Trellix DLP Network sends protocol and hardware logging information to the local syslog, and one or more remote logging servers if you have them enabled. Examples of information sent to the syslog are certificate installation status and ICAP events.
Note
Use settings in the General category of the Common Appliance policy to set up remote logging servers. Use the TCP protocol to send Trellix DLP Network events data to a remote logging server. UDP has a limit of 1024 bytes per packet so events that exceed that amount are truncated.
Trellix DLP Network sends information to the syslog in the Common Event Format (CEF). CEF is an open log management standard that improves the interoperability of security-related information from different security and network devices and applications. To simplify integration, syslog is used as a transport mechanism. This applies a common prefix to each message that contains the date and host name.
Syslog entries contain information about the device itself (the vendor, product name, and version), the severity of the event, and the date the event occurred.
Note
SMTP message events can include the sender and recipient, the subject, the source, and the destination IP addresses. Every attempt to send a message results in at least one entry in the log. If the message contains content that violates a data loss prevention policy, another entry is added to the log. When two entries are added to the log, both entries contain the corresponding TrellixDLPOriginalMessageID number.
For information about the description of fields that appear in syslog entries and event IDs, see KB93612.