Trend Micro InterScan™ Messaging Security Suite Online Help

Collapse AllExpand All
  • about IMSS [1]
  • activate
  • add
    • administrator accounts [1]
  • address group
  • address groups
    • examples of [1]
    • understand [1]
  • administrator accounts
  • Advanced Threat Scan Engine [1]
  • adware [1]
  • antivirus rule [1]
  • APOP [1]
  • approved list
    • add hosts [1]
  • approved senders list
    • configure [1]
  • archive
    • configure settings [1]
  • archive areas
  • archived messages
  • asterisk wildcard
  • attachment size
    • scanning conditions [1]
  • audience [1]
  • back up
  • blocked list
    • add records [1]
  • blocked senders list
    • configure [1]
  • bounced mail settings
    • configure [1]
  • change
    • management console password [1]
  • Cloud Pre-Filter
    • configure DNS MX records [1]
    • create account [1]
    • create policy [1]
    • policies [1]
    • suggested settings [1]
    • troubleshoot [1]
    • understand [1]
    • verify it works [1]
  • Cloud Pre-Filter tab [1]
  • Command & Control (C&C) Contact Alert Services [1]
  • commands [1]
  • community [1]
  • component update [1]
  • condition statements [1]
  • Configuration Wizard
    • accessing [1]
  • configure
    • approved senders list [1]
    • archive settings [1]
    • blocked senders list [1]
    • connection settings [1] [2]
    • Control Manager server settings [1]
    • database maintenance schedule [1]
    • delivery settings [1]
    • Direct Harvest Attack (DHA) settings [1]
    • DNS MX records [1]
    • Email reputation [1]
    • encrypted message scan actions [1]
    • expressions [1]
    • internal addresses [1] [2]
    • LDAP settings [1]
    • log settings [1]
    • Messaged Delivery settings [1]
    • Message Rule settings [1]
    • notification messages [1]
    • notification settings [1]
    • other scanning exceptions scan actions [1] [2]
    • POP3 settings [1] [2]
    • product settings [1]
    • quarantine settings [1]
    • route [1]
    • scan exceptions [1]
    • scheduled reports [1]
    • security setting violation exceptions [1] [2]
    • security setting violation scan actions [1]
    • Sender Filtering [1]
    • Sender Filtering bounced mail settings [1]
    • Sender Filtering spam settings [1]
    • Sender Filtering virus settings [1]
    • SMTP routing [1]
    • SMTP settings [1]
    • spam text exemption rules [1]
    • TMCM settings [1]
    • update source [1]
    • Web EUQ Digest settings [1]
  • configure event criteria [1]
  • configuring
    • Encryption settings [1]
  • connection settings
  • Control Manager
    • enable agent [1]
    • replicate settings [1]
    • see Trend Micro Control Manager [1]
  • Control Manager server settings
    • configure [1]
  • Conventional scan [1]
  • criteria
    • customized expressions [1]
    • keywords [1]
  • customized expressions [1] [2] [3]
  • customized keywords [1]
  • customized templates [1]
  • dashboard
  • database
    • configure maintenance schedule [1]
  • data identifiers [1]
    • expressions [1]
    • file attributes [1]
    • keywords [1]
  • Data Loss Prevention [1]
  • Data Loss Prevention (DLP) [1]
  • default tabs [1]
  • delete
    • address group [1]
    • administrator accounts [1]
  • delivery settings
    • configure [1]
  • dialers [1]
  • Direct Harvest Attack (DHA) settings
    • configure [1]
  • display
    • domains [1]
    • suspicious IP addresses [1]
  • DLP [1]
  • documentation [1]
  • domains
  • edit
    • address group [1]
    • administrator accounts [1]
  • Email Encryption
    • managing domains [1]
    • registering domains [1]
    • understand [1]
  • email relay [1]
  • Email reputation [1]
  • email threats
    • spam [1]
    • unproductive messages [1]
  • enable
    • Control Manager agent [1]
    • Email reputation [1]
    • End-User Access [1]
    • EUQ [1]
    • IP Profiler [1]
    • POP3 scanning [1]
    • sender filtering rules [1]
  • encrypting messages [1]
  • Encryption settings
    • configuring [1]
  • End-User Access
  • ERS
  • EUQ [1]
    • authentication [1]
    • disable [1]
    • enable [1]
    • open the console [1]
    • start [1]
    • web console [1]
    • Web console [1]
  • event criteria
    • configure [1]
  • event notifications [1]
  • export notes [1]
  • expression lists
  • expressions [1] [2]
  • FAQ
  • file attributes [1] [2] [3] [4]
  • File Reputation Services [1] [2]
  • filtering, how it works [1]
  • filters
    • examples of [1]
  • generate
  • graymail [1]
  • hacking tools [1]
  • import notes [1]
  • IMSA
  • IMSS
  • internal addresses
  • IP Profiler [1]
  • joke program [1]
  • keywords [1] [2]
  • known hosts [1]
  • LDAP settings
  • LDAP User or Group
    • search for [1]
  • license
  • logical operators [1]
  • logs [1]
    • configure settings [1]
    • query [1]
    • query message tracking [1]
    • query MTA event [1]
    • query policy event [1]
    • query quarantine event [1]
    • query sender filtering [1]
    • query system event [1]
    • query URL click tracking [1]
  • manage
