Ironport Reports - What is considered "No User Informat

[klose_ironport]

The outbound/Sent section of the Users reports typically show senders email address.

There is a group that is labeled "No User Information" and the numbers are high.

I suspect this is internal email relays from our systems, but would like to confirm the actitivy.

What items would end up into this group?
Please provide sample on how to use findevent to review some of these.

[Douglas Hardison]

This parameter relates to messages that have been relayed through the IronPort appliance without an Envelope-From address. These are typically bounce messages being sent by an internal host. This is not a defect or a critical issue. It is just the way your internal host is configured to send bounces.

The IronPort has no control over this setting. Generally, your host will add a "mailer-daemon@domain.com" type address as the From message header for such bounce messages. If it does not, there will be no "FROM" address.

You can use findevent to search for null senders by doing a search for 'envelope FROM', with the regular expression "<>".

-whardison

[klose_ironport]

We have identified our source of these. Exchange 2007 Out of Office replies are generating them.
Now that we know what they are...we can look into better identifiing them so they do not end up in this "No Uer Information" group.