Cisco Cisco Email Security Appliance C160 Mode D'Emploi
5-9
Cisco IronPort AsyncOS 7.6 for Email Daily Management Guide
OL-25138-01
Chapter 5 Logging
Log Types
Information displayed in text mail logs is shown in
Interpreting an IronPort Text Mail Log
Use the following sample as a guide to interpret log files.
Note
Individual lines in log files are NOT numbered. They are numbered here only for sample purposes.
Table 5-5
Text Mail Log Statistics
Statistic
Description
ICID
Injection Connection ID. This is a numerical identifier for an individual SMTP
connection to the system, over which 1 to thousands of individual messages may
be sent.
connection to the system, over which 1 to thousands of individual messages may
be sent.
DCID
Delivery Connection ID. This is a numerical identifier for an individual SMTP
connection to another server, for delivery of 1 to thousands of messages, each
with some or all of their RIDs being delivered in a single message transmission.
connection to another server, for delivery of 1 to thousands of messages, each
with some or all of their RIDs being delivered in a single message transmission.
RCID
RPC Connection ID. This is a numerical identifier for an individual RPC
connection to the Cisco IronPort Spam quarantine. It is used to track messages
as they are sent to and from the Cisco IronPort Spam Quarantine.
connection to the Cisco IronPort Spam quarantine. It is used to track messages
as they are sent to and from the Cisco IronPort Spam Quarantine.
MID
Message ID: Use this to track messages as they flow through the logs.
RID
Recipient ID: Each message recipient is assigned an ID.
New
New connection initiated.
Start
New message started.
Table 5-6
Text Mail Log Detail
1
Mon Apr 17 19:56:22 2003 Info: New SMTP ICID 5 interface Management (10.1.1.1)
address 10.1.1.209 reverse dns host remotehost.com verified yes
2
Mon Apr 17 19:57:20 2003 Info: Start MID 6 ICID 5
3
Mon Apr 17 19:57:20 2003 Info: MID 6 ICID 5 From: <sender@remotehost.com>
4
Mon Apr 17 19:58:06 2003 Info: MID 6 ICID 5 RID 0 To: <mary@yourdomain.com>
5
Mon Apr 17 19:59:52 2003 Info: MID 6 ready 100 bytes from <sender@remotehost.com>
6
Mon Apr 17 19:59:59 2003 Info: ICID 5 close
7
Mon Mar 31 20:10:58 2003 Info: New SMTP DCID 8 interface 192.168.42.42 address
10.5.3.25
8
Mon Mar 31 20:10:58 2003 Info: Delivery start DCID 8 MID 6 to RID [0]
9
Mon Mar 31 20:10:58 2003 Info: Message done DCID 8 MID 6 to RID [0]
10
Mon Mar 31 20:11:03 2003 Info: DCID 8 close