Kaspersky Secure Mail Gateway audit log

Kaspersky Secure Mail Gateway registers email scan-related events in the audit log.

This section contains information on working with the Kaspersky Secure Mail Gateway audit log, as well as information on how to sort and filter events in the audit log or search events by specific table columns based on the indicators you specify.

Viewing the audit log and events in the audit log

To view the Kaspersky Secure Mail Gateway audit log:

1. In the main window of the application web interface, open the management console tree and select the Settings section and Log subsection.
2. In the lower right corner of the window, click the Audit Log link.

This opens the Audit Log window containing the table of events in the Kaspersky Secure Mail Gateway audit log.

The table displays the first 500 events of the audit log. To view a large number of events, utilize filtering and searching events in the audit log.

To view an event in the Kaspersky Secure Mail Gateway audit log:

1. In the main window of the application web interface, open the management console tree and select the Settings section and Log subsection.
2. In the lower right corner of the window, click the Audit Log link.

   This opens the Audit Log window containing the table of events in the Kaspersky Secure Mail Gateway audit log.

3. Click the link with information about the event that you want to view to open a window containing information about this event.
4. If you want to return to the table of events, click the To Audit Log button.

Sorting events in the audit log

To sort events in the audit log:

1. In the main window of the application web interface, open the management console tree and select the Settings section and Log subsection.
2. In the lower right corner of the window, click the Audit Log link.

   This opens the Audit Log window containing the table of events in the Kaspersky Secure Mail Gateway audit log.

3. Click the button to the left of the name of the table column by which you want to sort events. You can sort events by one of the following indicators:
   • Event time—Date and time when the event occurred.
   • Event type—Type of Kaspersky Secure Mail Gateway event. For example, Message scan.
   • Subject ID—Subject identifier. For example, the domain name of the Kaspersky Secure Mail Gateway server.
   • Result—Result of the Kaspersky Secure Mail Gateway event. For example, Success or Fail.
   • Description—Description of the event and its result. For example, the result of a message scan by application modules or a message stating that application database update failed.

To modify the sorting order for messages in queue,

click the or button to the left of the name of the table column whose event sorting order you want to modify.

Filtering and searching events by date and time

To filter or search events by date and time:

1. In the main window of the application web interface, open the management console tree and select the Settings section and Log subsection.
2. In the lower right corner of the window, click the Audit Log link.

   This opens the Audit Log window containing the table of events in the Kaspersky Secure Mail Gateway audit log.

3. Click the Event time link to expand the list of event search periods.
4. Select one of the following periods:
   • Last hour
   • Last day
   • Last week
   • Custom
5. If you chose a custom period for searching events:
   1. In the calendar that opens, specify the start and end dates of the period for displaying events in the audit log.
   2. Click the Apply button.

      The calendar closes.

The workspace of the Audit Log window displays the audit log event table generated based on the filter conditions.

If no message search filter is defined, the table displays the first 500 events of the audit log.

Filtering and searching events by event type

To filter or search events by event type:

1. In the main window of the application web interface, open the management console tree and select the Settings section and Log subsection.
2. In the lower right corner of the window, click the Audit Log link.

   This opens the Audit Log window containing the table of events in the Kaspersky Secure Mail Gateway audit log.

3. Click the Event type link to open the event filter configuration window.
4. In the Event type field, enter several characters or all characters of the event type. For example, you can enter Message scan.
5. Click the Apply button.

The workspace of the Audit Log window displays the audit log event table generated based on the filter conditions.

If no message search filter is defined, the table displays the first 500 events of the audit log.

Filtering and searching events by subject identifier

To filter or search events by subject identifier:

1. In the main window of the application web interface, open the management console tree and select the Settings section and Log subsection.
2. In the lower right corner of the window, click the Audit Log link.

   This opens the Audit Log window containing the table of events in the Kaspersky Secure Mail Gateway audit log.

3. Click the Subject ID link to open the event filter configuration window.
4. In the Subject ID field, enter several characters or all characters of the subject identifier. For example, you can enter the domain name of the Kaspersky Secure Mail Gateway server.
5. Click the Apply button.

The workspace of the Audit Log window displays the audit log event table generated based on the filter conditions.

If no message search filter is defined, the table displays the first 500 events of the audit log.

Filtering and searching events by event result

To filter or search events by event result:

1. In the main window of the application web interface, open the management console tree and select the Settings section and Log subsection.
2. In the lower right corner of the window, click the Audit Log link.

   This opens the Audit Log window containing the table of events in the Kaspersky Secure Mail Gateway audit log.

3. Click the Result link to expand the list of event results.
4. Select one of the following event results:
   • Success
   • Fail
5. Click the Apply button.

The workspace of the Audit Log window displays the audit log event table generated based on the filter conditions.

If no message search filter is defined, the table displays the first 500 events of the audit log.

Filtering and searching events by event description

To filter or search events by event description:

1. In the main window of the application web interface, open the management console tree and select the Settings section and Log subsection.
2. In the lower right corner of the window, click the Audit Log link.

   This opens the Audit Log window containing the table of events in the Kaspersky Secure Mail Gateway audit log.

3. Click the Description link to open the event filter configuration window.
4. In the Description field, enter several characters of the event description.
5. Click the Apply button.

The workspace of the Audit Log window displays the audit log event table generated based on the filter conditions.

If no message search filter is defined, the table displays the first 500 events of the audit log.