This section controls scan and activity logging including X- header generation. Since most of the activity of the SNFMulti engine is performing message scans, we decided to include other activities such as SYNC operations and rulebase reloads in the same log file.

In general, the data that is logged can be sent to a file and/or made available via the API (or XCI interface). This way applications that integrate the SNFMulti engine can absorb the log and/or X-header data without incurring additional I/O operations. For example, a message scanning system that uses multiple tests might combine the X- header data from multiple tests and then rewrite the message only once. Similarly that application might capture the message scan log data from the API, modify it, and include the information in a single log entry of its own that covers the activity of all of the tests performed on a particular message.

There are a number of sub-sections to the <scan/> element that control these features:

• <identifier/> - Message Identification Options
• <classic/> - Classic (SNF2 style) Log Options
• <xml/> - XML (SNF3+ style) Log Options
• <xheaders/> - X Header Generation & Injection Options

Please email support@armresearch.com with any questions.