Search for a message and view message history

Track Messages enables you to:

• Search for a message
• Explore the message events associated with the selected message (view message history)

Tell me about...

• The Message Tracking - Systems Event Page

  Message Tracking - Systems Event displays the message events associated with the selected message.

  Message information

  The upper panel displays basic Message Information.

  Item	Description
  From:	The sender's original email address.
  Received:	The date and time that the Gateway received the message for processing.
  To:	The email addresses of the message recipients.
  Subject:	The subject line of the message.

  Message events

  The lower panel displays the Message Events associated with the selected message.

  Each Message Event is displayed in chronological order, with the date and time of occurrence.

  Possible Message Event...	Indicates that the message has been..
  Accepted	Accepted by the Gateway.
  Accepted for processing by SMTP outbound transport service	Accepted for outbound delivery.
  Applied encryption	Encrypted. The Encryption Method is displayed.
  Applied encryption endpoint delivery policy	Applied with encryption endpoint.
  Decrypted PGP content	Decrypted as a result of a PGP decryption action.
  Decrypted SMIME content	Decrypted as a result of an S/MIME Secure Multipurpose Internet Mail Extensions (S/MIME) is a specification for secure email messages that uses the X.509 format for digital certificates and uses various encryption algorithms such as 3DES. decryption action.
  Decrypted SMIME and PGP content	Decrypted as a result of both an S/MIME and PGP decryption action.
  Deleted from message area	Deleted from a message area.
  Delivered to destination SMTP server	Delivered to the recipient's SMTP server.
  Delivery failed to destination SMTP server	Unable to be delivered to the recipient's SMTP server.
  Discarded	Discarded as a result of expiry or being non-delivered.
  Downloaded attachment	Attachment clicked and downloaded by an administrator.
  Expiry time set	Designated to expire from a message area, after a user-defined time period.
  Finished delivery attempts	Attempted to be delivered.
  Failed to apply encryption endpoint delivery policy	Unable to be delivered, due to no recipient key available.
  Forwarded from message area	Forwarded from a message area.
  Held	Held in a message area.
  Marked for deletion from message area	Designated for deletion from a message area.
  Marked for relay to specific host	Designated for relay to a user-defined host.
  Message discarded	Discarded by policy.
  No encryption endpoint for recipients	Unable to be delivered, due to no encryption endpoint defined for recipient.
  Non-delivered	Non-delivered.
  Non-delivered from message area	Non-delivered from a message area.
  Notify sender about unreachable recipients	Unable to be delivered and the sender has been notified with a non-delivery email.
  PMM Auto-release	Released from a PMM-enabled message area automatically.
  PMM Delete	Deleted from a message area by a PMM user.
  PMM Release	Released from a message area by a PMM user.
  Placed in problem message area	Detained because the Gateway has been unable to determine the message structure, or is unable to complete processing the message.
  Queued for relay to an encryption portal	Placed in queue to be relayed to an encryption portal.
  Rejected	Rejected at the Gateway perimeter.
  Received by MTA	Received for processing (inbound).
  Released from message area	Released from a message area.
  Reprocessed from message area	Reprocessed manually from a message area.
  Send a copy (BCC)	Copied and emailed to a user-defined email address.
  Send a copy (Relay Server)	Copied and archived to a relay server.
  Split into multiple messages	Split as a result of policy.
  Split to apply encryption endpoint settings	Split as a result of applying an encryption endpoint.
  Successfully processed	Successfully processed by the Gateway.
  Viewed in message area	Viewed by an administrator.
  Viewed message body	Message tab viewed by an administrator.
  Viewed raw message	Raw Message tab viewed by an administrator.

  Below each Message Event, a summary of Additional Information is also displayed.

  Additional Information	Description
  Actioned by	The user who processed the message.
  Address Route	The policy route that was applied to the message.
  Attachments	Filenames of attachments included with the message.
  Delivery failed	Delivery was unsuccessful.
  Encryption endpoint	The name of the mail encryption endpoint A profile of encryption settings for the Email Gateway to use for recipients that match the endpoint. applied to the message.
  Encryption error	Specific error while applying encryption.
  Encryption method	The method used to encrypt the message.
  Held area	The message area where a message is held.
  Hostname	The name (or IP address) of the relay server hosting archived or relayed messages.
  Never expire	The message has been configured to remain indefinitely in a message area.
  New MessageID	Unique identity of a message following a processing event (release, reprocess, forward, non-deliver) or a relay event.
  Receiving Peer	The Gateway peer that has received the message.
  Recipients	A list of recipients of the message.
  Sending Host	The IP address of the sender's host server. This can be an IPv4 or IPv6 address.
  Set expiry days	The number of days configured for the message to remain in a message area before expiring.
  SMTP Auth	SMTP Authentication status. Authentication type and connection details are displayed in brackets.
  Threats Found	Potential threats or issues detected by policy or a failure to process.
  TLS Cipher	The name of the TLS cipher used to encrypt the communication channel.
  TLS Requested	The level of TLS requested for encrypting the communication channel. The TLS Requested value can be None, Opportunistic, or Mandatory (forced).
  TLS Version	The version of TLS used to encrypt the communication channel.
  Transport Security	Protocol providing encryption at the transport layer (TLS).
  Triggered Rules	A list of the content rules that have been triggered by the message.
  User	The PMM user who processed the message.

