Important logs in IceWarp

The following log settings are recommended for both On-premise and Cloud instances.

SMTP: Extended – Logs all information about emails, including senders and recipients. Note that larger systems will require significantly more disk space.
Web: Extended – Logs certificate creation, server performance stability, and PHP worker activity.
Antivirus: Debug or higher – Logs whether emails are checked by the antivirus, whether antivirus updates occur, and the results (e.g., if an email is marked as spam).
Anti-Spam: Extended – Logs update status, reasons why emails are marked as spam, spam scores, and whether emails bypass filters.
Other logs – Enable only for individual debugging as needed.

Delete log files older than (days): Defines the retention period before logs are deleted. A longer retention period requires more disk space and depends on system size. For Cloud systems, the default is 9 days (maximum allowed: 14 days).
System maintenance log: Extended – Records all system changes and identifies the administrator who made them.
Authentication log: Extended – Logs successful and failed login attempts, including the originating IP address. Useful for breach monitoring.

System performance: Logs actions exceeding a set time threshold (in seconds). Adjust settings based on your system and HDD performance.
Mail flow: Optional/Recommended – Provides detailed logging of Antispam checks. May require additional disk space.
SQL logs: Logs only failed SQL actions.
AD sync logs: Enable only if your system uses Active Directory.
Kerberos logs: Enable only if your system uses Kerberos.
Other debug logs: Optional, based on troubleshooting needs.

Logs can also be archived to an external Syslog server.

Steps: