What happens to log files on the Cisco Content Security appliance that are pushed via FTP or SCP?
When a log file reaches its configured "maximum file size", it is renamed from a file ending with the ".c" extension (c = current) to a file ending with a ".s" extension (s = saved). This process is referred to as "rollover."
When you configure logs to be pushed via FTP or SCP, the saved (.s) file is pushed to your specified destination server at rollover time, and then it is deleted from the appliance.
For more information about Rolling Over Log Subscriptions, see the AsyncOS User Guide on the Cisco Content Security products support.