Outgoing destinations and outgoing servers reports empty

ardi_80_ironport · ‎09-18-2009

Hi,

We are using C150 series cluster.
We have defined only one listener for both outgoing and incoming mails.
When accessing reports under Monitor/Outgoing destinations or outgoing servers, the reports show no data found.
The counter under reportingconfig is unlimited.
The incoming mail reports work fine. The problem is with outgoing mail.
Is some configuration wrong with log subscription, or with the cluster?
Which type of logs are being read for outgoing reports?

pvdberg00 · ‎09-18-2009

We have the same issue on our C650's when we do domain based reporting. Incoming is filled with data, outgoing reported no data found.
Hope somebody can tell how to change that.

Peter.

shannon.hagan · ‎09-18-2009

For the purposes of reporting:
Incoming is any mail that matches an Accept policy.
Outgoing is any mail that matches a Relay policy.

Based on the definitions above, what you are considering outgoing mail may be in the Incoming report if it matches an accept policy.

pvdberg00 · ‎09-21-2009

In the domain based reporting as specified our internal domain. Incoming there are figures reported, outgoing there is only reported "No data found".

Machine name - 09 Aug 2009 01:00 (GMT +0200)
Copyright © 2009 IronPort Systems, Inc. All rights reserved. 1
SECURITY MANAGEMENT APPLIANCE
Domain-Based Executive Summary xxx.xxx.xx machine name
02 Aug 2009 00:00 to 08 Aug 2009 23:59 (GMT +0200) Data in time range: 100.0 % complete
Incoming Mail Graph Incoming Mail Summary
Message Category % Messages
Stopped by Reputation Filtering 87.3% 3.3M
Stopped as Invalid Recipients 0.0% 3
Spam Detected 2.1% 78.7k
Virus Detected 0.0% 15
Stopped by Content Filter 0.9% 32.9k
Total Threat Messages: 90.3% 3.4M
Clean Messages 9.7% 365.1k
Total Attempted Messages: 3.8M
Outgoing Mail Graph
No Data found
Outgoing Mail Summary
No Data found
Report Generated for Domain(s): xxx.xxx.xx

Peter

ardi_80_ironport · ‎09-22-2009

For the purposes of reporting:
Incoming is any mail that matches an Accept policy.
Outgoing is any mail that matches a Relay policy.

Based on the definitions above, what you are considering outgoing mail may be in the Incoming report if it matches an accept policy.

The incoming mails match Accept policy.
The outgoing mails mtch Relay policy.
So the problem seems not the matches.
Has anyone face the problem before?

Galileo_ironport · ‎12-11-2009

Same issue here with 2 x C360 and M660 on version 6.5.3-007 on all appliances. The outgoing domain-based summary is empty but the incoming works fine.

Any help is appreciated.

Thanks.

mychrislo_ironport · ‎12-12-2009

Sounds like using 1 listener for incoming/outgoing issue?

cos I cannot verify it. My outoging ironport configured _only_ private listener is fine with the report.

Galileo_ironport · ‎12-14-2009

I have 1 outbound (internal facing) and one internet listener, so it definitely isn't that. What shows up on the outgoing report for domain is only the internal domain of the Exchange server (not even the email domain).

Any suggestions?

Jussi Torhonen · ‎12-31-2009

Noticed same here with our 2xC160 + 1xM160 environment. Have changed mail

with Ironport support and the bug has been identified there.

If rDNS is working for the sending mailbox server, then add the FQDN name of the mailbox server to Domain based report settings Report Generation -> Generate report by specifying individual domains -> Domain(s). Something like

ouremaildomain.com, mboxsrv01.ouremaildomain.com

Got the tip from Ironport support.

After that you will see some counters for Outgoing mail traffic in the DOmain based reports. But be warned, the numbers may not be correct. We found that in all of the Domain based reports we can see the exactly same counters for the Outgoing mail traffic. Have informed Ironport support abt this problem too.

Hopefully they will fix these very annoying problems very soon.

pvdberg00 · ‎01-29-2010

There is an update on this (see release notes 6.7.6 for SMA)

Peter

_______________________________________________________________

Enhanced: Domain-Based Executive Summary Report

When you schedule a Domain-Based Executive Summary report, you now have the

configuration option to pull outgoing mail data from the domain of either the email server or

the email address. The system stores data for both, so you can configure this option differently

each time you schedule a report.

Note —

This feature requires AsyncOS 7.0.0 or higher on the Email Security appliance to

populate the outgoing mail graph.

_________________________________________________________________________

pvdberg00 · ‎02-08-2010

I have upgrade our test C and M appliance to the latest release and send a test message. I can do a domain report now but there is a problem with subdomains (domain xxx.nl and subdomain yyy.xxx.nl). Only report on domain is possible (if I run the report for the subdomain numbers for the domain are reported).

Peter.