS 10.2 distribution, fixes iChain log format, fixes a bug in CSV export on UNIX/Linux, fixes a bug where zooming on a "default page" would give all 0's, and fixes a few other minor bugs. See the version history for complete details of all bugs fixed and features added in this release and earlier releases.

Sawmill 7.0.3 ships (August 23, 2004)

This version (download) adds CSV export from the reports, improves the Scheduler interface and links it from the Admin menu, adds a User editor for creating users, adds support for multi-element reports (adds single-page summary report based on this), adds new command line options for querying internal report and profile names, adds Create/Update Many Profiles to the templates (for rapid creation of multiple similar profiles), and enhances zooming into items with no subitems. It adds support for GTA GBWare Firewall log format, enhances Snare log format, and fixes IronMail SMTP Proxy and Microsoft Exchange Server 2000 log formats. It fixes a bug in counting events for some IPs, fixes a bug where Scheduled tasks created in the GUI did not work, fixes a bug where non-administrators could see some administrative pages, fixes a bug in conversion of v6 configurations to v7 profiles, and fixes a few other minor bugs. See the version history for complete details of all bugs fixed and features added in this release and earlier releases.

Sawmill 7.0.2 ships (August 14, 2004)

This version (download) adds start and end time columns to Individual Sessions, adds support for UTF-8 encoded log data, adds a link to the Licensing page from the Admin menu, adds a page for choosing Enterprise vs. Professional licensing for trial, and enhances support for IIS FTP, WebStar and Helix Universal log formats. It also fixes the following bugs: crash during log processing, incorrect reporting of "average", "maximum", and "minimum" columns, incorrect handling of entire_line variable in log filters, crash when Global Filter used non-existent value, crash when zooming on tables build from the "main table" of the database, error when using command-line log source, error when viewing Overview with session filters, crash when using visitors, error in session duration in Individual Sessions, poor selection of default graphing field, incorrect session information for out-of-order log data, error on CGI setup, error zooming on MMS format URLs with MySQL, error on database update on Windows, error where visitor information was incorrect after database update, problem with -f filtering during remove_database_data, rejection of all "sent" entries in IIS FTP logs, error creating profile with Declude Spam logs, problem where errors were not reported on web interface, error browsing directories with $ in subdirectory or file names, error in localtime field tracking in W3C logs, error with certain sorts on subtables, and a few other bugs. See the version history for complete details of all bugs fixed and features added in this release and earlier releases.

Sawmill 7.0.1 ships (August 7, 2004)

This version fixes a serious bug which resulted in incorrect results in some reports. It also adds a DNS configuration section to the Config. It also fixes some labelling on the MacOS X version, which used the Sawmill 6 logo, fixes problems with SGS, Snort, Blue Coat IM, IIS W3C, and Blue Coat Custom log formats. Fixes a bug where log formats and filename were not sorted, changed cookie names so a v7 installation can coexist with a v6 installation, fixes a bug which could cause a crash on update, and fixes a bug which could cause a crash on rebuild with MySQL. See the version history for complete details of all bugs fixed and features added in this release and earlier releases.

Sawmill 7.0.0 ships! (July 31, 2004)

Sawmill 7 is the culmination of three years of work, and is the most significant update to Sawmill ever. Major new features include a completely new graphical interface; greatly improved database flexibility including tracking of multiple numerical fields; a powerful programming language used for log filters, statistics filters, GUI templates, and more; many performance improvements in log processing and report generation; arbitrary statistics filtering without the need for cross-references; native Windows service support; improved progress during long operations, and more. Version 7 is available in Professional and Enterprise versions; Enterprise will include all features of Professional (listed above), and will also include support for MySQL as a back-end database, WebNibbler(tm) technology for advanced user tracking, multiprocessor database building, and a completely customizable graphical interface. See What's New In Version 7 for a more complete list of major features.

Read the press release.

Sawmill 6.5.11 ships (July 24, 2004)

This version fixes a bug where log entries would be ignored, and memory usage could grow arbitrarily, when DNS lookup was enabled. This version adds support for Interscan Messaging Security Suite Virus, Squid (with Referrer and Agent) Log Format (Syslog Required), Netgear FVS318, Oracle Failed Login Attempts, EmailCatcher, BEA WebLogic, Ethereal, ClamAV, Symantec AntiVirus Corporate Edition (VHIST Exporter), IPEnforcer, NetGear DG834G, Symantec Gateway Security 5400, Watchguard Firebox Export, Cisco Router, GFI Spam, Proxy-Pro GateKeeper, Active PDF, MailSweeper 24 Hour, Servers Alive Statistics, Anti-Spam SMTP Proxy (ASSP), Ironmail AV (Sophos), and IronPort log formats. This version improves support for Postfix, GFI Attachment & Content, Symantex Gateway Security, Declude SPAM, Interscan Security Suite, Watchguard SOHO, Merak SMTP, ServUFTP, Sidewinder Syslog, Firewall-1 (fw logexport export), Cisco VPN Concentrator, and LinkSys Router log formats. This version also fixes several other bugs. See the version history for complete details of all bugs fixed and features added in this release and earlier releases.

