Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 
Email Security Quick-links: ESA Product Support | SMA Product Support | Email Submission and Tracking Portal | Cisco SecurityHub
Current General Deployment (GD) Releases:
ESA: 11.0.0-264 WSA: 10.5.1-296 SMA: 11.0.0-115 Email Plug-in (Reporting): 1.0.1-048 Email Plug-in (Encryption): 1.0.0-036

spamtowho stats

i love this little util, but it looks as if the weekly stats from my ironport device and the util itself don't gel. weekly we may block about 900,000 emails mostly due to poor reputation, but when i load in a weeks worth of mail logs and run spamtowho, i only show about 1/3 of that. can anyone possibly clue me in as to what i may be doing wrong here? thanks!

Cisco Employee


are you logging dropped connections, by default and for performance reasons those are not typically logged.

Re: spamtowho stats

when i look in a log file i can see drops due to HAT, and DHAP etc. so i'd say it's logging them. my mail_log level is at Informational.

Cisco Employee


Not sure you would want to log every single dropped connection via SBRS but if you want to for tracking purposes go to Security Services/Message Tracking and edit the settings and enable "Save tracking information for rejected connections"

Re: spamtowho stats

good point, yeah i don't really want to tax the system by having it keep up with that much logging. i'm a little curious what good the spamtowho app is though? if you don't have an accurate number of all connections, dropped and otherwise then i would think it throws off the stats for everything else.