Values of fields in the body of CEF messages for classes of Backup group events

In the body of CEF messages for classes of Backup group events, you can use keys in accordance with their semantics (see the table below).

Permissible values of fields for classes of Backup group events

Key	Value
cn1	Message size.
cn1Label	Its value is always `MessageSize`.
cn2	Maximum size of Backup.
cn2Label	Its value is always `MaxBackupSize`.
cn3	Number of messages in Backup.
cn3Label	Its value is always `MessageCount`.
cs1	ID of the message in Backup.
cs1Label	Its value is always `MessageId`.
cnt	Number of errors during the past 10 minutes.
act	Action to perform on the message in Backup (deliver / delete).
suser	User who performed the action on the message in Backup.
cs2	Anti-Virus scan status.
cs2Label	Its value is always `AvStatus`.
cs3	Status of Anti-Spam protection.
cs3Label	Its value is always `AsStatus`.
cs4	Status of Anti-Phishing protection.
cs4Label	Its value is always `ApStatus`.
cs5	Name of the malicious object.
cs5Label	Its value is always `Threat`.
cs6	Status of content filtering.
cs6Label	Its value is always `CfStatus`.
duser	List of message recipients.
reason	Description of the error.
outcome	Result of Backup Digest event: `no messages`, `success` or `failed`.

Each class of Backup group events can contain only keys that are relevant to it (see the table below).

Relevant keys for classes of Backup group events

Event class	Relevant keys
LMS_EV_BACKUP_ADD_ERROR	cs1, cs1Label, cnt
LMS_EV_BACKUP_ROTATE_ERROR	reason, cnt
LMS_EV_BACKUP_ALMOST_FULL	cn1, cn1Label, cn2, cn2Label, cn3Label
LMS_EV_BACKUP_MESSAGE_RESTORE	cs1, cs1Label, act, suser, cs2, cs2Label, cs3Label, cs4, cs4Label, cs5, cs5Label, cs6, cs6Label, duser