SMTP Log Query

Question

Hi all, 
 I was hoping to get some clarification in relation to SMTP Logging on our Sophos UTM SG450 Instance (Version 9.408-4, Active-Passive). 
 Is there a unique field value logged for an inbound (or outbound) email which will show all of the processes carried out against that particular email as it traverses the UTM appliance? 
 I'm examining logs to try and get a better understanding of how the UTM handles emails and I want to isolate just those log entries for a particular email. I'm afraid if I use a sender or recipient value to search against, I may miss out on some information. 
 Many thanks for your time and assistance in this matter. 
 John P

sachingurung · Accepted Answer

Hi John, 
 To get detailed logs over SMTP you need to enable debug over SMTP. 
 Check, https://community.sophos.com/kb/hu-hu/115325 
 Thanks

BAlfson · Answer

John, even without debug, you will note that each message has a unique identifier that is repeated in most lines and in clearly-identifiable groups of lines. 
 Cheers - Bob