Proofpoint sending logs with missing information, there anything that I can change or edit?

[daniaabujuma]

Hi all, I have an issue with the logs I am receiving from Proofpoint. The issue is that I am receiving logs with either (from) or (to) field, but they are never associated together. This is due to the fact that every time an email is sent or received, it goes to quarantine in Proofpoint to be scanned, and is then sent to the recipient. This is an issue for me because I can't see the sender and receiver for each email.

I have reached out to Proofpoint but they said there's nothing we can do. I am receiving the logs through syslog, is there anything that I can change or edit to receive the logs with both fields?

[PickleRick]

Proofpoint logs are indeed quite annoying to work with since informations about a single mail can be scatterred across many different events.

But (and your Proofpoint admin should have told you that) there are two fields - sid and qid - which can be used to correlate those events.

So the logs are not missing this piece of info (unless you're not ingesting everything), it's just a matter of searching properly.

[ITWhisperer]

If Proofpoint does not or are unwilling to meet your requirements, find an alternative solution provider?

[PickleRick]

However strongly I might agree with your point of view, typically the log export format is not at the top of criteria list for choosing an email gateway 😉

[daniaabujuma]

Hi @ITWhisperer ,

Unfortunately, that is not an option for me. All I can do is look for a walkaround or a way edit syslog configuration settings to receive logs in the appropriate form, do you have any recommendation?