MICROSOFT IAS COMMA-SEPARATED
Sawmill is a Microsoft IAS Comma-Separated log analyzer (it also supports the 1021 other log formats listed to the left).
It can process log files
in Microsoft IAS Comma-Separated format, and generate dynamic statistics from them,
analyzing and reporting events.
Sawmill can parse Microsoft IAS Comma-Separated logs, import them into a MySQL, Microsoft SQL Server, or Oracle database (or its own built-in database),
aggregate them, and generate dynamically filtered reports, all through a web interface.
Sawmill can perform Microsoft IAS Comma-Separated log analysis on any platform, including Windows, Linux, FreeBSD, OpenBSD, Mac OS, Solaris, other UNIX, and others.
Sawmill stores the following non-numerical fields in its database for Microsoft IAS Comma-Separated, generates reports for each field, and allows dynamic filtering on any combination of these fields:
| Field | | Internal Name |
|---|
| | date/time | | date_time |
| | day of week | | day_of_week |
| | hour of day | | hour_of_day |
| | computer name | | computername |
| | service name | | servicename |
| | packet type | | packet_type |
| | username | | user_name |
| | fully qualified username | | fully_qualified_user_name |
| | called station ID | | called_station_id |
| | calling station ID | | calling_station_id |
| | callback number | | callback_number |
| | framed IP address | | framed_ip_address |
| | NAS identifier | | nas_identifier |
| | NAS IP address | | nas_ip_address |
| | NAS port | | nas_port |
| | client vendor | | client_vendor |
| | client IP address | | client_ip_address |
| | client friendly name | | client_friendly_name |
| | event timestamp | | event_timestamp |
| | port limit | | port_limit |
| | NAS port type | | nas_port_type |
| | connect info | | connect_info |
| | framed protocol | | framed_protocol |
| | service type | | service_type |
| | authentication type | | authentication_type |
| | NP policy name | | np_policy_name |
| | reason code | | reason_code |
| | session timeout | | session_timeout |
| | idle timeout | | idle_timeout |
| | termination action | | termination_action |
| | EAP friendly name | | eap_friendly_name |
| | status type | | acct_status_type |
| | delay time | | acct_delay_time |
| | session ID | | acct_session_id |
| | authentic | | acct_authentic |
| | session time | | acct_session_time |
| | terminate cause | | acct_terminate_cause |
| | multi ssn ID | | acct_multi_ssn_id |
| | link count | | acct_link_count |
| | interim interval | | acct_interim_interval |
| | tunnel type | | tunnel_type |
| | tunnel medium type | | tunnel_medium_type |
| | tunnel client endpoint | | tunnel_client_endpt |
| | tunnel server endpoint | | tunnel_server_endpt |
| | tunnel connection | | acct_tunnel_conn |
| | tunnel private group ID | | tunnel_pvt_group_id |
| | tunnel assignment ID | | tunnel_assignment_id |
| | tunnel preference | | tunnel_preference |
| | ms account auth type | | ms_acct_auth_type |
| | ms account EAP type | | ms_acct_eap_type |
| | ms ras version | | ms_ras_version |
| | ms ras vendor | | ms_ras_vendor |
| | ms chap error | | ms_chap_error |
| | ms chap domain | | ms_chap_domain |
| | ms ppe encryption type | | ms_ppe_encryption_type |
| | ms mppe encryption policy | | ms_mppe_encryption_policy |
Sawmill stores the following numerical fields in its database for Microsoft IAS Comma-Separated, aggregating them and including them as columns in most reports:
| Numerical Field | | Internal Name |
|---|
| | events | | events |
| | unique client IPs | | unique_client_ips |
| | input octets | | acct_input_octets |
| | output octets | | acct_output_octets |
| | input packets | | acct_input_packets |
| | output packets | | acct_output_packets |
See Sawmill Features to learn more about Sawmill's options for viewing, customizing, filtering, exporting and scheduling Microsoft IAS Comma-Separated reports.
Sawmill also supports 1021 other log formats.
