Log View Database Schema Parent topic

The following table combines table tblMessageEntries and view tblFilterEntries.

View [vwMsgFilterEntries]

Field Name
From Table
From Field
Description
filter_scan_time
tblFilterEntries
filter_scan_time
The scan time
msg_source
tblMessageEntries
msg_source
The semi-colon delimited sender list
msg_destination
tblMessageEntries
msg_destination
The semi-colon delimited recipient list
msg_subject
tblMessageEntries
msg_subject
The subject of this message
filter_rule
tblFilterEntries
filter_rule
The filter rule triggered. Virus/malware name for security risk filter, rule name for content filter, and file type blocked by attachment blocking filter (such as .exe), risk level of a malicious URL for Web Reputation filter
filter_reason
tblFilterEntries
filter_reason
Detailed information about how the content is being detected for content violation, malicious URL for Web Reputation filter
file_original
tblFilterEntries
file_original
The original filename that triggered the rule
msg_entry_id
tblMessageEntries
msg_entry_id
Primary key of the table [tblMsgEntries]
filter_id
tblFilterEntries
filter_id
Primary key of the table [tblFilterEntries]
filter_action
tblFilterEntries
filter_action
The result of the action taken
filter_rule_supplement
tblFilterEntries
filter_rule_supplement
The virus/malware type, used to separate virus and spyware
msg_device_id
tblMessageEntries
msg_device_id
The device ID of the device that synced the message
msg_device_user
tblMessageEntries
msg_device_user
The user of the device that synced the message
For example, test.com\user
msg_os_version
tblMessageEntries
msg_os_version
The operating system and version of the device that synced the message
For example, Android 4.1.2
The following table selects blocked attachments data from view vwMsgFilterEntries.

View [vwABLogs]

Field Name
From Table
From Field
Description
filter_scan_time
vwMsgFilterEntries
filter_scan_time
The scan time
msg_source
vwMsgFilterEntries
msg_source
The semi-colon delimited sender list
msg_destination
vwMsgFilterEntries
msg_destination
The semi-colon delimited recipient list
msg_subject
vwMsgFilterEntries
msg_subject
The subject of this message
filter_rule
vwMsgFilterEntries
filter_rule
File type blocked by attachment blocking filter (such as .exe)
filter_original
vwMsgFilterEntries
filter_original
The original filename that triggered the rule
filter_action
vwMsgFilterEntries
filter_action
The result of action taken. Reference [action_description.xml], which is located in %SMMS_HOME%\ web\xml
Note
Note
%SMMS_HOME% represents the ScanMail Mobile installation directory. By default, this is C:\Program Files\Trend Micro\ScanMail Mobile\
filter_id
vwMsgFilterEntries
filter_id
Primary key of the table [tblFilterEntries]
msg_device_id
vwMsgFilterEntries
msg_device_id
The device ID of the device that synced the message
msg_device_user
vwMsgFilterEntries
msg_device_user
The user of the device that synced the message
For example, test.com\user
msg_os_version
vwMsgFilterEntries
msg_os_version
The operating system and version of the device that synced the message
For example, Android 4.1.2
The following table selects Data Loss Prevention incident data from view vwMsgFilterEntries.

View [vwDLPLogs]

Field Name
From Table
From Field
Description
filter_scan_time
vwMsgFilterEntries
filter_scan_time
The scan time
msg_source
vwMsgFilterEntries
msg_source
The semi-colon delimited sender list
msg_destination
vwMsgFilterEntries
msg_destination
The semi-colon delimited recipient list
msg_subject
vwMsgFilterEntries
msg_subject
The subject of this message
filter_rule_dlp
vwMsgFilterEntries
filter_rule
Rule name for Data Loss Prevention
filter_action
vwMsgFilterEntries
filter_action
The result of action taken. Reference [action_description.xml], which is located in %SMMS_HOME%\ web\xml
Note
Note
%SMMS_HOME% represents the ScanMail Mobile installation directory. By default, this is C:\Program Files\Trend Micro\ScanMail Mobile\
file_original
vwMsgFilterEntries
file_original
The original filename that triggered the rule
filter_template
vwMsgFilterEntries
filter_reason
The triggered Data Loss Prevention template
msg_device_id
vwMsgFilterEntries
msg_device_id
The device ID of the device that synced the message
msg_device_user
vwMsgFilterEntries
msg_device_user
The user of the device that synced the message
For example, test.com\user
msg_os_version
vwMsgFilterEntries
msg_os_version
The operating system and version of the device that synced the message
For example, Android 4.1.2

Example 1: Query information about the attachment blocking log from ‘vwABLogs’ between 12/12/2008 09:00:00’ AND ‘12/18/2008 09:00:00’ 

SELECT *
FROM vwABLogs
WHERE filter_scan_time 
BETWEEN ‘2008-12-12 09:00:00’ AND ‘2008-12-19 09:00:00’
ORDER BY filter_scan_time;