Cisco Cisco Email Security Appliance C170 Mode D'Emploi

Cisco AsyncOS for Email generates the following log types:

Text mail logs record information regarding the operations of the email 
system. For example, message receiving, message delivery attempts, open 
and closed connections, bounces, TLS connections, and others.

qmail format delivery logs record the same information regarding the 
operations of the email system as delivery logs following, but stored in qmail 
format. 

Delivery logs record critical information about the email delivery operations 
of the Cisco appliance — for example, information regarding each recipient 
delivery and bounce at the time of the delivery attempt. The log messages are 
“stateless,” meaning that all associated information is recorded in each log 
message and users need not reference previous log messages for information 
about the current delivery attempt. Delivery logs are recorded in a binary 
format for resource efficiency. Delivery Log files must be post-processed 
using a provided utility to convert them to XML or CSV (comma-separated 
values) format. The conversion tools are located at:

http://support.ironport.com

Bounce logs record information about bounced recipients. The information 
recorded for each bounced recipient includes: the message ID, the recipient 
ID, the Envelope From address, the Envelope To address, the reason for the 
recipient bounce, and the response code from the recipient host. In addition, 
you can choose to log a fixed amount of each bounced recipient message. 
This amount is defined in bytes and the default is zero.

This log file records system statistics found in the CLI status commands, 
including 

status detail

 and 

dnsstatus

. The period of recording is set 

using the 

setup

 subcommand in 

logconfig

. Each counter or rate reported in 

status logs is the value since the last time the counter was reset.

Domain debug logs record the client and server communication during an 
SMTP conversation between the Cisco appliance and a specified recipient 
host. This log type can be used to debug issues with specific recipient hosts. 
You must specify the total number of SMTP sessions to record in the log file. 
As sessions are recorded, this number decreases. You can stop domain debug 
before all sessions have been recorded by deleting or editing the log 
subscription.

Injection debug logs record the SMTP conversation between the Cisco 
appliance and a specified host connecting to the system. Injection debug logs 
are useful for troubleshooting communication problems between the Cisco 
appliance and a host on the Internet.

System logs record the following: boot information, DNS status information, 
and comments users typed using 

commit

 command. System logs are useful 

for troubleshooting the basic state of the appliance. 

The CLI audit logs record all CLI activity on the system. 

FTP logs record information about the FTP services enabled on the interface. 
Connection details and user activity are recorded. 

See HTTP Logs.