Technical Library | Support

Go to the table of contents Go to the previous page Go to the next page View or print as PDF
Getting Started > The dashboard > Viewing and searching logs > Connection Log
Connection Log
Administrator Help | TRITON AP-EMAIL | Version 8.2.x
The Connection Log is a record of incoming connection requests and the results of connection analysis. Access the Connection Log on the Main > Status > Logs page by clicking the Connection tab.
You can configure the number of entries per log page, between 25 and 200, in the Per page drop-down list in the log table banner. At the top and bottom of the page, scroll through Connection Log pages by clicking the back and next arrows in the banner, or enter a specific page number in the Page field and click Go.
The length of time connection records are saved in the database depends on your connection volume and database partition capacity. To preserve connection records, use the Export option to export log data on a regular basis. Exporting does not remove records from the Connection Log. It copies log data to a CSV or HTML file.
When the Connection Log page appears, the most recent records are shown. Use the View from/to fields to specify the date/time range for the log entries you want to see. The calendar includes the following options:
*
Change the month and year by using the back and next arrows around the month and year at the top of the calendar.
*
Set the calendar to the current date by clicking the date in the lower left corner of the calendar.
*
Click Clean to clear the current date/time calendar selection.
*
Click Today to set the calendar date to today's date.
Set the time range in hours and minutes in the entry fields to the right of the calendar.
Connection Log data
The following connection data is collected and displayed in table format:
Connection Data Item
Description
Sender IP Address
The connection's sender IP address
Date/Time
The date and time a connection was received
Number of Messages
The number of messages in the connection
Security Level
Encrypted or Not Encrypted
Connection Status
Current connection status (Accepted or Blocked).
Status details are displayed in a hover-over pop-up box.
Possible Blocked status details are as follows:
*
HELO/EHLO received before SMTP server greeting
*
Connection from <server address> failed SPF check.
*
Reverse DNS lookup failed.
*
Simultaneous connections from <server address> exceeded limit.
*
Message volume exceeded limits.
*
Message size exceeded limit. Message was forwarded to <queue id> queue.
*
File size exceeded limit. Message was forwarded to <queue id> queue.
*
Data size per connection exceeded limit. Message was forwarded to <queue id> queue.
*
HELO command syntax error
*
EHLO command syntax error
*
Percentage of invalid recipients exceeded limit.
*
Connection attempt by <server name> failed global Always Block list check.
*
Connection attempt by <server name> failed recipient validation check.
*
Connection attempt by <server name> failed user authentication.
*
Open relay from <sender name> blocked.
Possible Accepted status details are as follows:
*
Email Hybrid Service IP Group entry match
*
Trusted IP group entry match
*
Access list entry match
*
Global Always Permit List entry match
*
BATV bypass entry match
*
True source IP address matched a Trusted IP group entry
*
True source IP address matched an access list entry
*
True source IP address matched an Email Hybrid Service IP Group entry
*
True source IP address matched a global Always Permit List entry
*
True source IP address matched a BATV bypass e
When you click an individual sender IP address link in the Connection Log, the Message Log opens and displays details about the message or messages associated with the selected connection. See Message Log data for details.
Connection Log search options
The Connection Log includes several search options, including date range or keyword searches. Determine the date/time range for a search by selecting dates in the View from/to field calendar controls. Default value for the from or to field is the date and time that you open the log.
You can perform a keyword search by selecting the log elements on which you want the search done from the Keyword search drop-down list and then entering a term in the field to the right of the list. Search for a keyword in all Connection Log elements, or in 1 of the following components:
*
Sender IP address (wildcards and special characters are not supported in the keyword)
*
Security Level
*
Connection Status
Click Search to generate search results.
Click Set to Default to return the keyword search options to the default settings (All Connection Log components with the keyword field blank).
Connection Log export options
To export Connection Log search results:
1.
Click Export to open the Export Log dialog box.
2.
Select the desired output file type (CSV or HTML).
*
If you select CSV, a dialog box opens to let you open or save a text file in comma-separated value format.
*
If you select HTML, a dialog box opens to let you open or save an HTML file containing the log data.
3.
Indicate the pages you want to export (All, Current Page, or a page range).
4.
Click OK.

Go to the table of contents Go to the previous page Go to the next page View or print as PDF
Getting Started > The dashboard > Viewing and searching logs > Connection Log
Copyright 2016 Forcepoint LLC. All rights reserved.