This article applies to:
- Trustwave SEG 7.2 and above
- Logging of TextCensor results in Engine text log
Question:
- Can I log details of what TextCensor expressions triggered?
Procedure:
SEG/MailMarshal 7.2 includes an updated version of the TextCensor functionality.
With this version of TextCensor, you can choose to log fewer or more details by adding a Registry value.
In version 7.2.2 and above, by default the log includes triggered expressions (up to 2048 characters total).
In version 7.2.0 and 7.2.1, by default, the only information logged is the name of the script and the email part that caused triggering. With these versions, the only additional information available is the expression names and not the actual expression.
Example triggered expression logging
The following example shows additional logging of triggered expressions (the two lines beginning "Expression").
3448 15:10:57.111 TextCensor triggered: Script "Language - Foodie" Triggered in Body
Expression "( fed OR feeds ) AND NOT fed-up" triggered 1 time, score 1
Expression "( eat OR eating ) FOLLOWEDBY = 1 ( pie OR ham OR cake )" triggered 1 time, score 5
3448 15:10:57.111 Name=U1\B5100982f0000.000000000001.0001.mml Message level criterion TRUE
To create or edit the Registry setting:
- On the Array Manager, edit the Registry (10.X: use Advanced Settings in the Management Console)
- Navigate to the SEG Engine key:
- In version 8.X: HKEY_LOCAL_MACHINE\SOFTWARE\Trustwave\Secure Email Gateway\Default\Engine
- 10.X: value names have the prefix Engine. (Engine dot).
- For full details of the location for each product version, see article Q10832.
-
Add (or edit) the DWORD value LogTCTriggerCriteria
-
To enable the additional logging, set the value to 1
-
To disable the additional logging, set the value to 0
-
To revert to the default value for the installed version, delete the DWORD value
- Commit configuration changes.
- Restart the Engine service.
Warning: As always, take due care when editing the Registry. Make a backup before making changes.