antispam-log-status {enable | disable}

Enable to log all antispam events.

antivirus-log-status {enable | disable}

Enable to log all antivirus events.

encryption-log-status {enable | disable}

Enable to log all IBE events.

event-log-category {imap | pop3 | smtp | webmail}]

Enter all of the mail log types and subtypes that you want to record to this storage location. Separate each type with a space.

• imap: Log all IMAP events.
• pop3: Log all POP3 events.
• smtp: Log all SMTP relay or proxy events.
• webmail: Log all FortiMail webmail events.

event-log-status {enable | disable}

Enable or disable event logging to FortiAnalyzer Cloud.

history-log-status {enable | disable}

Enable to log both successful and unsuccessful attempts by the built-in MTA or proxies to deliver email.

loglevel {alert | critical | debug | emergency | error | information | notification | warning}

Enter one of the following severity levels:

• emergency
• alert
• critical
• error
• warning
• notification
• information
• debug

This log destination will receive log messages greater than or equal to this severity level. However, the relevant information level logs are always sent for any other log level selection. For details, see the FortiMail Administration Guide.

reliable {enable | disable}

Reliable logging to FortiAnalyzer prevents lost logs when the connection between FortiMail and FortiAnalyzer is disrupted. When reliable mode is enabled:

• Logs are cached in a FortiMail memory queue.

• FortiMail sends logs to FortiAnalyzer, and FortiAnalyzer uses seq_no to track received logs.

• After FortiMail sends logs to FortiAnalyzer, logs are moved to a confirm queue in FortiMail.

• FortiMail periodically queries FortiAnalyzer for the latest seq_no of the last log received, and clears logs from the confirm queue up to the seq_no.

• If the connection between FortiMail and FortiAnalyzer is disrupted, FortiMail resends the logs in the confirm queue to FortiAnalyzer when the connection is reestablished.

status {enable | disable}

Enable to send log types which are enabled to FortiAnalyzer Cloud.

syseventlog-category {admin | configuration | configuration-user | dns | ha | system | update}]

Enter all of the system event log types and subtypes that you want to record to this storage location. Separate each type with a space.

• admin: Administrative events such as logins, viewing log messages, and resetting the configuration.
• configuration: Configuration changes by an administrator, such as policies, profiles, and domains.
• configuration-user: Configuration changes by a quarantine or webmail user, such as personal safe/block lists.
• dns: DNS queries.
• ha: High availability (HA) activity.
• system: System events, such as rebooting the FortiMail unit or IP address configuration via DHCP. Note: This category does not include events from mail daemons, which are configured in event-log-category [{imap pop3 smtp webmail}].
• update: Both successful and unsuccessful attempts to download firmware and FortiGuard updates.