HI, According to the microsoft technet site the last field in the agent logs is the "ReasonData" field. But most of the logs that I saw on the net have one extra field in the logs called "diagnostics". What is this field about and how come its not mentioned in the technet site? is it a configurable field? For eg: imestamp : 2008/01/14 04:03:08 PMSessionId : 08CA24B3C3080729IPAddress :MessageId : <20080114140335.B115F6452A@10.240.80.202>P1FromAddress : senderaddress@domain.comP2FromAddresses : {senderaddress@domain.com}Recipients : {recipientaddress@domain.com}Agent : Content Filter AgentEvent : OnEndOfDataAction : RejectMessageSmtpResponse : 550 5.7.1 Message rejected as spam by Content Filtering.Reason : SclAtOrAboveRejectThresholdReasonData : 7Diagnostics : DV:3.3.5705.600 But in the technet site whos link is given below there is no mention of this field: http://technet.microsoft.com/en-us/library/bb124795(EXCHG.80).aspx Thanks, Yuvika

Hi, Base on my research, I found DV:3.3.5705.600 from X-MS-Exchange-Organization-Antispam-Report(Anti-Spam report). I think Diagnostic is the same as X-MS-Exchange-Organization-Antispam-Report. We can explain DV as The DAT version (DV) stamp indicates the version of the spam definition file that was used when scanning the message. Related information share with you: Anti-Spam Stamps http://technet.microsoft.com/en-us/library/aa996878(EXCHG.80).aspx How to View Anti-Spam Stamps in Outlook 2007 http://technet.microsoft.com/en-us/library/bb124595(EXCHG.80).aspx Hope it helps. Xiu

Hi Xiu, Thanks a lot for that input. But I have a slightly diffenrent query. Actualy wat I wanted to know is why is this info being shown in the agent logs? Since in the technet site the "reasonData" field is the last field that is supposed to be in these logs. Also, the logs that I found on the net, few have this "diagnostics" field and few dont. I am rely confused because of this. It wud be gr8 if you could shed some light on that. Thanks, Yuvika