WSM Reference Guide - WatchGuard Technologies

Traffic Logs
SMTP Proxy Traffic Log Messages
Text in Message Field
Associated Fields
SMTP AV ERROR
filename
error
sender
recipient
SMTP REQ
rcvd_bytes
sent_bytes
sender
recipient
SMTP MESSAGE FORMAT
header
mime_error
sender
recipients
SMTP IPS MATCH
ips_msg
signature_id
SMTP TOO MANY RECIPIENTS
num_recipients
SMTP RESPONSE SIZE TOO LONG
headers_size
SMTP LINE LENGTH TOO LONG
line_length
SMTP MESSAGE SIZE TOO LONG
size
SMTP HEADERS SIZE TOO LONG
headers_size
Message Meaning
Value that appears in associated field(s)
The SMTP cannot finish an antivirus scan, usually because an
attachment was encrypted
file name
description of error
sender e-mail address (from envelope)
recipient e-mail addresses (from envelope)
Auditing information about an SMTP request
size of message before proxying
size of message after proxying
sender e-mail address (from envelope)
recipient e-mail addresses (from envelope)
The SMTP header uses a format that is not correct
header with improper format
description of format error
sender e-mail address (from envelope)
recipient e-mail addresses (from envelope)
The SMTP proxy found an IPS signature match
description of the signature that matched
the signature ID of the rule that matched
The number of e-mail addresses in the TO field is larger than the
configured limit
number of recipients
The SMTP server sent a response that is too long
total size of message headers (up to when log emitted; full headers can
be larger)
The SMTP client or server has sent a line that is longer than the
configured limit
total size of header line (up to when log emitted; full line can be larger)
The SMTP client sent a message larger than the configured limit
size in bytes of message received (up to when log emitted; full message
can be larger)
The SMTP client sent a header section that is larger than the SMTP limit
total size of message headers (up to when log emitted; full headers can
be larger)
DNS Proxy Traffic Log Messages
Text in Message Field
Associated Fields
DNS INVALID NUMBER OF QUESTIONS
DNS OVERSIZED QUERY NAME
DNS COMPRESSED QUERY NAME
DNS PARSE ERROR
DNS NOT INTERNET CLASS
query_class
DNS DENIED OPCODE
rulename
query_opcode
DNS DENIED QUERY TYPE
rulename
query_type
DNS UNDERSIZED QUESTION
Message Meaning
Value that appears in associated field(s)
There is more than one RRs inquiry in one DNS request
The total DNS query frame size is larger than the DNS protocol limit
The client used a DNS compression scheme in the query name
The DNS request or respone is not in the correct format.
The DNS query is not in IP protocol format
name or number of its class
The opcode matches a configured proxy rule
name of rule matched in ruleset
name of the denied opcode (IQUERY, STATUS, UPDATE)
The query type matches a configured proxy rule
name of rule matched in ruleset
name of denied type (a, MX, NS)
The name component of the DNS query is too small
32 WatchGuard System Manager