Using Anti-spam Log Entries
IMail Server logs all anti-spam events, such as error messages, to a separate log file. These events are stored in the log file that is selected in the Save Logs To list box in the Setting the Anti-spam Logging Options. The log files also contain text that is returned by a blacklist if a message’s IP address is listed. Other anti-spam events included in the log file are:
- Enabling/disabling phrase filtering or content filtering
- Initialization of phrase filtering and content filtering for each message
- Verification checks performed on a message and the results
- Connections to realtime blacklists and the results of the connection
File Format
The file format for anti-spam log lines is similar to that of the IMail Server logs, except that anti-spam log messages also contain an anti-spam message ID. The generic format of a log file entry is:
Date - Time - Anti-Spam Message ID -Thread or Process ID - Host name – Entry Type - Message
Example:
File Format for Premium Anti-spam Log Entries
10:17 11:24 SMTP(f593012a00000001) e-mail determined to be spam by Premium filter, Tag = 5AE906968DC04881B0626ADBF612D86F, where Tag is the signature ID of the e-mail that caused the spam.
Thread ID
The thread ID allows you to identify all log entries for specific messages. For example, if you want to identify all log entries for the above example, you would look for every entry that contains the thread ID of (00001316). The thread ID persists across log files so you can find a thread ID in the anti-spam log and trace the same message in the SMTP log. This is also the same ID that is used to create the Q and D filenames when a message is being processed.
In addition, the thread ID is inserted into the message's X-Header when it is identified as spam.