Views:

LEEF Message Tracking Logs

LEEF Key
Description
Value 
Header (timestamp)
Local time in the format: "Mmm dd hh:mm:ss"
Example: Dec 5 05:26:45
Header (host)
Hostname without the domain information
Example: internalAP1
Header (logVer)
CEF format version
1.0
Header (vendor)
Appliance vendor
 Trend Micro
Header (pname)
Appliance product
 Deep Discovery Email Inspector
Header (pver)
Appliance version
Example: 5.1.0.1110
Header (eventName)
Event Name
MESSAGE_TRACKING
sev
Email severity
  • 2: Unavailable
  • 2: Unrated
  • 2: Normal
  • 4: Low
  • 6: Medium
  • 8: High
dvc
Appliance IP address
Examples:
  • IPV4:192.168.10.1
  • IPv6:2620:0101:4002:0401::131
dvcmac
Appliance MAC address
Example: 00:0C:29:6E:CB:F9
dvchost
Appliance host name
Example: localhost
deviceGUID
Appliance GUID
Example: 6B593E17AFB7-40FBBB28-A4CE-0462-A536
devTime
Log generation time
Example: Mar 09 2015 17:05:21 GMT+00:00 (UTC time)
devTimeFormat
Time format
MMM dd yyyy HH:mm:ss z
messageId
Email ID
Example: <20150414032514.494EF1E9A365@internalbeta.bcc.ddei>
msgUuid
Internal email ID
Example: 6965222B-13A6-C705-89D4-6251B6C41E03
suser
Email sender
Example: user2@domain.com
duser
Email recipients
Example: user1@domain2.com;test@163.com
mailMsgSubject
Email subject
Example: hello
reason
Reason for block action
Example: Timeout period expired
latestStatus
Latest status
  • Deleted
  • Delivered
  • Delivery unsuccessful
  • Processing completed
  • Quarantined
  • Recipient changed
src
Source IP address
Example: 10.1.144.199
senderMail
Sender email address
Example: user1@domain.com
rcptMail
Recipient email address
Example: user2@domain.com
deviceTranslatedAddress
Relay MTA IP address
Example: 204.92.31.146
procHistory
Process history
Example: Action taken by the device. The format: "timestamp1 act1,timestamp2 act2,…, timestampn actn"
Log sample:
May 15 16:00:4 7 internalbeta LEEF:1.0|Trend Micro|Deep Di
scovery Email Inspector|3.1.0.1154|MESSAGE_TRACKING|sev=2<
009>latestStatus=Processing completed<009>procHistory=May 
15 2018 08:00:33 GMT+00:00 Received,May 15 2018 08:00:33 G
MT+00:00 Action set to 'pass',May 15 2018 08:00:33 GMT+00:
00 Processing completed<009>msgUuid=46252714-6C39-FF05-98F
4-5C63BCB20569<009>mailMsgSubject=Time is running out: New
 data privacy permissions<009>src=104.130.122.63<009>sende
rMail=sap@mailsap.com<009>suser=bounce+814a73.7ecda73-jeff
_lovelace=trendmicro.com@mailsap.com<009>dvchost=internalb
eta.bcc.ddei<009>dvc=10.64.1.131<009>duser=jeff_lovelace@t
rendmicro.com<009>deviceGUID=67067637-acbf-46de-a22d-be8d0
d976cd5<009>rcptMail=jeff_lovelace@trendmicro.com<009>devT
ime=May 15 2018 08:00:33 GMT+00:00<009>messageId=201805150
80033.0EE4B6834964@internalbeta.bcc.ddei<009>dvcmac=EC:F4:
BB:DE:E5:30<009>devTimeFormat=MMM dd yyyy HH:mm:ss z<009>d
eviceTranslatedAddress=104.130.122.63