Limiting Text Log entries with Regular Expressions

This article applies to:

• Trustwave MailMarshal (SEG) 6.4 and above
• Trustwave ECM/MailMarshal Exchange 7.X

Question:

• How can I stop certain information from being logged to the MailMarshal text logs? 

Procedure:

Current versions of MailMarshal allow you to limit what is logged to text logs using Regular Expression matching.

This facility is available for the Receiver, Engine, Sender, Controller, and Array Manager services.

To enable this filtering, for versions 8.2 and below, add a Registry entry LogFilter for each service, and enter a Regular Expression that defines the entries you do not want to see in the logs.

For MailMarshal (SEG) 10 and above:

• Add the values for Receiver, Engine, and Sender in the Advanced Settings section of the Management Console
• Add the value for Array Manager in the arraymanager.config.json file
• Add the value for Controller in the controller.config.json file on each node

Remember to back up the json files before editing.

Note: For details of the registry/Advanced setting locations for each MailMarshal version, see the following Knowledge Base articles:

• Q10832 (MailMarshal SMTP)
• Q14003 (MailMarshal Exchange)

1. On the Array Manager, edit the Registry (10.X: use Advanced Settings in the Management Console)
2. Navigate to the SEG Engine key:
   • In version 8.X: HKEY_LOCAL_MACHINE\SOFTWARE\Trustwave\Secure Email Gateway\Default\Engine
   • 10.X: value names have the prefix Engine. (Engine dot).
   • For full details of the location for each product version, see article Q10832.
3. Create a Reg_SZ (string) value LogFilter
4. Set the value to : 0 user\(s\) match rule| Name=U.*False

Note: The example value entry includes  \ (backslash) characters. These are used to allow the Regular Expression to match the literal parentheses.

Notes:

• This is an advanced feature. Only administrators familiar with MailMarshal logs, and who regularly review the logs, should set filters.
• In version 7.3 and above, logging of redundant "not triggered" lines is greatly reduced and filtering is usually unnecessary.
• When requesting help from Trustwave Technical Support, you will usually be requested to disable any log filtering.
• To apply the Registry changes, you must

1. Commit configuration changes
2. Restart the affected service(s) on each server.

Warning: Using the Registry Editor incorrectly can cause serious problems that may require you to reinstall your operating system. Trustwave cannot guarantee that problems resulting from the incorrect use of Registry Editor can be solved. Make sure that you back up your Registry prior to making any changes.