    • administrator accounts [1]
    • expression lists [1]
    • notifications list [1]
    • one-time reports [1]
    • product licenses [1]
  • manage domains for Email Encryption [1]
  • management console password
  • manual update [1]
  • mass mailing viruses
  • message delivery [1]
  • Message Delivery settings
    • configure [1]
  • Message Rule settings
    • configure [1]
  • messages in the Virtual Analyzer queue
  • message size
    • scanning conditions [1]
  • message traffic tab [1]
  • MIME content type
    • scanning conditions [1]
  • MTA
  • new features [1]
  • notes
  • notification messages
    • configure [1]
  • notifications
  • notification settings
    • configure [1]
  • notifications list
  • one-time reports
  • online
    • community [1]
  • online help [1]
  • other rule [1]
  • password
    • management console [1]
  • password cracking applications [1]
  • pattern files
  • PCRE [1]
  • Perle Compatible Regular Expressions [1]
  • permitted senders [1]
  • policies
  • policy management
  • policy notification
  • POP3 messages
  • POP3 scanning
  • POP3 settings
  • postponed messages
  • predefined expressions [1]
  • predefined keywords
    • distance [1]
    • number of keywords [1]
  • predefined templates [1]
  • product licenses
  • product services [1]
  • product settings
    • configure [1]
  • quarantine
    • configure settings [1]
  • quarantine and archive [1]
  • quarantine areas
  • quarantined messages
  • query
    • archive areas [1]
    • logs [1]
    • messages [1]
    • messages in the Virtual Analyzer queue [1]
    • MTA event logs [1]
    • policy event logs [1]
    • postponed messages [1]
    • quarantine areas [1]
    • quarantine event logs [1]
    • sender filtering logs [1]
    • system event logs [1]
    • URL click tracking logs [1]
  • readme file [1]
  • register domains for Email Encryption [1]
  • remote access tools [1]
  • renew
  • replicating settings [1]
  • reports
  • restore
  • roll back
    • components [1]
  • route
  • scan
    • POP3 messages [1]
    • SMTP messages [1]
  • scan actions
    • configure encrypted message settings [1]
    • configure other scanning exceptions settings [1] [2]
  • scan engine
  • scan exceptions
    • configure [1]
  • Scan methods [1]
  • scanning conditions [1]
    • attachment names [1]
    • attachment number [1] [2]
    • attachments [1]
    • attachment size [1]
    • extensions [1]
    • message size [1]
    • MIME content type [1]
    • spam [1]
    • specify [1]
    • true file type [1]
  • scheduled reports
  • scheduled updates [1]
  • security risks
    • spyware/grayware [1]
  • security setting violations
    • configure exceptions [1] [2]
    • configure scan actions [1]
  • Sender Filtering
    • configure [1]
    • configure bounced mail settings [1]
    • configure Direct Harvest Attack (DHA) settings [1]
    • configure spam settings [1]
    • configure virus settings [1]
  • Sender Filtering Service
  • Sender Filtering tab [1]
  • services [1]
    • Sender Filtering Service [1]
  • smart protection [1] [2]
  • Smart Protection [1] [2]
  • Smart Protection Network [1] [2]
  • Smart Scan [1]
  • SMTP
    • notification server [1]
  • SMTP messages
  • SMTP routing [1]
    • configure [1]
  • SMTP settings
    • configure [1]
  • spam settings
    • configure [1]
  • spam text exemption rules
    • configure [1]
  • specify
    • actions [1]
    • route [1]
    • scanning conditions [1]
    • update source [1]
  • spyware/grayware [1]
    • adware [1]
    • dialers [1]
    • entering the network [1]
    • hacking tools [1]
    • joke program [1]
    • password cracking applications [1]
    • remote access tools [1]
    • risks and threats [1]
  • start
  • support
    • knowledge base [1]
    • resolve issues faster [1]
    • TrendLabs [1]
  • suspicious IP addresses
  • system overview tab [1]
  • System Status screen [1]
  • tabs
    • add a tab [1]
    • Cloud Pre-Filter [1]
    • configure a tab [1]
    • default tabs [1]
    • message traffic [1]
    • Sender Filtering [1]
    • system overview [1]
    • understand [1]
  • tag subject
  • templates [1] [2] [3] [4] [5] [6]
  • TMCM settings
    • configure [1]
  • transport layer [1]
  • TrendLabs [1]
  • Trend Micro Control Manager [1]
  • troubleshooting [1]
    • imssps daemon [1]
  • true file type [1]
  • understand
    • Email Encryption [1]
    • widgets [1]
  • update
    • automatically [1]
    • manually [1]
    • pattern files [1]
    • scan engine [1]
    • system and application [1]
  • update source
  • view
    • archived messages [1]
    • messages in the Virtual Analyzer queue [1]
    • postponed messages [1]
    • product licenses [1]
    • quarantined messages [1]
  • Virtual Analyzer [1]
  • virus settings
    • configure [1]
  • Web EUQ Digest
    • configure settings [1]
  • Web Reputation Services [1] [2]
  • what’s new [1]
  • widgets
    • add a widget [1]
    • configure a widget [1]
    • edit a widget [1]
    • understanding [1]
    • using a widget [1]
  • wildcards [1]
    • file attributes [1]

