Subsecond timestamps for Cisco ESA Ironport textmail logs

[RahimAbdulla]

The Ironport text logs on the Cisco Email Security Appliance have timestamps that go down to the second, but not the millisecond - like this:

Tue Aug 20 16:57:21 2019

This can make things very confusing when you send the logs to a SIEM: each event can have multiple associated log entries with the exact same timestamp, which can cause the order to get mixed up in the SIEM.

Is there any way to include ms in the log events?

[Ken Stieers]

As far as I can tell, no.

But, 13.0, currently in Beta will have single log line output for each email, so a seim will see all of the results of what happened to an email without having to untangle the mail logs.



Ken

[ppreenja]

Hello RahimAbdulla,

To best of my understanding, unfortunately, the timestamp of the "mail_logs" is not configurable.
If you need a different timestamp for these files you would need to perform some off box scripting or macros to alter them.

Cheers,
Pratham