Using Antispam Log Entries
IMail Server logs all antispam events, such as error messages, to a separate log file. These events are stored in the log file that is selected in the Save Logs To list box in the Setting the Antispam Logging Options. The log files also contain text that is returned by a black list if a message's IP address is listed. Other antispam events included in the log file are:
- Enabling/disabling phrase filtering or content filtering
- Initialization of phrase filtering and content filtering for each message
- Verification checks performed on a message and the results
- Connections to DNS black lists and the results of the connection
File Format
The file format for antispam log lines is similar to that of the IMail Server logs, except that antispam log messages also contain an antispam message ID. The generic format of a log file entry is:
Date - Time - Anti-Spam Message ID -Thread or Process ID - Host name – Entry Type - Message
Example:
File Format for Premium AntiSpam Log Entries
10:17 11:24 SMTP(f593012a00000001) e-mail determined to be spam by Premium filter, Tag = 5AE906968DC04881B0626ADBF612D86F, where Tag is the signature ID of the e-mail that caused the spam.
Thread ID
The thread ID allows you to identify all log entries for specific messages. For example, if you want to identify all log entries for the above example, you would look for every entry that contains the thread ID of (00001316). The thread ID persists across log files so you can find a thread ID in the antispam log and trace the same message in the SMTP log. This is also the same ID that is used to create the Q and D filenames when a message is being processed.
In addition, the thread ID is inserted into the message's X- Header when it is identified as spam .