  Use the Show Log button to view SMTP logs associated with the selected message. The Show Log button is not displayed if the SMTP log level is lower than 4. For more information on log levels, see Log Levels.

• Split messages

  Occasionally, a message can be split by a policy route, or for encryption. Split messages might be processed differently, despite originating as a single message. Message Tracking highlights messages that have been split by displaying subsequent message events with a shaded background in the Message Events area.

• Searching for messages on peered Gateways

  If you are searching with the Attachment or Reject Reason criteria across peered Gateways, it is recommended that you search only Gatewaysthat have been upgraded to the latest version. Older versions of the Gatewaymay not support these search criteria.

How do I...

• Search for a message?

  1. Navigate to Message > Track Messages. The Track Message page is displayed.

  2. In the Search Criteria panel, specify your search.

  3. Click Search. The results are displayed below the Search Criteria panel.

  Use the Reset Filter button to start a new search.

• Use the search criteria?

  You can search for a message on the Track Message page, using any of the following criteria:

  Search Criteria	Description
  Sender	The email address of the message sender.
  Recipients	The email address of the intended recipient.
  Subject	Text contained in the subject line of a message.
  Sending Host	The upstream SMTP host responsible for sending the message. This can be an IPv4 or IPv6 address and is case-insensitive. (IPv6 addresses are stored in condensed format but can be input as an expanded address and the criteria will still be valid).
  Attachment	An attachment filename.
  Reject Reason	A reason for message rejection. Select a Reject Reason from the list of options in the drop-down menu.
  Message Security	The encryption method used. Select a method from the list of options in the drop-down menu. PGP*, S/MIME, Password* encryption methods are available. Select Any Encrypted to search for messages encrypted with any of the available methods, or None to search for messages with none.
  Transport Security	The type of encryption security used for message delivery. You can search for messages that are delivered using Forced TLS, Opportunistic TLS, or Encryption Portal.
  Message Action	The policy or process action performed on the message. You can search for Accepted, Rejected, or Any messages.
  Received	The time period in which the message was received for processing. You can select a preset value (for example, Today, Yesterday, Last Week) or set a Custom time period.
  Peers	The Peer Gateway available for searching. Select one or more from the list of Peered Gateway.

  *PGP and Password encryption types are not available if your Gateway is operating in FIPS mode. For information on FIPS, see FIPS mode.

  You can search for a fragment, or part of a word, in any of the text fields. For example, searching for file in the Attachment field returns messages with attachments named file.xls, file.doc, and filestore.ppt If you are searching by Subject, you can also precede your search string with the character ^ to search for subjects that begin with common characters. For example, searching for ^Pers returns messages with subjects starting with Persons, Personal, or Personnel.

  What do the Reject Reasons mean?

  Each Reject Reason is displayed in the list of options with its system name in brackets.

