Auditing users ( release , delete from quarantines )

IT_Ironport · ‎11-03-2009

Hi,

We are using Appliance C- Model.
Some local users are configured for checking quarantines in order to release or delete emails.
My question is :

Is it possible to have reporting or auditing in order to know for example : User1 has released emails with subject xxx from Quarantine Q1 on 3/11/2009 at 10:25

I have checked mail_logs but not enough information. Also it is not user friendly :wink:

Regards

IT_Ironport · ‎11-10-2009

up...

citygirl0804_ironport · ‎11-24-2009

ran into the same problem, let me know if you figured somethign out.
thanks.

Rayman_Jr · ‎11-25-2009

I also wish there would be something like quarantine auditing log !

I don't know any easy way but some info can be also found from euqgui_logs

for example release of message is shown in the following way:

Fri Sep 11 08:09:18 2009 Info: req: user:User1 id:7WQZhqMvm8Z60kVhQP9t 303 GET /Message?action=&screen=Message&page=&mid=368522&action%3ARelease=Release HTTP/1.1 Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/530.5 (KHTML, like Gecko) Chrome/2.0.172.43 Safari/530.5

At least you will see time stamp, user name and message ID. By using the message ID you can get more info from mail logs.

Yes, it's a painful process....

Andrew Wurster · ‎11-25-2009

maybe they could also add a 'comments' field to the administrator's release buttons? who knows - in any case great ideas!

check this link out on submitting your awesome feature ideas to us:
http://tinyurl.com/mm8r26

IT_Ironport · ‎11-26-2009

Hi,

Thanks for the tips with euqguilogs however it is not user friendly :-)
I have sent a feature request to IronPort Support. Logically they are working on a new feature like auditing due to same questions.

I hope that feature will be in the next updates.

I keep you informed

Rayman_Jr · ‎11-26-2009

Thanks IT for having effort to create a feature request, more customers want this, sooner it might come (I hope) :wink:

Andrew Wurster · ‎11-26-2009

yea the more you guys open cases with ironport support and hook up to the feature request (same one and no duplicates hopefully **fingers crossed**) - the easier it is for the product management and support staff to recognize what are the most important requests to focus on and implement.

so if there's something that really bugs you guys - don't hide it inside - shout it out! well, don't shout - maybe just be kind of excited about it...

happy t-day!

andrew