Log message severity levels

Each log message contains a field that indicates the severity level of the log message, such as pri=warning.

Table 63:Log severity levels

For each location where the FortiMail unit can store log files, you can define the severity threshold of the log messages to be stored there.

Avoid recording log messages using low severity thresholds such as Information or Notification to the local hard disk for an extended period of time. A low log severity threshold is one possible cause of frequent logging. Excessive logging frequency can cause undue wear on the hard disk and may cause premature failure.

The FortiMail unit stores all log messages equal to or exceeding the severity level you select. For example, if you select Error, the FortiMail unit stores log messages whose severity level is Error, Critical, Alert, or Emergency.

Classifiers and dispositions in history logs

Each history log contains one field called Classifier and another called Disposition.

The Classifier field displays which FortiMail scanner applies to the email message. For example, “Banned Word” means the email messages was detected by the FortiMail banned word scanner. The Disposition field specifies the action taken by the FortiMail unit.

If you view the log messages on the FortiMail web UI or send the logs to a Syslog server, the dispositions and classifiers are displayed in English terms. However, if you download log files from FortiMail web UI to your PC and open them, the dispositions and classifiers are displayed in hex numbers.

The following tables map the hex numbers with English terms.

Table 64:Classifiers

Table 65:Dispositions