If you want to log all attachment names passing through the Ironport you can create a message filter to do this. From the Knowledgebase:-

Question:
I want to see the filenames of all attachments going through the system. By default, these are not recorded in the logs.

How can I log filenames of attachments?

Answer:
Create a new header that contains the filenames of all attachments.
Use logconfig > logheaders to record the value of that header to the mail_log.


Here is a filter that will record the filenames for messages that have attachments:

add_filenames_header:

if (attachment-filename == "^.+$") {
insert-header ("X-fn", "$filenames");
}

The "^.+$" regex assures that there is an attachment with at least 1 character in the filename. This will be false for messages with no attachments, so only attachments will be logged.

Note that the definition of "Attachment" to an email message is debatable. Typically, the first text/plain and text/html parts are considered the "body". See the user's guide for more detail on what is considered an attachment.