d. Email Filter
- Svetlana Sheptiy
- Karein Directo (Unlicensed)
Records email filter events.
Sample Event
date=2019-04-09 time=03:41:18 logid="0553020509" type="utm" subtype="emailfilter" eventtype="ftgd_err" level="error" vd="vdom1" eventtime=1554806478647415130 policyid=1 sessionid=439 srcip=10.1.100.22 srcport=39937 srcintf="port21" srcintfrole="undefined" dstip=172.16.200.45 dstport=143 dstintf="port17" dstintfrole="undefined" proto=6 service="IMAPS" profile="822881" action="passthrough" direction="outgoing" size="525" attachment="no"
Fields
Field | Description |
|---|---|
DATE | Event date, in the format YYYY-MM-DD |
TIME | Event time, in the format HH:MM:SS |
SYSTEM | The source system |
TABLE | FortiGateEmailFilter |
CRITICALITY |
|
LOGID | Unique 10-digit identifier (log type, subtype/event type and message ID) for that specific log and includes information about the log entry |
TYPE | Represented by the first two digits of the log ID |
SUBTYPE | Represented by the first/second two digits of the log ID |
EVENTTYPE | Represented by the second two digits of the log ID |
DEVNAME |
|
DEVID | Serial number of the device for the traffic's origin |
LEVEL | Security level rating |
VD | Name of the virtual domain in which the log message was recorded |
EVENTTIME | Epoch time the log was triggered by FortiGate |
POLICYID | Policy ID |
SESSIONID | Session ID |
USER |
|
SRCIP | Source IP |
SRCPORT | Source port |
SRCINTF | Source interface |
SRCINTFROLE |
|
DSTIP | Destination IP |
DSTPORT | Destination port |
DSTINTF | Destination interface |
DSTINTFROLE |
|
PROTO | Protocol number |
SERVICE |
|
PROFILE |
|
ACTION |
|
FROM |
|
TO |
|
RECIPIENT |
|
DIRECTION |
|
AGENT |
|
SUBJECT |
|
SIZE |
|
ATTACHMENT |
|
MSG | Message text |
SNAREDATAMAP | All other data in the event will be pushed to this field |
Notes
Log Message Reference Documentation: https://docs.fortinet.com/document/fortigate/6.4.2/fortios-log-message-reference