Values of fields in the body of CEF messages for classes of Appliance group events

In the body of CEF messages for classes of Appliance group events, you can use keys in accordance with their semantics (see the table below).

Allowed field values for classes of Appliance group events

Key	Value
cs1	Queue name.
cs1Label	Its value is always `Queue`.
cs2	Status of the incoming message queue.
cs2Label	Its value is always `Incoming`.
cs3	Status of the outgoing message queue.
cs3Label	Its value is always `Outgoing`.
cs4	User name.
cs4Label	Its value is always `User`.
cs5	List of modified values.
cs5Label	Its value is always `ChangedValues`.
cn1	Message ID.
cn1Label	Its value is always `QueueMessageld`.
cn2	Size of the queue.
cn2Label	Its value is always `QueueSize`.
rt	Time when the message was received
suser	Mail sender.
duser	List of message recipients.
outcome	Result of the action.
reason	Description of the error.
fname	Name of the new file.
oldFileName	Name of the old file.

Each class of Appliance group events can contain only keys that are relevant to it (see the table below).

Relevant keys for classes of Appliance group events

Event class	Relevant keys
LMS_EV_MTA_MESSAGE_FLUSH	cn1, cn1Label, cs1, cs1Label, cn2, cn2Label, rt, suser, duser, outcome, reason
LMS_EV_MTA_MESSAGE_DELETE	cn1, cn1Label, cs1, cs1Label, cn2, cn2Label, rt, suser, duser, outcome, reason
LMS_EV_MTA_ALL_MESSAGES_FLUSH	outcome, reason
LMS_EV_MTA_ALL_MESSAGES_DELETE	outcome, reason, cs1, cs1Label
LMS_EV_MTA_STATUS_CHANGE	cs5, cs5Label, cs2, cs2Label, cs3, cs3Label, outcome, reason
LMS_EV_TLS_CERT_CHANGED	cs4, cs4Label, oldFileName, fname