date - See format below
time - See format below (24 hour time format)
c-ip - Client IP address
cs-username - MAIL FROM: no '<' or '>'
s-ip - Server Receiving IP address
s-port - Server Receiving Port
cs-uri-stem - User[/Alias]/Status
sc-status - 550 (rejected), 404 (spam), 200 (good)
sc-bytes - Number of bytes received (size of e-mail message before analyzing)
time-taken - Time in seconds from start of connection to the end-of-relay disconnect
cs(Referrer) - The information sent during HELO
x-score - The score that the e-mail received
SAMPLE:
#Software: Spam Sleuth Enterprise
#Version: 1.0
#Date: 2003-06-03 14:29:28
#Fields: date time c-ip cs-username s-ip s-port cs-uri-stem sc-status sc-bytes time-taken cs(Referrer) x-score
2003-06-03 14:29:28 207.86.139.145 bob@outside.com 10.7.4.219 25 jim@inside.com/sales@inside.com/good 200 10832 1.023 IMS+Server+[10.1.1.145] 189