Configuring Log Settings Parent topic

You can configure the level of detail that IMSS writes to the logs and the length of time it stores them. In addition, you can set the update period that controls how frequently the scanner services write their local logs to the IMSS admin database.

Procedure

  1. Go to Logs → Settings.
    The Log Settings screen appears.
  2. Configure Reporting Logs.
    • Database log update interval: IMSS updates the logs regularly at every interval. Select a number between 1 and 60 for the interval. Selecting 60 means that IMSS updates the logs once every hour.
    • Number of days to keep logs for query: Specify a value between 1 and 60 that represents the number of days IMSS preserves the report logs in the IMSS admin database.
  3. Under Log Files, configure the following:
    • Application log detail level: The level of log detail. Select one of the following:
      • Normal: The standard level of detail. This level provides the basic information needed by an administrator for daily monitoring and maintenance.
      • Detailed: A high level of detail. All IMSS processes write detailed information to the logs, including: POP3 session information, the policy matched, the filter executed, and the action taken.
      • Diagnostic: Comprehensive information on each event or action. Diagnostic level logs include all information from the detailed level, plus SMTP routing information, and the route match information that determined which policy was applied.
      • Debug: The most complete and verbose level of detail. Debug logs are only recommended when troubleshooting.
      Note
      Note
      Diagnostic or debug logs might consume excessive IMSS resources and could reduce system performance.
    • Number of days to keep log files: Select the check box and specify a number between 1 and 150 that represents the number of days IMSS keeps the local log files. To prevent IMSS from deleting the log files, clear the check box.
    • Maximum log file size for each service: Select the check box and specify a number between 100 and 99999 that represents the size in MB for local log files for each type of process or service. To remove any size restriction, clear the check box.
      Note
      Note
      IMSS log files are stored in the folder /opt/trend/imss/log by default.
      Daily log files for each event type are created at midnight and have the suffix "<Date>.<Count>". The <Count> suffix is incremented if there is more than one (1) log file per day.
      If the log file size exceeds the maximum log file size for each service, IMSS will delete the oldest file.
  4. Click Save.