To perform the Content Scanning (Spam) log query, do the steps below:

1. Send the logs to Apex Central.
   1. On the SMEX web console, navigate to Administration > Apex Central Settings.
   2. Tick the Send spam logs to Apex Central option.

      

      Those logs will appear in Apex Central under the "Content violation category".

      

      ^{Click the image to enlarge.}

       

2. Send logs via syslog to a third-party log management system.
   1. In the Apex Central console, go to Logs > Log Forwarding.
   2. Under Log Type, make sure the Spam Prevention is selected.

      

      ^{Click the image to enlarge.}

More information regarding the format of the syslog events sent by SMEX can be found in the following KB article: ScanMail for Exchange (SMEX) 14.0 Syslog content mapping guide