Email Appliance Log

Hi BopBop,

The only other option (besides syslog) would be to backup your 'System Logs' to FTP.  The logs will be in the same format as when transferred via syslog.  So a syslog server would usually be preferrable because log data is transferred in real time.

You could import this data into excel, use a reporting program, or manually search the data (eg. via script).  More details on the format are here:
http://esa.sophos.com/docs/esa/sea_docs/en/ESA/references/SEASyslog.html

If you just want more information about the message that was quarantined, you could consider enhancing the notification instead.  You can add variables to your notification to give more detail:

http://esa.sophos.com/docs/esa/sea_docs/en/ESA/concepts/PolAboutActionsTempVars.html

Does that help?  Let me know if there was something specific you want from the logging.

Thanks,

Tom.

I took your suggestions and backed up file in FTP site. But going thru and what I want to find is very hard.

Here is what we are getting now

Whenever DLP  log an email to Email Appliance it is sending email to XXX account with attachment and it is

Violation - Ailment, disease and diagnosis lexicon (ICD-9) [USA] - Lecture_Week10Day1_AdaptiveImmunityPart2.pdf

Now , my CIO wants to see  a report  such as “ how many “Ailment …(ICD9) policy triggered in email appliance . ( I send him weekly report from Sophos Enterprise console” in excel and he can do pivot table and see by each policy.

can i do this without Syslog server ?

Hi,

At the present time customized reporting based on that information is not available.  That specific information is not stored in a database table in which the reports are able to query.  Please contact our support team to request this feature be added into the product.

-Jason