  Reject	Reason
  Bad Reputation (TRUSTmanager:reject)	Sender has a bad reputation with Spamlogic.
  Badly Tagged Recipient (spam:badlytaggedrecipient)	Invalid BATV Bounce Address Tag Validation recipient.
  Banned Sender (spam:bannedsender)	Sender blocked by Spamlogic.
  BATV (spam:batvfailure)	Probable spam detected by BATV.
  Confirmed Junk Email (spam:confirmedjunkemail)	Junk email detected.
  Confirmed Phishing Email (spam:confirmedphishingemail)	Phishing email detected. This is a sub-category of Junk email.
  DKIM DomainKeys Identified Mail Hard Fail (spam:dkimhardfail)	Mail failed DKIM verification check.
  DMARC Domain-based Message Authentication, Reporting & Conformance Reject (spam:dmarcreject)	Mail failed DMARC verification check.
  Domain of Sender Address Does Not exist (spam:unresolvablesenderdomain)	Sender's domain is unresolved.
  Grey Listed (spam:greylisted)	Sender temporarily rejected by a greylist.
  Host Denied (spam:hostdenied)	Sending host rejected.
  Other Reject Reason (spam:otherrejectreason)	Rejected for reason not listed.
  Oversized messages (smtp:oversized)	Mail contains oversized attachment or content.
  Real-time Blocklist (spam:rbllookup)	Sender's IP address added to the block list by Spamlogic.
  Recipient Verification (spam:recipientverification)	Recipient unknown
  Relaying Denied (spam:relayingdenied)	Relayed message denied.
  Sender Spoofed (spam:spoofedsender)	Sender attempted to spoof an approved email address.
  SPF Sender Policy Framework DNS error (spam:spfdnserror)	Sender policy framework validation could not contact DNS.
  SPF Fail (spam:spf)	Sender policy framework validation check failed.
  Suspected Junk Email (spam:suspectedjunkemail)	Junk email suspected.
  Suspected Phishing Email (spam:suspectedphishingemail)	Phishing email suspected. This is a sub-category of Junk email.
  SMTP Auth Error (SMTP Auth:error)	Unable to verify a connection using SMTP authentication.
  TLS Authentication Failed (TLS:authenticationfailed)	Unable to authenticate using TLS.

• Search for multiple senders or recipients?

  Message Tracking allows you to search with a single entry in either the Sender or Recipients field. You can also search for email addresses using a domain. For example, searching with @company.org returns matches for all users within the company.org domain.

  You can search for messages with 'no sender' (such as delivery reports or other automated messages) by using <> in the Sender field.

• Search for messages received within a time period?

  You can search for recently processed messages in a variety of ways using Message Tracking. You can also search for older messages, or refine the search criteria to a time period of your choice. The available preset values for messages Received are:

  • Today
  • Last Hour
  • Last 30 minutes
  • Last 5 minutes
  • Yesterday
  • This Week
  • Last Week
  • Custom

  This Week is defined as the time period between the first day of the week and Today. You can use the Tracking And Report Settings page to define the Start Day and End Day of the week. For example, if the Start Day of the week is Monday, This Week refers to the period between Monday and Today, while Last Week is defined as the time period between the previous Monday and Sunday.

  To refine the search period:

  1. Set the messages Received value by selecting Custom from the drop-down menu. The date and time settings are displayed.
  2. Use the calendar icon and time values to specify the time period. Time values are displayed in the 24-hour clock format.
  3. Click Search. The matching results are displayed.

  The Gateway is configured to retain detailed reporting data for a set number of days. Searching for older messages may return no matches. You can configure the detailed reporting data retention time in Tracking And Report Settings.

• Explore the search results?

  Search results are displayed in a list, indicating the status of the message, the Sender, Recipients, Subject, and the Processed date and time.

  The current status of a message is displayed by one of the following Message Tracking icons:

  Icon	Description
  	The message has been successfully delivered.
  	The message was rejected by the Gateway at the Postfix perimeter.
  	The message is being processed by the Gateway.
  	The message has been split by the security policy.
  	The message is currently in the deferred queue as it was unable to be delivered on the first attempt.
  	The message has been blocked by the security policy, or has timed-out while in the deferred queue.
  	The message has been deleted.
  	The message has been redirected to a held message area.
  	A PMM action (delete, release, auto-release) has been applied to the message.

  If a large number of messages match your search results, the list of messages is displayed on multiple pages. Page navigation buttons enable you to scroll through each page of results, or select pages individually. You can also specify the number of results displayed per page (20, 50, 100, 150, 200, or 300) using the drop-down menu in the results toolbar.

  Search results are displayed in reverse chronological order, with the most recently processed message displayed at the top of the list.

• Export the search results?

  Search results can be exported as a CSV file. This enables you to save and archive the search results for future use.

  1. From the Track Message page, enter your search criteria and perform a search. The search results are displayed.

  2. Click Export. A dialog is displayed enabling you to configure the save or export options.

     The exported CSV contains the data pertaining to the messages displayed in your search results including the Timestamp, Event type, Message ID and Peer ID (name), Sender, Recipients, Subject, Message Outcome, Attachment names, and Encryption Type.

• Track a message?

  You can view the complete set of message events for an individual message.

  1. Use the search criteria to locate messages that have been processed by the Gateway.
  2. Select a message entry from the search results and click View (or double-click the message). The Message Tracking - System Events page is displayed, showing information about the selected message including a full list of message events.