Message tracking display and reporting

[Adam White]

Hi,

I am newish to the email appliance. We have a c370.

I am told we need reports daily detailing each email address leaving the ironport each day.

If we could also see the sending address that would be great.

message tracking seems to have this information but there are two problems:

1. it only lists 250 items.

2. i cannot  schedule this report?

Any ideas as to the 2 items?

[Jacqueline Fleming]

You are correct, this is not possible because:

- Tracking can show only up to 1000 items.
- It is not possible to schedule Tracking searches.

There is an Internal Users Report that tracks how many clean/threat messages for each user.  However, these are just counters and will not show the details for each message.  I'd still suggest looking over that page (from Monitor tab) to see if it meets your needs.

So the only other suggestion I can offer is manually parsing the mail_logs each day for all the required data.  Sorry.

- Jackie

[tachingh]

May I know is current version have this request resolve?

- Possible the tracking "export all" can export more than 100,000 items?
- It is not possible to schedule Tracking searches and send/archive the report?

[dmccabej]

You can find more details on the tracking search behavior within the User Guide(s) under the 'Working with Message Tracking Search Results' section. Currently, you can export up to 50,000 events (not necessarily messages - could be less than 50,000 if some messages have been re-written causing new MIDs to be formed). You're also not able to schedule tracking reports, so they need to be done manually. 

Thanks!

-Dennis M.

[tachingh]

Hi, I have read the KBA as post, but it still not able to answer my query.

I try to download 100k message events but seem like I can't. Is there CLI command that i can export out the message events to a .csv? (Not from Mail_logs)

[dmccabej]

Hello,

As I previously mentioned, (up to) 50,000 is the max number of events you're going to be able to export. So, what you're asking for is not currently possible. 

Your best bet would be to start pushing off the mail_logs via SCP/Syslog/ETC and then performing searches on those logs.

Thanks!

-Dennis M.