Views:

CEF Message Tracking Logs

CEF Key
Description
Value 
Header (timestamp)
Local time in the format: "Mmm dd hh:mm:ss"
Example: Dec 5 05:26:45
Header (host)
Hostname without the domain information
Example: internalAP1
Header (logVer)
CEF format version
CEF: 0
Header (vendor)
Appliance vendor
 Trend Micro
Header (pname)
Appliance product
 Deep Discovery Email Inspector
Header (pver)
Appliance version
Example: 5.1.0.1110
Header (eventid)
Signature ID
100136
Header (eventName)
Description
MESSAGE_TRACKING
Header (severity)
Email severity
  • 2: Unavailable
  • 2: Unrated
  • 2: Normal
  • 4: Low
  • 6: Medium
  • 8: High
dvc
Appliance IP address
Example: 10.1.144.199
dvcmac
Appliance MAC address
Example: 00:0C:29:6E:CB:F9
dvchost
Appliance host name
Example: localhost
deviceExternalId
Appliance GUID
Example: 6B593E17AFB7-40FBBB28-A4CE-0462-A536
rt
Log generation time
Example: Mar 09 2015 17:05:21 GMT+00:00 (UTC time)
cs1Label
Label for Email ID
messageId
cs1
Email ID
Example: <20150414032514.494EF1E9A365@internalbeta.bcc.ddei>
cs2Label
Label for internal email ID
msgUuid
cs2
Internal email ID
Example: 6965222B-13A6-C705-89D4-6251B6C41E03
suser
Email sender
Example: user2@domain.com
duser
Email recipients
Example: user1@domain2.com;test@163.com
msg
Email subject
Example: hello
reason
Reason for block action
Example: Timeout period expired
cs3Label
Latest status
latestStatus
cs3
Details
  • Deleted
  • Delivered
  • Delivery unsuccessful
  • Processing completed
  • Quarantined
  • Recipient changed
src
Source IP address
Example: 10.1.144.199
cs4Label
Label for sender email address
senderMail
cs4
Sender email address
Example: user1@domain.com
cs5Label
Label for recipient email address
rcptMail
cs5
Recipient email address
Example: user2@domain.com
deviceTranslatedAddress
Relay MTA IP address
Example: 204.92.31.146
cs6Label
Label for process history
procHistory
cs6
Process history
Example: Action taken by the device. The format: "timestamp1 act1,timestamp2 act2,…, timestampn actn"
Log sample:
May 15 16:00:47 localhost CEF:0|Trend Micro|Deep Discovery
 Email Inspector|3.1.0.1106|100136|MESSAGE_TRACKING|2|rt=A
pr 27 2018 02:55:53 GMT+00:00 cs3Label=latestStatus cs3=De
livery unsuccessful dvchost=localhost.localdomain deviceEx
ternalId=9ceb7be2-3ec5-4b80-8697-6b4913eb044b dvc=10.204.6
3.177 duser=test@test.com dvcmac=00:50:56:A7:5F:AD reason=
host 10.204.253.179[10.204.253.179] said: 552 test@test.co
m mailbox full (in reply to end of DATA command) cs1Label=
messageId cs1=20180427025553.4D771D6135F@localhost.localdo
main cs4Label=senderMail cs4=marks@relay.ddei.comsuser=fak
e@test.testmsg=plain_text_upper_case.HTML/HTM cs2Label=msg
Uuid cs2=EB715918-6ACB-A405-BF46-56F53CE3FD86 cs6Label=pro
cHistory cs6=Apr 27 2018 02:55:53 GMT+00:00 Received,Apr 2
7 2018 02:55:53 GMT+00:00 Sent for analysis,Apr 27 2018 02
:56:48 GMT+00:00 Action set to 'pass',Apr 27 2018 02:56:48
 GMT+00:00 Delivery unsuccessful,Reason:host 10.204.253.17
9[10.204.253.179] said: 552 test@test.com mailbox full (in
 reply to end of DATA command)