Sawmill adds support for 500th log format! (July 21, 2004)

Sawmill now supports over 500 log formats, making it the clear choice for universal log analysis.

Read the press release.

Sawmill 7.0b16 ships (July 21, 2004)

Sawmill 7.0b16 is now available for download. This version updates the FAQ to refer to the new v7 features and interface. It also fixes a bug with SonicWall analysis, a bug where date/time tables were sometimes empty, a bug where error during long operations were not reported, and a bug where the "session paths" report showed the same number of users for each path. See the v7 version history for complete details of all bugs fixed and features added in this release and earlier releases.

Sawmill 7.0b15 ships (July 18, 2004)

Sawmill 7.0b15 is now available for download. This version adds a "global filter editor" for applying complex filters which affect all reports, and which remain until they are explicitly removed. This version also fixes a long-standing bug where portions of some pages did not load, and fixes a bug where removing data from the database did not work in some cases, and fixes a bug where database updates could cause a progress error, and fixes a bug where filters did not work unless they were applied to column fields, and fixes a bug where items were incorrectly omitted from graphs and tables! See the v7 version history for complete details of all bugs fixed and features added in this release and earlier releases.

Sawmill 7.0b14 ships (July 17, 2004)

Sawmill 7.0b14 is now available for download. This version greatly improves the performance of large tables with subtables. It fixes a bug where progress did not update, fixes a couple bugs which could cause errors on Windows when building a database with multiple processors. See the v7 version history for complete details of all bugs fixed and features added in this release and earlier releases.

Sawmill 7.0b13 ships (July 14, 2004)

Sawmill 7.0b13 is now available for download. This version works on Linux even if MySQL libraries are not installed (some previous versions requires the libraries even if MySQL was not used). It adds a link to switch from Enterprise to Professional features when using a trial license. It fixes a bug which could cause stalled or never-complete progress pages, a bug which caused an error when viewing the table of contents of the technical reference manual, a bug with IP address display with IIS logs, and a bug which reported "can't drop table" when using MySQL. This version also fixes several other bugs. See the v7 version history for complete details of all bugs fixed and features added in this release and earlier releases.

Sawmill 7.0b12 ships (July 11, 2004)

Sawmill 7.0b12 is now available for download. This version fixes a bug in MySQL support which resulted in incorrect numbers in some cases, updates the Technical Manual for the new (v7) features, improves/fixes WebSTAR support, and fixes a few other bugs. See the v7 version history for complete details of all bugs fixed and features added in this release and earlier releases.

Sawmill 7.0b11 ships (June 27, 2004)

Sawmill 7.0b11 is now available for download. This version improves MySQL table structure for improved performance and table size, and fixes support for unique fields (like visitors) in MySQL cross-reference tables. It adds a new "subtable" type of report which provides a more intuitive breakdown of two-field reports, including the new "search phrases by search engine" report. It also restores the Single-page summary, which was present in version 6 but has not been implemented in version 7 until now. It also adds a new v6-to-v7 profile converter, so v6 users with existing configurations can use them with v7 now (a database rebuild will be required after conversion). It also fixes a few bugs. See the v7 version history for complete details of all bugs fixed and features added in this release and earlier releases.

Sawmill 7.0b10 ships (June 23, 2004)

Sawmill 7.0b10 is now available for download. This version greatly improves performance when displaying certain very large tables, especially tables with multiple non-numerical fields; implements the Logout link; improves worm detection; and significantly improves the Browse interface. It also fixes problem with Squid, Cisco VPN Concentrator, Exchange, Postfix, and IIS FTP. It fixes bugs in the Calendar, the Browse window, and the Log Detail report. See the v7 version history for complete details of all bugs fixed and features added in this release and earlier releases.

Sawmill 7.0b9 ships (June 19, 2004)

Sawmill 7.0b9 is now available for download. This version implements the Logout link, improves worm detection, improves and fixes support for Postfix, IIS FTP, Exchange, and other log formats, and fixes several bugs. See the v7 version history for complete details of all bugs fixed and features added in this release and earlier releases.

Sawmill 7.0b8 ships (June 16, 2004)

Sawmill 7.0b8 is now available for download. This version moves the GUI text to the language modules for easy translation, adds pie charts, and improves support for Quicktime Streaming Server, IIS, and Fortigate. It also fixes several bugs. See the v7 version history for complete details of all bugs fixed and features added in this release and earlier releases.

