Cisco Cisco Email Security Appliance C160 Guía Del Usuario
38-14
AsyncOS 9.1.2 for Cisco Email Security Appliances User Guide
Chapter 38 Logging
Log Types
Note that the second of the three attachments is Unicode. On terminals that cannot display Unicode,
these attachments are represented in quoted-printable format.
these attachments are represented in quoted-printable format.
Log Entries for Generated or Re-Written Messages
Some functions, such as rewrite/redirect actions (
alt-rcpt-to
filters, anti-spam rcpt rewrite,
bcc()
actions, anti-virus redirections, etc.), create new messages. When looking through the logs, you might
need to check the results and add in further MIDs and possibly DCIDs. Entries such as these are possible:
need to check the results and add in further MIDs and possibly DCIDs. Entries such as these are possible:
or:
An interesting point to note about ‘rewritten’ entries is that they can appear after lines in the log
indicating use of the new MID.
indicating use of the new MID.
Messages Sent to the Spam Quarantine
When you send a message to the quarantine, the mail logs track the movement to and from the quarantine
using the RCID (RPC connection ID) to identify the RPC connection. In the following mail log, a
message is tagged as spam, and sent to the Spam Quarantine:
using the RCID (RPC connection ID) to identify the RPC connection. In the following mail log, a
message is tagged as spam, and sent to the Spam Quarantine:
Sat Apr 23 05:05:42 2011 Info: MID 44 interim verdict using engine: CASE
spam negative
Sat Apr 23 05:05:42 2011 Info: MID 44 using engine: CASE spam negative
Sat Apr 23 05:05:43 2011 Info: MID 44 attachment 'Banner.gif'
Sat Apr 23 05:05:43 2011 Info: MID 44 attachment '=D1=82=D0=B5=D1=81=D1=82.rst'
Sat Apr 23 05:05:43 2011 Info: MID 44 attachment 'Test=20Attachment.docx'
Sat Apr 23 05:05:43 2011 Info: MID 44 queued for delivery
Tue Jun 1 20:02:16 2004 Info: MID 14 generated based on MID 13 by bcc filter 'nonetest'
Tue Jan 6 15:03:18 2004 Info: MID 2 rewritten to 3 by antispam
Fri May 14 20:44:43 2004 Info: MID 6 rewritten to 7 by alt-rcpt-to-filter filter
'testfilt'
Wed Feb 14 12:11:40 2007 Info: Start MID 2317877 ICID 15726925
Wed Feb 14 12:11:40 2007 Info: MID 2317877 ICID 15726925 From: <HLD@chasehf.bfi0.com>
Wed Feb 14 12:11:40 2007 Info: MID 2317877 ICID 15726925 RID 0 To:
<stevel@healthtrust.org>
Wed Feb 14 12:11:40 2007 Info: MID 2317877 Message-ID
'<W1TH05606E5811BEA0734309D4BAF0.323.14460.pimailer44.DumpShot.2@email.chase.com>'