Session ID

The session_id field is in many FortiMail log messages where:

• type=encrypt
• type=event

• type=statistics

• type=spam

• type=virus

The session_id field indicates which SMTP session tried to receive or deliver email (for example, session_id="585DOodQ002505-585DOodR002505"), and can be used to correlate an SMTP session across multiple types of log messages to get details about why an email delivery was accepted, temporarily failed, or rejected.

This field is empty for webmail logins and daemon events that do not correspond to sending or receiving email, such as:

• daemon startup

• daemon shutdown

• reload of packages from FortiGuard, such as heuristic rules

• generating DMARC reports

• generating quarantine reports