Technical Tip: How to enable email and spam filter logs

[cfirpo_FTNT]

Description

This article describes how to enable email and spam filter logs. It may indeed be useful to enable these logs in case a troubleshooting is needed.

All of these logs are disabled by default for the services listed below as it can cause unnecessary processing on the unit and should only be enabled if it is a requirement and/or for troubleshooting purposes:

• IMAP
• POP3
• SMTP
• MAPI
• MSN, Yahoo, Gmail

Scope

FortiGate.

Solution

In this example,e IMAP logging will be enabled with the default profile.

For versions 6.2 below:

config spamfilter profile
    edit default
    config imap
        set log enable
end

For v6.2 and above:

config emailfilter profile
    edit default
    set spam-log enable
    config imap
       set log-all enable
    end

Repeat the operation for all additional services or different filter profiles, as illustrated below:

For versions below v6.2:

config spamfilter profile
    edit default
        show full-configuration

config spamfilter profile
    edit "default"
        set comment "Malware and phishing URL filtering"
        set flow-based disable
        set replacemsg-group ''
        set spam-log enable
        set spam-filtering disable
        set external disable
        unset options
        config imap
            set log enable
        end
        config pop3
            set log disable/enable
        end
        config smtp
            set log disable/enable
        end
        config mapi
            set log disable/enable
        end
        config msn-hotmail
            set log disable/enable
        end
        config yahoo-mail
            set log disable/enable
        end
        config gmail
            set log disable/enable
        end
        set spam-bword-threshold 10
        unset spam-bword-table
        unset spam-bwl-table
        unset spam-mheader-table
        unset spam-rbl-table
        unset spam-iptrust-table
        set spam-log-fortiguard-responsed disable
    next
end

For versions 6.2 and above:

config emailfilter profile
    edit default
        show full-configuration

config emailfilter profile
    edit default
        set comment "Malware and phishing URL filtering."
        set feature-set flow
        set replacemsg-group ''
        set spam-log enable
        set spam-filtering disable
        unset options
        config imap
            set log-all enable
        end
        config pop3
            set log-all disable/enable
        end
        config smtp
            set log-all disable/enable
        end
        config msn-hotmail
            set log-all disable/enable
        end
        config gmail
           set log-all disable/enable
        end
        set spam-bword-threshold 10
        unset spam-bword-table
        unset spam-bal-table
        unset spam-mheader-table
        unset spam-iptrust-table
    next
end