TMEF Message Tracking Logs
|
TMEF Key
|
Description
|
Value
|
|
Header (timestamp)
|
Local time in the format: "Mmm dd
hh:mm:ss"
|
Example: Dec 5 05:26:45
|
|
Header (host)
|
Hostname without the domain information
|
Example: internalAP1
|
|
Header (logVer)
|
CEF format version
|
1.0
|
|
Header (vendor)
|
Appliance vendor
|
Trend Micro |
|
Header (pname)
|
Appliance product
|
Deep Discovery Email Inspector |
|
Header (pver)
|
Appliance version
|
Example: 5.1.0.1110
|
|
Header (eventid)
|
Signature ID
|
100136
|
|
Header (eventName)
|
Description
|
MESSAGE_TRACKING
|
|
Header (severity)
|
Email severity
|
|
|
dvc
|
Appliance IP address
|
Examples:
|
|
dvcmac
|
Appliance MAC address
|
Example: 00:0C:29:6E:CB:F9
|
|
dvchost
|
Appliance host name
|
Example: localhost
|
|
deviceGUID
|
Appliance GUID
|
Example: 6B593E17AFB7-40FBBB28-A4CE-0462-A536
|
|
rt
|
Log generation time
|
Example: Mar 09 2015 17:05:21 GMT+00:00 (UTC time)
|
|
cs1Label
|
Label for Email ID
|
messageId
|
|
cs1
|
Email ID
|
Example:
<20150414032514.494EF1E9A365@internalbeta.bcc.ddei>
|
|
cs2Label
|
Label for internal email ID
|
msgUuid
|
|
cs2
|
Internal email ID
|
Example: 6965222B-13A6-C705-89D4-6251B6C41E03
|
|
suser
|
Email sender
|
Example: user2@domain.com
|
|
duser
|
Email recipients
|
Example: user1@domain2.com;test@163.com
|
|
mailMsgSubject
|
Email subject
|
Example: hello
|
|
reason
|
Reason for block action
|
Example: Timeout period expired
|
|
cs3Label
|
Latest status
|
latestStatus
|
|
cs3
|
Details
|
|
|
src
|
Source IP address
|
Example: 10.1.144.199
|
|
cs4Label
|
Label for sender email address
|
senderMail
|
|
cs4
|
Sender email address
|
Example: user1@domain.com
|
|
cs5Label
|
Label for recipient email address
|
rcptMail
|
|
cs5
|
Recipient email address
|
Example: user2@domain.com
|
|
deviceTranslatedAddress
|
Relay MTA IP address
|
Example: 204.92.31.146
|
|
cs6Label
|
Label for process history
|
procHistory
|
|
cs6
|
Process history
|
Example: Action taken by the device. The format: "timestamp1 act1,timestamp2
act2,…, timestampn actn"
|
Log sample:
May 15 16:08:12 internalbeta CEF:0|Trend Micro|Deep Discovery Email Inspector|3.1.0.1154|100136|MESSAGE_TRACKING|2|rt=May 15 2018 08:02:50 GMT+00:00 src=199.59.150.74 deviceGUID=67067 637-acbf-46de-a22d-be8d0d976cd5 cs6Label=procHistory cs6=May 15 2018 08:02:50 GMT+00:00 Received,May 15 2018 08:02:51 GMT+ 00:00 Sent for analysis,May 15 2018 08:07:52 GMT+00:00 Action set to 'pass',May 15 2018 08:07:52 GMT+00:00 Processing comp leted mailMsgSubject=BBC News (World)"US to open controversi al Jerusalem embassy" deviceTranslatedAddress=199.59.150.74 d vchost=internalbeta.bcc.ddei dvc=10.64.1.131 duser=user1@doma in.com cs1Label=messageId cs1=20180515080250.DEDC168349EC@int ernalbeta.bcc.ddei cs4Label=senderMail cs4=info@twitter.com c s5Label=rcptMail cs5=user2@domain2.com suser=n066660a6ef-3786 c6192ef34d49a9435fb49c655529-user2\=\=\=domain2.com@bounce.tw itter.com dvcmac=EC:F4:BB:DE:E5:30 cs3Label=latestStatus cs3= Processing completed cs2Label=msgUuid cs2=105D32B1-6C3A-0705- 954B-563DDB1B5714