Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Community Member

Strange "Internal Users" report

Hi,

I have an IronPort C100 ESA with an exchange server and one inside domaine (like @toto.com). When I look at the "Internal Users" report at the right side (Top Users by Clean Outgoing Messages), there are some addresses that do not belong to my toto.com domain.

Does anyone has a clue for this?

Thanks,

Vincent

2 REPLIES
Cisco Employee

Re: Strange "Internal Users" report

Is it possible that you have a compromised host on your network. You can grep the mail logs to verify that these messages were injected by your internal mail server.

Community Member

Re: Strange "Internal Users" report

Hi,

I just peformed a "findevent" and found that those stats are linked to mails forwarded to an external address on my exchange server.

thanks

127
Views
0
Helpful
2
Replies
CreatePlease to create content