PostFix Mail Transfer Agent Sample Event Messages

Use these sample event messages to verify a successful integration with JSA.

Note:

Due to formatting issues, paste the message format into a text editor and then remove any carriage return or line feed characters.

PostFix Mail Transfer Agent Sample Messages when you use the Syslog Protocol

Sample 1: The following sample event message shows that an email is sent successfully.

Table 1: JSA Field Names and Highlighted Values in the Event Payload
JSA field name	Highlighted values in the event payload
Event ID	B83C6210AB
Number of Recipients (custom property)	1
Username	`user4@+exampledomain.test`
Originating Host (custom property)	`exampledomain.test`
Originating User (custom property)	`user4@+exampledomain.test`
Recipient Host (custom property)	`host.example.test`
Recipient User (custom property)	`user01@+host.example.test`
Source IP	192.168.0.14
Destination Port	192.168.126.33
Destination Port	25

Sample 2: The following sample event message shows that an email is received.

Table 2: JSA Field Names and Highlighted Values in the Event Payload
JSA field name	Highlighted values in the event payload
Event ID	qmgr
Username	User.Name@domain1.test
Message Size (custom property)	3806
MessageID (custom property)	FFFFFFF

Tip:

Use the IBM QRadar Custom Properties for Postfix to closely monitor your Custom Properties for Postfix deployment. The Postfix custom event properties expand your JSA searches and reports by normalizing specific event data from a log source. If the IBM QRadar Custom Properties for Postfix content pack is not installed on your system, download it from the IBM X-Force Exchange website.