Finding syslog events related to viewed spam quarantine messages

Products

• Messaging Gateway

Issue/Introduction

This article provides a comprehensive guide on how to retrieve events related to the view of messages from spam quarantine from your Syslog server.

Resolution

To retrieve the event of releasing a message from spam quarantine from your Syslog server, you need to look for specific details logged under a particular facility and process ID. Below are the essential elements to check:

• Syslog Facility: AUTHPRIV - security/authorization messages (private) (10)
• Syslog Process ID: AuditEventLoggedManager
• Syslog Message ID: The Syslog message ID follows a specific format, detailing the subject of the message that was released followed by the user who viewed the message
  The message <Message Subject> was viewed by <User Mail Address who viewed the message>