Enable Logging via Email

Prerequisites

Complete Before You Begin

Follow these steps:

Open the logback-audit.xml as created in Before You Begin.

Add the following appender and logger. Depending on the host that will do the logging, the appender looks a bit different. You can identify the host (MTA vs XCC) that will do the logging based on the event that you want to log, as described in Before You Begin.

/activeguard/core/logback-audit.xml

<?xml version="1.0" encoding="UTF-8"?>
<included>
    <!-- Set to your xorlab domain -->
    <property name="host.name" value="xyz.activeguard.cloud"/>

    <appender name="smtpMailAppender" class="ch.qos.logback.classic.net.SMTPAppender">
        <from>no-reply@${host.name}</from>
        <to>example@xorlab.com</to>
        <subject>Email reported via ${host.name}</subject>

        <layout class="ch.qos.logback.classic.PatternLayout">
            <pattern>An email was reported\nDate: %d{yyyy-MM-dd HH:mm}\nLink https://${host.name}/messages/all/message/%X{gr.id} \n%jsonMsg\n</pattern>
        </layout>

        <smtpHost>mta.activeguard.xor</smtpHost>
        <smtpPort>10026</smtpPort>
        <evaluator class="com.xorlab.sgappliance.shared.logback.evaluator.LevelEvaluator"/>
    </appender>

    <!-- Change the name to the desired Event -->
    <logger name="trace.msg_analysis.complete.reported">
        <appender-ref ref="smtpMailAppender"/>
    </logger>

</included>

TLS LimitationThis configuration requires that smtpd_tls_req_ccert = no is set inside /activeguard/mta/startup_cfg/postfix_custom/main.cf.

/xcc/backend/logback-audit.xml

<?xml version="1.0" encoding="UTF-8"?>
<included>
    <!-- TODO Set to your xorlab domain -->
    <property name="host.name" value="xyz.activeguard.cloud"/>

    <appender name="smtpMailAppender" class="ch.qos.logback.classic.net.SMTPAppender">
        <from>no-reply@${host.name}</from>
        <to>example@xorlab.com</to>
        <subject>Email Release Request ${host.name}</subject>

        <layout class="ch.qos.logback.classic.PatternLayout">
        <!-- feel free to change the email content here --> 
        <pattern>An email was requested for release\nDate: %d{yyyy-MM-dd HH:mm}\nLink: https://${host.name}/messages/all/message/%logArg{ggrid} \n\n</pattern>
        </layout>

        <!-- TODO Set to you the MX records that resolves to the xorlab MTAs -->
        <smtpHost>mx.xyz.activeguard.cloud</smtpHost>
        <smtpPort>25</smtpPort>
        <STARTTLS>true</STARTTLS>
        <evaluator class="com.xorlab.sgappliance.shared.logback.evaluator.LevelEvaluator"/>
    </appender>

    <!-- Change the name to the desired Event -->
    <logger name="audit.quarantine.release.request.created">
        <appender-ref ref="smtpMailAppender"/>
    </logger>

</included>

Set host.name to the domain of your xorlab.
Adjust to, subject and pattern to match the desired email content and destination.
Adjust the logger name to match the event that you want to log.
Click Publish. The logging configuration becomes active within about one minute.