Auditing users ( release , delete from quarantines )

Unanswered Question
Nov 3rd, 2009
User Badges:


We are using Appliance C- Model.
Some local users are configured for checking quarantines in order to release or delete emails.
My question is :

Is it possible to have reporting or auditing in order to know for example : User1 has released emails with subject xxx from Quarantine Q1 on 3/11/2009 at 10:25

I have checked mail_logs but not enough information. Also it is not user friendly :wink:


  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Rayman_Jr Wed, 11/25/2009 - 09:43
User Badges:

I also wish there would be something like quarantine auditing log !

I don't know any easy way but some info can be also found from euqgui_logs

for example release of message is shown in the following way:

Fri Sep 11 08:09:18 2009 Info: req: user:User1 id:7WQZhqMvm8Z60kVhQP9t 303 GET /Message?action=&screen=Message&page=&mid=368522&action%3ARelease=Release HTTP/1.1 Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/530.5 (KHTML, like Gecko) Chrome/ Safari/530.5

At least you will see time stamp, user name and message ID. By using the message ID you can get more info from mail logs.

Yes, it's a painful process....
Andrew Wurster Wed, 11/25/2009 - 15:52
User Badges:

maybe they could also add a 'comments' field to the administrator's release buttons? who knows - in any case great ideas!

check this link out on submitting your awesome feature ideas to us:

IT_Ironport Thu, 11/26/2009 - 09:47
User Badges:


Thanks for the tips with euqguilogs however it is not user friendly :-)
I have sent a feature request to IronPort Support. Logically they are working on a new feature like auditing due to same questions.

I hope that feature will be in the next updates.

I keep you informed

Rayman_Jr Thu, 11/26/2009 - 11:55
User Badges:

Thanks IT for having effort to create a feature request, more customers want this, sooner it might come (I hope) :wink:

Andrew Wurster Thu, 11/26/2009 - 17:15
User Badges:

yea the more you guys open cases with ironport support and hook up to the feature request (same one and no duplicates hopefully **fingers crossed**) - the easier it is for the product management and support staff to recognize what are the most important requests to focus on and implement.

so if there's something that really bugs you guys - don't hide it inside - shout it out! well, don't shout - maybe just be kind of excited about it...

happy t-day!



This Discussion