InterScanTM Messaging Security Virtual Appliance - Online Help ...

Trend Micro InterScan Messaging Security Virtual Appliance Administrator’s Guide
Querying Logs
23-4
You can perform queries on five types of events or information:
• Message tracking: Records message details such as the sender, recipient(s),
message size, and the final action that IMSVA or Cloud Pre-Filter has taken. The
query result also indicates the name and type of the policy rule that was triggered.
• System events: Tracks the time of system events such as user access, modification
of rules, registration of MCP agent and so on.
• Policy events: Provides details on the policy rules that were triggered, the actions
taken, and the message details.
• MTA events: Provides connection details of Postfix on the local computer where
the central controller is installed.
• IP filtering: Provides the time when IMSVA started and stopped blocking email
messages from the queried IP address.
Log Query Behavior
With the inclusion of Cloud Pre-Filter to IMSVA, changes in the way that users can
query logs have been introduced.
Message Tracking Enhancement
IMSVA splits Message tracking logs in to:
• IMSVA data only: These message tracking logs only contain data from IMSVA.
• Cloud Pre-Filter + IMSVA data: These message tracking logs contain data from
the Cloud Pre-Filter and IMSVA.
IMSVA includes hyperlinks for quarantined, archived, and postponed messages in
Message tracking logs. This provides detailed information about those messages.
Query Behavior
IMSVA provides the following log query behavior: