Here are some log entries from cisco ironport email security appliance:
I think there are four key words for searching this logs: 2185496, 355912,2185491,2070528, but in nature I only know one key word to search, for example "MID 2185496", here, I want to define a search template that when I input the only one key word, e.g "MID 2185496", then it can print all reference log entries, how can I do it?
asked 21 Feb '11, 02:35
Are you saying that when you specify "MID 2185496" as your search string, you only want to receive the events that have 2185496 as the MID? If so, you can accomplish this a couple of ways:
1: The best method would be to download the Cisco for Ironport E-mail add-on which will do the field extractions for you:
This will allow you to restrict your search to the specific fields within the events. For instance, you could search for messages of MID 2185496, like this:
Adding that app will also allow you to install the Cisco Security Suite which will give you a nice set of pre-defined reports, dashboards, and saved searches:
2: The other option is to do the field extraction yourself. The easiest way to do this is with the Interactive Field Extractor (IFX). Here's a link to the docs on IFX:
answered 21 Feb '11, 08:32
Refer to the above log entry "Start MID 2185491 ICID 2070528", I know that the log entries include "2070528" are relate to "MID 2185491", and log entry "MID 2185491 rewritten to MID 2185496 by LDAP rewrite", it means all log entries include "2185496" also relate to "MID 2185491". And the log entry "Delivery start DCID 355912 MID 2185496 to RID ", it means that all log entries include "355912" also relate to the "MID 2185491".
So, I want to search "mid=2185491", then it can print out all log entries which include 2070528, 2185496, 355912 and 2185491.
answered 22 Feb '11, 10:14