Thanks for your prompt response.
I agree, but we can add IronPort as custom device and write custom log parsers for that. I am confused which logs do we need to capture and write parsers as IronPort does not provide message log in one line I mean it break in pieces and maintain MID for each line.
Secondly, I have setup custom device, I received messages but I got "Buffer overflow" error message in IronPort and stop sending logs to CS-MARS.
Can you please advice so as to what could be the cause for this.
I really appreciate if you could advice some interesting things which we can log into CS-MARS from IronPort. Thanks.