Views:

To perform the Content Scanning (Spam) log query, do the steps below:

  1. Send the logs to Apex Central.
    1. On the SMEX web console, navigate to Administration > Apex Central Settings.
    2. Tick the Send spam logs to Apex Central option.

      Spam Logs

      Those logs will appear in Apex Central under the "Content violation category".

      Content Violation

      Click the image to enlarge.

       

  2. Send logs via syslog to a third-party log management system.
    1. In the Apex Central console, go to Logs > Log Forwarding.
    2. Under Log Type, make sure the Spam Prevention is selected.

      Log Forwarding Settings

      Click the image to enlarge.

 
The log forwarding setting is only available starting with ScanMail for Exchange 14.
 

More information regarding the format of the syslog events sent by SMEX can be found in the following KB article: ScanMail for Exchange (SMEX) 14.0 Syslog content mapping guide