IronPort - daily management guide - AsyncOS 7.6.1

OL-25138-01
Tracking Email Messages
This chapter contains the following sections:
Tracking Service Overview, page 3-1
Enabling and Disabling Local Message Tracking, page 3-2
Understanding Tracking Query Setup, page 3-3
Running a Search Query, page 3-5
Understanding Tracking Query Results, page 3-6
Tracking Service Overview
CHAPTER
3
The message tracking service makes it easy to find the status of messages processed by AsyncOS, and
you can quickly resolve help desk calls by determining the exact location of a message. You can use
message tracking to determine if a particular message was delivered, found to contain a virus, or placed
in a spam quarantine — or if it is located somewhere else in the mail stream.
You can enable message tracking on your local Cisco IronPort Email Security appliance, or you can
enable centralized tracking on an M-Series appliance to track messages for multiple email security
appliances. For instructions on enabling centralized tracking, see the Cisco IronPort AsyncOS for
Security Management User Guide . For instructions for enabling local tracking, see Enabling and
Disabling Local Message Tracking, page 3-2.
Instead of having to search through log files using “grep” or similar tools, you can use the flexible
tracking interface to locate messages. You can use a variety of search parameters in combination.
Tracking queries can include:
Envelope information: Find messages from particular envelope senders or recipients by entering
the text strings to match.
Subject header: Match a text string in the subject line. Warning: Do not use this type of search in
environments where regulations prohibit such tracking.
Time frame: Find a message that was sent between specified dates and times.
Sender IP address or rejected connections: Search for messages from a particular IP address, or
show rejected connections in the search results.
Event Information: Find messages that match specified events, such as messages flagged as virus
positive, spam positive, or suspected spam, and messages that were delivered, hard bounced, soft
bounced, or sent to the Virus Outbreak Quarantine.
Cisco IronPort AsyncOS 7.6 for Email Daily Management Guide
3-1