Update

The update field is in FortiMail log messages where type=statistics and subtype=update.

The field indicates the type of update to the previous history log. This can be used to correlate search results about the same session_id on FortiAnalyzer, where information in other fields may have changed during processing.

For example, update="notification" occurs when delivery_status has changed, and notif_delay may also have changed. Similarly, update="original_host" or update="alternate_host" indicates if the email is now being delivered to a different email server.