Sawmill 7.0b7 ships (June 12, 2004)

Sawmill 7.0b7 is now available for download. This version improves field names for non-English reports, and fixes several bugs. See the v7 version history for complete details of all bugs fixed and features added in this release and earlier releases.

Sawmill 7.0b6 ships (June 9, 2004)

Sawmill 7.0b6 is now available for download. This version improves the progress display, and fixes a few bugs. See the v7 version history for complete details of all bugs fixed and features added in this release and earlier releases.

Sawmill 7.0b5 ships (June 5, 2004)

Sawmill 7.0b5 is now available for download. This fixes a few bugs. See the v7 version history for complete details of all bugs fixed and features added in this release and earlier releases.

Sawmill 7.0b4 ships (June 3, 2004)

Sawmill 7.0b4 is now available for download. This fixes many bugs in the 7.0b3 release, and moves a large step closer to completing all major features in 7.0. Major new features in 7.0 include support for MySQL databases (commercial licenses only), a new administrative and statistical interface, a full programming language for log filtering, support for arbitrary filtering of statistics on any combination of fields using Boolean expressions, improved tracking of numerical fields including duration and inbound/outbound bandwidth, a new "log detail" report shows table of full log data for any filter set, default installation as a Windows service, support for multiprocessor log processing, and many performance optimizations.

Sawmill 6.5.10 ships (May 29, 2004)

This version adds support for GMS POP, Merak Mail Server Control, Symantec Gateway Security 5400, Vamsoft Open Relay Filter Enterprise Edition, Aladdin eSafe Sessions, Fortinet, Apache/NCSA Common Agent, Snare, Amavis, Watchguard WELF, FortiGate Space Separated, Netgear Security, Netilla, FortiGate Traffic, WebNibbler, Eventlog to Syslog, Packet Dynamics, Nagios, Bind 9 Query (without timestamp), Vexira, IPCop, NetCache NetApp 5.5, Trend Micro ScanMail For Exchange, NetApp Filers Audit, Symantec Enterprise Firewall 8, Message Sniffer, This version improves support for Windows 2000/XP Event Log Format (export list-CSV) ddmmyyyy, Unix Syslog, Common Proxy, NetScreen Traffic, Cisco PIX/IOS, Postfix, LogSat SpamFilterISP, LISTSERV, and NetCache NetApp. This version fixes a bug which could cause crashes when DNS lookup was turned on, and fixes several other minor bugs. See the version history for complete details of all bugs fixed and features added in this release and earlier releases.

Sawmill 7.0b3 ships (April 28, 2004)

Sawmill 7.0b3, the first public beta of Sawmill 7, is now available for download. Major new features include support for MySQL databases (commercial licenses only), a new administrative and statistical interface, a full programming language for log filtering, support for arbitrary filtering of statistics on any combination of fields using boolean expressions, improved tracking of numerical fields including duration and inbound/outbound bandwidth, a new "log detail" report shows table of full log data for any filter set, default installation as a Windows service, support for multiprocessor log processing, and many performance optimizations.

Sawmill 6.5.9 ships (April 3, 2004)

This version adds support for Syslog NG, Passlogd, InfiNet, MailEnable, Sendmail NT, Array 500, MTS Professional, Servers Alive, GW Guardian Spam, Fountry BigIronII, Microsoft ISA Server Packet, GW Guardian Antivirus, Watchguard WSEP Text Exports, and Cyberguard WELF log formats. It improves support for LogSat SpamFilterISP, Lucent Brick, iPlanet Messenging Server 5MTALog, Zone Alarm, Unix Syslog, Novell NetMail, tcpdump,Fountry BigIronII, Bulletproof FTP, NetScreen, and Microsoft Exchange Internet Mail log formats. This version also fixed several bugs, and improves performance of some large database builds. See the version history for complete details of all bugs fixed and features added in this release and earlier releases.

Sawmill 6.5.8 ships (February 14, 2004)

This version adds support for Winproxy 5.1 (yyyy-mm-dd dates), Astaro, PortalXPert, FirstClass Server, iChain, Socks 5, Windows Event (dumpel.exe export), Trend ServerProduct CVS Admin, and Netgear Security log formats, and improves support for Interscan Messaging Security Suite, Netscreen IDP, WebSTAR, N2H2 / Novell Border Manager, and MailSweeper log formats. This version fixes a bug which prevented Unix Syslog files from being processed, and several other bugs, including one which could cause a crash under certain uncommon circumstances while viewing session information. See the version history for complete details of all bugs fixed and features added in this release and earlier releases.

