Adding IceWarp Messaging Server via Syslog

Updated October 17, 2026 17:51

Purpose

This guide explains how to forward IceWarp Messaging Server logs to Logsign USO over syslog. The integration parses the SMTP session lines that IceWarp writes (client and server dialog, reply codes, sender and recipient), and on IceWarp 13 and later it also classifies anti-spam decisions, whitelist and blacklist changes, intrusion prevention blocks, service errors, failed SQL queries, administration console logins and maintenance reports.

Prerequisites

Administrator access to the IceWarp administration console.
Network connectivity from the IceWarp server to the Logsign USO collector on your syslog port (TCP or UDP 514 by default).
A Logsign USO release that includes the IceWarp Messaging Server parser. The IceWarp 13+ event classes described below need a recent release. Contact Logsign Support if you are not sure which release you run.
Logging enabled for the IceWarp services you want to see in Logsign USO (at least SMTP and Anti-Spam).

Step 1: Send IceWarp Logs to Syslog

IceWarp can send its service logs to a remote syslog server. The menu names and the exact location of the syslog setting differ between IceWarp releases, so check the logging section of the IceWarp documentation for your release.

Log in to the IceWarp administration console.
Open the logging settings and turn on logging for the services you need (SMTP, Anti-Spam, Control, GroupWare, POP3/IMAP).
Enter the IP address of the Logsign USO collector as the syslog server and set the port (514 by default).
Save the settings.

Logsign USO expects the lines exactly as IceWarp writes them, with the BSD syslog header (Mmm dd hh:mm:ss service[thread]:) in front. If a relay sits between IceWarp and Logsign USO, make sure it does not rewrite the message text.

Step 2: Add the Data Source in Logsign USO

Open the Logsign USO web interface and click + Device under Settings > Data Collection. Choose Syslog as the collection method, select IceWarp as the vendor and Messaging Server as the product, and enter the IP address of the IceWarp server as the host. Click Save. Once the server starts sending, events appear under Search.

Supported Message Formats

The parser accepts the classic SMTP session lines and the IceWarp 13+ format, which repeats the source tag and adds the thread ID and time after the syslog header. Some examples (addresses and public IPs are anonymized):

Oct 14 14:47:37 smtp.s[7F84D1FF7640]: 203.30.161.171 203.30.161.172 [00007F84D1FF7640] 14:47:37 Client session *** <sender@example.com> <rcpt@example.org> 2 4974036 00:00:18 OK 202610141446596132
Oct 14 14:44:24 smtp.antispam[7F84EBBFE640]: 127.0.0.1 127.0.0.1 [00007F84EBBFE640] 14:44:24 202610141444066120 '<sender@example.com>' '<rcpt@example.org>' 1 score 5.20 reason [SpamAssassin=-1.80] action SPAM
Oct 14 14:44:25 smtp.antispam[7F84C5BF6640]: SYSTEM SYSTEM [00007F84C5BF6640] 14:44:25 Whitelist: recipient 'partner@example.org' owner 'user@example.com' whitelisted
Oct 14 14:46:24 smtp.s[7F84EBBFE640]: SYSTEM SYSTEM [00007F84EBBFE640] 14:46:24 Intrusion Prevention - closing all connections from 203.30.161.171
Oct 14 08:18:22 control.maintenance[7FC82BFFF640]: Console Console [00007FC82BFFF640] 08:18:22 Logged on successfully: user@example.com 203.30.161.171

Notes and Limits

Older parser releases wrote the sender into Mail.TO and the recipient into Mail.FROM for Client session *** lines. Current releases write the sender into Mail.FROM. Events that were stored before the update keep the old order.
Intrusion prevention events used to appear as Application / Mail / Fail (reply code 421) or Application / Mail / Info. They now appear as Security / Intrusion Prevention / Block. If you have alert rules, searches or reports that look for these events under Mail Fail, update them.
Mail.MessageID holds the IceWarp thread ID, not the message ID of the e-mail. The anti-spam message ID is in Mail.QueueID.
The BSD syslog timestamp has no year and no time zone. Set the IceWarp server clock to the same time zone as Logsign USO so that Time.Generated is correct.

Verification

In Logsign USO, open Settings > Data Collection and confirm that the IceWarp Messaging Server source is receiving data.
Send a test e-mail through IceWarp. In Logsign USO, go to Search and look for events with Vendor IceWarp and Product Messaging Server. Check that Mail.FROM holds the sender and Mail.TO holds the recipient.
If anti-spam is active, look for events with Service.Name smtp.antispam. They should carry Threat.Score and Block.Reason.
If the source is receiving data but no events show Vendor IceWarp, check that the messages are not changed by a relay and that the syslog header is present.