Skip to main content
Skip table of contents

Flat File - PureMessage For UNIX Message Log

Sophos PureMessage for UNIX Message is a spam and antivirus filter for mail systems operating on a UNIX platform.


The Agent flat file collection mechanism uses state tracking to reference the directory and retain the last log read from the file. You will need the following information to configuring collection of the logs from PureMessage for UNIX Message:

  • The full path to the directory containing the flat files.
  • The LogRhythm System Monitor Agent that will collect the audit logs from the flat file.

Configure Sophos PureMessage for UNIX Message

Note the location of the message_log file, which is usually located in /opt/pmx/var/log/.

After you configure the device, you must also configure LogRhythm according to the instructions provided on the overview page of this guide. The file being collected must be viewable on the host with the Agent using a standard file name path such as: /var/log/logfile.txt or C:\logs\logfile.txt.

Only Global Admins or Restricted Admins with elevated View and Manage privileges can take this action.

The name of the log message source is Flat File - PureMessage For UNIX Message Log. In addition, when configuring this log source:

  • For Log Message Processing Mode, select MPE Processing Enabled, Event Forwarding Enabled.
  • For Log Message Processing Engine (MPE) Policy, select LogRhythm Default.
  • On the Flat File Settings tab, enter the following:
    • File Path. <path to log file, including the file name and extension>
      This is usually /opt/pmx/var/message_log
    • Date Parsing Format. Select existing PureMessage For UNIX Message Log (<yy><M><d>T<h>:<m>:<s>)
    • Log Message Start Regex. ^
JavaScript errors detected

Please note, these errors can depend on your browser setup.

If this problem persists, please contact our support.