Sawmill 6.5.7 ships (January 25, 2004)

This version adds support for Symantec Enterprise Firewall, and Cisco Access Control Server. It improves support for Unix Syslog, PIX Firewall, Cisco VPN Concentrator, Microsoft Media Server, NVDcms, Firewall-1 Log Viewer 4.1 Export, Netscape Directory Server. It also fixes a bug which could cause incorrect processing of Squid logs and certain other log formats, and a few other bugs. See the version history for complete details of all bugs fixed and features added in this release and earlier releases.

Sawmill 6.5.6 ships (January 11, 2004)

This version adds support for Minirsyslogd and WebSEAL error log formats, and improves the existing support for Cisco Router and Postfix formats. It also fixes a bug which could cause hangs or even server crashes when updating a database using "update if older than" or the "update" or "rebuild" link in the statistics (only in CGI mode), and a few other bugs. See the version history for complete details of all bugs fixed and features added in this release and earlier releases.

Sawmill 6.5.5 ships (December 13, 2003)

This version fixes a bug which could cause crashes or high memory use when using DNS lookup, enhances the "session pages" view (formerly "time spent per page"), fixes a bug which could cause hangs or error when downloading data using active FTP, adds several new log formats, adds a few other minor enhancements, and fixes a few minor bugs. See the version history for complete details of all bugs fixed and features added in this release and earlier releases.

Sawmill 6.5.4 ships (November 8, 2003)

This version adds a few new log formats, and fixes a number of bugs, including some which caused FTP downloads to fail in some cases. See the version history for complete details of all bugs fixed and features added in this release and earlier releases.

Sawmill 6.5.3 ships (October 12, 2003)

This version adds a few new log formats, adds support for "active" FTP transfers, and fixed a number of bugs, including several which caused problems when using W3C log files and configuration files from version 6.4, and one which could incorrectly report the traffic on some IP addresses under certain circumstances. See the version history for complete details of all bugs fixed and features added in this release and earlier releases.

Sawmill 6.5.2 ships (September 14, 2003)

This version adds a few new log formats, adds a few minor features, and fixes several bugs. See the version history for complete details of all bugs fixed and features added in this release and earlier releases.

Sawmill 6.5.0 ships (August 13, 2003)

This is a major new version. It is a paid upgrade for existing customers. This version adds support for about 100 new log formats, improves support for generic W3C and CSV logs, improved DNS lookup to resolve all fields, adds a "session visitors" view and other session enhancements, adds incremental HTML statistics updating, adds country/region/city user tracking, and includes many other small improvements. See the version history for complete details of all bugs fixed and features added in this release and earlier releases.

Sawmill 6.4.8 ships (June 15, 2003)

See the version history for complete details of all bugs fixed and features added in this release and earlier releases. This version also introduces new pricing and licensing-- see Pricing for the new pricing. (6.4.8a is a very minor update to 6.4.8 which fixes a licensing bug).

Sawmill 6.4.7 ships (May 10, 2003)

This version fixes several bugs. See the version history for complete details of all bugs fixed and features added in this release and earlier releases.

Sawmill 6.4.6 ships (April 26, 2003)

This version fixes several bugs, including one which could cause crashes when going to the Scheduler. See the version history for complete details of all bugs fixed and features added in this release and earlier releases.

Sawmill 6.4.5 ships (April 20, 2003)

This version fixes several bugs, including one which could cause crashes when going to the Scheduler. See the version history for complete details of all bugs fixed and features added in this release and earlier releases.

Sawmill 6.4.4 ships (April 5, 2003)

This version fixes several bugs, including one which could cause crashes when going to the Scheduler. See the version history for complete details of all bugs fixed and features added in this release and earlier releases.

Sawmill 6.4.3 ships (March 23, 2003)

This version fixes several bugs. See the version history for complete details of all bugs fixed and features added in this release and earlier releases.

Sawmill is now available in Czech (March 18, 2003)

A new Czech translation of the statistics interface lets you serve statistics to Czech speaking clients in their own language, and to administrate Sawmill in Czech. French, German, Spanish and Italian versions of the statistics interface are also available.

Sawmill 6.4.2 ships (February 15, 2003)

This version fixes several bugs. See the version history for complete details of all bugs fixed and features added in this release and earlier releases.

Sawmill 6.4.1 ships (February 1, 2003)

This version fixes several bugs. See the version history for complete details of all bugs fixed and features added in this release and earlier releases.

Sawmill is now available in French (June 16, 2003)

Sawmill is now available in French! A new French translation of the statistics interface lets you serve statistics to French speaking clients in their own language. German, Spanish and Italian versions of the statistics interface are also available.

Sawmill 6 ships (March 21, 2001)

Sawmill 6 ships! The new version has countless improvements over version 5, including a streamlined statistics interface, a new option to fetch log files by FTP, improved log formats and filters, highly customizable views, a new option to send views by email, and much more.

Recent News

Daily News Archive