Руководство Пользователя для Cisco Cisco Content Security Management Appliance M160

Скачать
Страница из 413
 
14-25
Cisco IronPort AsyncOS 8.0 for Security Management User Guide
 
Chapter 14      Logging
White space, punctuation, and, in the case of the 250 response, the OK characters are stripped from 
the beginning of the string. Only white space is stripped from the end of the string. For example, 
Cisco IronPort appliances, by default, respond to the DATA command with this string: 
250 Ok: 
Message MID accepted
. So, the entry “Message MID accepted” would be logged if the remote host 
were another Cisco IronPort appliance. 
  •
Original Subject Header: When this option is enabled, the original subject header of each message 
is included in the log.
Tue May 31 09:20:27 2005 Info: Start MID 2 ICID 2
Tue May 31 09:20:27 2005 Info: MID 2 ICID 2 From: <mary@example.com>
Tue May 31 09:20:27 2005 Info: MID 2 ICID 2 RID 0 To: <joe@example.com>
Tue May 31 09:20:27 2005 Info: MID 2 Message-ID '<44e4n$2@example.com>'
Tue May 31 09:20:27 2005 Info: MID 2 Subject 'Monthly Reports Due'
Logging Message Headers
In some cases, it is necessary to record the presence and contents of a message’s headers as they pass 
through the system. You specify the headers to record on the Log Subscriptions Global Settings page (or 
via the 
logconfig
 -> 
logheaders
 subcommand in the CLI). The Cisco IronPort appliance records the 
specified message headers in the text mail logs and the tracking logs. If the header is present, the system 
records the name of the header and the value. If a header is not present, nothing is recorded in the logs.
Note
The system evaluates all headers that are present on a message, at any time during the processing of the 
message for recording, regardless of the headers specified for logging.
Note
The RFC for the SMTP protocol is located at 
http://www.faqs.org/rfcs/rfc2821.html
 and defines user-defined headers. 
Note
If you have configured headers to log via the 
logheaders
 command, the header information appears after 
the delivery information:
For example, specifying “date, x-subject” as headers to be logged causes the following line to appear in 
the mail log:
Tue May 31 10:14:12 2005 Info: Message done DCID 0 MID 3 to RID [0] [('date', 'Tue, 31 May 
2005 10:13:18 -0700'), ('x-subject', 'Logging this header')]
Configuring Global Settings for Logging by Using the GUI
Procedure 
Step 1
Click the Edit Settings button in the Global Settings section of the Log Subscriptions page. 
Table 14-23
Log Headers  
Header name
Name of the header
Value
Contents of the logged header