Documentation | Support

Go to the table of contents Go to the previous page Go to the next page View or print as PDF
Getting Started > Viewing and searching logs > Connection Log
Connection Log
Administrator Help | Forcepoint Email Security | Version 8.5.x
The Connection Log is a record of incoming connection requests and the results of connection analysis. Access the Connection Log on the Connection tab of the page Main > Status > Logs.
Connection Log data
The following table details the connection data that is collected and displayed in the Connection Log in table format:
 
Connection Data Item
Description
Sender IP Address
The connection's sender IP address.
Date/Time
The date and time a connection was received.
Number of Messages
The number of messages in the connection.
Security Level
Encrypted or Not Encrypted.
Connection Status
Current connection status (Accepted or Blocked).
Status details are displayed in a hover-over pop-up box.
Possible Blocked status details are as follows:
*
HELO/EHLO received before SMTP server greeting.
*
Connection from <server address> failed SPF check.
*
Reverse DNS lookup failed.
*
Simultaneous connections from <server address> exceeded limit.
*
Message volume exceeded limits.
*
Message size exceeded limit. Message was forwarded to <queue id> queue.
*
File size exceeded limit. Message was forwarded to <queue id> queue.
*
Data size per connection exceeded limit. Message was forwarded to <queue id> queue.
*
HELO command syntax error.
*
EHLO command syntax error.
*
Percentage of invalid recipients exceeded limit.
*
Connection attempt by <server name> failed global Always Block list check.
*
Connection attempt by <server name> failed recipient validation check.
*
Connection attempt by <server name> failed user authentication.
*
Open relay from <sender name> blocked.
Possible Accepted status details are as follows:
*
Email Hybrid Service IP Group entry match.
*
Trusted IP group entry match.
*
Access list entry match.
*
Global Always Permit List entry match.
*
BATV bypass entry match.
*
True source IP address matched a Trusted IP group entry.
*
True source IP address matched an access list entry.
*
True source IP address matched an Email Hybrid Service IP Group entry.
*
True source IP address matched a global Always Permit List entry.
*
True source IP address matched a BATV bypass.
Connection Log search options
The Connection Log Search Options section includes search options such as date range or keyword. The View from/To calendar controls are used to determine the date and time range for a search. The default value for the from and to fields is the date and time at which the log is opened.
The calendar includes the following options:
*
Back and Next arrows display around the month and year at the top of the calendar to change the month and the year.
*
The current date displays in the lower left corner of the calendar; selection sets the calendar to the current date.
*
The Clean option is used to clear the current date/time calendar selection.
*
The Today option is used to set the calendar date to the current date.
*
The entry fields to the right of the calendar are used to set the time range in hours and minutes.
Search the Connection Log
1.
From the section Connection Log Search Options, set the date and time to be searched in the fields View from and To.
(Optional) Use the calendar functionality to specify a date to search.
2.
From the pull-down menu Keyword search, select a Connection Log element in which to search; All, Sender IP address, Security level, or Connection status.
3.
In the text field, enter a search term.
Alphanumeric characters are supported in the keyword search entry field. Wildcards and special characters are not supported in the keyword search for Sender IP address.
4.
Click Search.
The search results display.
5.
(Optional) Restore all search settings to the default, click Set to Default.
Search settings are reset.
Configure display settings and navigate log entries
1.
From the pull-down menu Per page, select the number of entries to display; 25, 50, 100, or 200.
2.
Scroll through Connection Log pages, select the arrows to go back and next, or to the first and last pages of Connection Log entries.
3.
Jump to a specific page; in the field Page, enter the page number and select Go.
Connection Log export options
The length of time connection records are saved in the database depends on the connection volume and database partition capacity. The Export option is used to preserve connection records by exporting log data; it is recommended to export data on a regular basis. Exporting does not remove records from the Connection Log; it copies log data to a CSV or HTML file.
Export Connection Log data
1.
From the Connection Log, click Export.
The Export Log dialog box displays.
2.
From the pull-down menu File type, select the desired output file type; CSV or HTML.
*
Selection of CSV enables data to be opened or saved as a text file in comma-separated value format.
*
Selection of HTML enables data to be opened or saved as an HTML file.
3.
From Page range, indicate the pages to export; All, Current Page, or Pages.
4.
Click OK.
The Export Log window closes and the selected data is exported.
Connection Log details
Selection of an individual sender IP address link in the Connection Log displays the Log Details page with details about the message or messages associated with the selected connection. See Log Details.

Go to the table of contents Go to the previous page Go to the next page View or print as PDF
Getting Started > Viewing and searching logs > Connection Log
Copyright 2022 Forcepoint. All rights reserved.