6.9.1 ORF Online Help
Select your ORF version:

Table of Contents

Event Log View


This section describes the usage and customization of the Event Log View in the ORF Log Viewer.

Usage

Log Viewer toolbar

All basic functions of the ORF Log Viewer can be accessed by clicking various icons of the toolbar in the upper-right corner. These are:

  • Load/Refresh Log files
    Load the log files according to your settings.
  • Open log file
    Open an individual .log file.
  • Search logs
    Quick search in the events currently loaded.
  • Edit or create filter
    Create a filtered view of the events.
  • Send IP or email to list
    Send an IP or email address to the manual list of the Administration Tool (see remote control).

Viewing events

Double click on the event row or hit Enter to display the event in the Log Event Properties dialog. Click the Next and Previous buttons in the dialog to navigate between events or click Copy to Clipboard to copy the event properties to the clipboard.

If you click the Explain button in the Event Properties dialog, the Log Viewer will try to query our online knowledge base and fetch detailed information about the given event.

Selecting and copying data

Copy contents of a single cell to the clipboard by either pressing CTRL-C or right-click the cell and selecting Copy Cell.

To copy the active event, press CTRL-R or right-click on the row and select Copy Selected Events. You can copy multiple events using this option. To select multiple events, hold the SHIFT key down and select the event range to be copied either by the mouse or by the cursor control keys. Non-continuous event ranges can be selected by holding the CTRL key and selecting the event rows by the mouse.

Sending items to the ORF Administration Tool

Right-click the selected event(s) and choose the data that you want to send to the ORF Administration Tool. See the Remote Control section for more information.

Managing and resending quarantined attachments

Right-click a quarantine-type event and select Resend Attachment to resend the quarantined attachment to the intended recipient(s) with a single click, or select Show in Attachment Quarantine to open the Attachment Quarantine Manager and export, delete or resend the quarantined attachment from there.

Customization

Grouping events

Events are grouped by email by default, with the exception of Greylisting events. Right-click a column header and select Expand All or Collapse All to expand or collapse all event groups. Right-click an event, or a selection of events, and select Expand Event Group (+) or Collapse Event Group (-) to expand or collapse the selected event group(s). Event grouping can be enabled or disabled using the FileView menu.

Event grouping is fully supported on Microsoft® Exchange servers, but has a limited support on IIS SMTP servers where only On Arrival events are grouped together.

Changing the column order

Grab the column header and pull it to its new location in the header. Alternatively, you can use the Column Settings dialog to change the order.

Sorting columns

Click the header of the column to sort the Event View by the contents of the selected column. The active sort column is marked with gray background.

The default sort order is descending. Change the sort order by a repeated click on the column header. To control the sort order from menu, right-click the column header and select either Sort Ascending or Sort Descending from the popup menu.

You can also sort columns containing email addresses or domains, by username, organizational domain or top-level domain.

Fit column to contents (Fit and Autofit)

Right-click the column header and select Fit Column to fit the column length to the widest data in the column. Select Autofit This Column to automatically fit the column on log reloads or filtering. Some columns, such as Sender or Recipient(s) are Autofit by default.

Press CTRL - Grey Plus to fit the all columns of the Event View at once. Press CTRL - Grey Minus to minimize the columns to the smallest possible width.

Hiding and restoring columns

Columns can be hidden or restored by using the Column Settings dialog.

The column settings dialog

To display the Column Settings dialog, right-click the header and select Choose Columns... from the popup menu.

Select the column to hide or restore from the list of the available columns and clear or set its checkbox.

Change the column order by selecting the column to move and setting the new position using the Move Up and Move Down buttons.

To reset the column settings to the Log Viewer defaults, click Reset.

Columns

Column name Visible by default Logged by default Explanation
Version - Version of the ORF service that generated the log entry
Log Mode - Verbosity level of the log entry
Server Name of the mail server that received the email
Service - Name of the service that submitted the email for filtering
Time The date the log entry was recorded
Class Class of the event as assigned by ORF
Severity Indicates the significance of the event
Actions The action taken on the email
Filtering Point The filtering point (Before Arrival or On Arrival) where the event was recorded
Message ID - - Unique identifier generated by the sending mail system
HELO/EHLO Domain - - Domain name of the SMTP host connected to the mail server running ORF
Source IP - IP address of the SMTP host that originally sent the email
Remote Peer IP IP addresses of the SMTP host that directly delivered the email to the mail server running ORF
Sender IP IP address of the SMTP host responsible for delivering the email to your organization's (wider) network
Sender Location Geographical location from which the email was sent
Sender The envelope sender (RFC5321.MailFrom) address
Author The author (RFC5322.From) address - displayed by email clients
Recipient(s) Email address of the email's recipient(s)
Email Subject Subject line of the email
Related Test - - Name of the ORF test responsible for the event
Message Further details of the event are displayed here

Preview

Enabling the preview

Press F6 or select Show Preview Panel from the View menu. You can disable the preview the same way.

Selecting the preview column

Click the dropdown icon on the right side of the Preview Panel, next to the "X" (Close) icon and select the column to be viewed from the menu displayed.

Alternatively you can drag the column header in the Event View to the Preview Panel to set the column.

Copyright © Vamsoft Ltd. 2024. All rights reserved. Document ID logv-eventview, version 4.