WSM Reference Guide - WatchGuard Technologies

Traffic Logsdst_ip="66.35.250.151" pr="tcp/http" src_port="4345" dst_port="80"src_intf="1-Trusted" dst_intf="0-External" src_ip_nat="250.168.43.6"src_port_nat="13419" rc="523" msg="Conn End" proxy_act="HTTP-Client.2"log_type="tr"/>Each proxy has its own set of messages. The tables here show the log messages each proxy can write tothe log file, and the secondary fields for each log message.SMTP Proxy Traffic Log MessagesText in Message FieldAssociated FieldsSMTP GREETINGhostnamerule_nameSMTP AUTHauthtyperule_nameSMTP HEADERheaderSMTP FROM ADDRESSaddresslengthresponsenew_addressheaderSMTP TO ADDRESSaddressnew_addresslengthresponseSMTP CONTENT TYPEcontent_typerule_namesenderrecipientSMTP CommandkeywordresponseSMTP FILENAMEfile_namerule_namesenderrecipientsSMTP TIMEOUTtimeoutSMTP AV VIRUSvirusfilenamecontent_typesenderrecipientSMTP AV TOO BIGfilenametypeMessage MeaningValue that appears in associated field(s)There is an invalid message in HELO statehostname sent in SMTP greetingname of rule matched in rulesetThe AUTH type used matces a configured proxy ruleAUTH type usedname of rule matched in rulesetThe SMTP header matches a configured proxy rule.header nameThe sender e-mail address matches a configured proxy rulethe sender e-mail address (from envelope)length in bytes of addressresponse code returned to clientnew address, if address rewrite usedif header rewrite feature is usedThe recipient e-mail address matches a configured proxy rulerecipient e-mail address (from envelope)new address, if address rewrite usedlength in bytes of addressresponse code returned to clientThe content type matches a configured proxy rulethe content type found by the SMTP proxyname of rule matched in rulesetsender e-mail address (from envelope)recipient e-mail addresses (from envelope)The full SMTP command as received from the SMTP clientvalues include EXPN, HELP, NOOP, etc.response code returned to clientThe filename matches a configured proxy rulethe file namename of rule matched in rulesetsender e-mail address (from envelope)recipient e-mail addresses (from envelope)The connection idle timeout was reachednumber of seconds configured to time-outThe SMTP proxy found a virusthe name of the virus foundthe filenamethe content type of the virus foundsender e-mail address (from envelope)recipient e-mail addresses (from envelope)An attachment was too big to scanthe filenamethe content type of the attachmentReference Guide 31