Classes of audit events in the Backup group

The Backup group represents the following event classes: LMS_AUDIT_BACKUP_MESSAGE_SEND, LMS_AUDIT_BACKUP_MESSAGE_DOWNLOAD, LMS_AUDIT_BACKUP_MESSAGE_DELETE.

The keys listed in the following table are used in the bodies of CEF messages of audit event classes in the Backup group.

Possible values of fields for classes of Backup group audit events

Key	Value
cs1Label	The value is always `ApplicationMessageId`.
cs1	The App ID of the message involved in the event.
cs2Label	The value is always `SmtpMessageId`. The key and value are logged in the audit message if the SMTP Message-ID of the message can be determined.
cs2	SMTP Message-ID of the message involved in the event. Logged if the SMTP Message-ID of the message can be determined.
dvc	IPv4 address of the KSMG node in whose Backup the event occurred.
c6a4Label	The value is always `BackupNodeIPv6 Address`. Logged if the address of the KSMG node in whose Backup the event occurred is in IPv6 format.
c6a4	IPv6 address of the KSMG node in whose Backup the event occurred.
cn4Label	The value is always `BackupNodePort`.
cn4	Port of the node in whose Backup the event occurred.

Page top