Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Tips on how to interpret logs containing attachments


I have a user complaining about that he is not receiving any attachments from a specific user. I of course took a look at the e-mail itself, and indeed there was not attachment there. However, when I use the message tracking function to track that specific e-mail, I see no evidence of any attachment being removed, or even being sent. This is true for other e-mails as well, where attachments of various kinds actually have been sent.

Is there an easy way to follow/log/trace this behaviour? or atleast find any signs or proof of that an attachment has been sent/removed with an e-mail. If the attachment was removed, shouldn't the user have been notified of this? (yes, i am aware that this has to be configured, which i am pretty sure we have).

thank you.

New Member

Re: Tips on how to interpret logs containing attachments

If you want to log all attachment names passing through the Ironport you can create a message filter to do this. From the Knowledgebase:-

I want to see the filenames of all attachments going through the system. By default, these are not recorded in the logs.

How can I log filenames of attachments?

Create a new header that contains the filenames of all attachments.
Use logconfig > logheaders to record the value of that header to the mail_log.

Here is a filter that will record the filenames for messages that have attachments:


if (attachment-filename == "^.+$") {
insert-header ("X-fn", "$filenames");

The "^.+$" regex assures that there is an attachment with at least 1 character in the filename. This will be false for messages with no attachments, so only attachments will be logged.

Note that the definition of "Attachment" to an email message is debatable. Typically, the first text/plain and text/html parts are considered the "body". See the user's guide for more detail on what is considered an attachment.

New Member

Re: Tips on how to interpret logs containing attachments


setup a connection debug log for the sending mailhost and you will see everything tha particular host is sending you (including attachments)