The VPOP3 SMTP IDS logging facility logs SMTP events in a form which may be useful to Intrusion Protection Systems, or security monitoring software.
One of the fields in the log file is the Log Event Number
These are:
0 = SMTP authentication failure
1 = Relay denied
2 = Relay allowed (not bad in itself, but a large number may indicate an open relay or spambot, etc)
3 = Bad local recipient
4 = Good local recipient (not bad in itself, but a large number may indicate a spammer)
5 = Message detected as spam
6 = Message detected as containing a virus
7 = SMTP Rule matched
8 = Realtime
DNS Blacklist match
9 = SMTP Syntax error (commonly spam software is badly written, so these can happen if error handling is poor in the sending software)
10 = Message is bigger than the maximum size limit specified in VPOP3
11 = Message contained a filtered attachment
12 = Message contained a partial attachment (these are often an indication of something trying to bypass virus scanners)
900 = IP address blocked