Search for a message and view message history
You can view the complete set of message events for an individual message.
- Use the search criteria to locate messages that have been processed by Secure Email Gateway.
- Select a message entry from the search results and click View or double-click the message. The Message Tracking - System Events page is displayed, showing information about the selected message including a full list of message events.
The Message Tracking - Systems Event
Message Tracking - Systems Event page provides the message events associated with the selected message.
Message information
-
The upper panel displays basic message information.
Show details
Item Description From: The sender's original email address. Received: The date and time that the To: The email addresses of the message recipients. Subject: The subject line of the message.
Message events
Message events are policy or process-related events.
-
The lower panel displays the Message Events associated with the selected message.
-
Each message event is displayed in chronological order, with the date and time of occurrence.
Show details
In the following table, there may be message events that are not applicable to the product you are using, for example, Secure Email Gateway or Secure Exchange Gateway. Event type Description Accepted Accepted by the Accepted by Exchange Interceptor Accepted by Exchange Interceptor. Accepted for processing by SMTP Outbound Transport service Accepted for outbound delivery. Active Content Sanitization Successful Active content sanitization successful. Active Content Sanitization Failure Active content sanitization failed. Applied encryption Encrypted. The Encryption Method is displayed. Applied Encryption Endpoint delivery policy Applied with encryption endpoint. Copied Copied to Message Area. Decrypted PGP content Decrypted as a result of a PGP decryption action. Decrypted SMIME content Decrypted as a result of an S/MIME Secure Multipurpose Internet Mail Extensions (S/MIME) is a specification for secure email messages that uses the X.509 format for digital certificates and uses various encryption algorithms such as 3DES. decryption action.Decrypted SMIME and PGP content Decrypted as a result of both an S/MIME and PGP decryption action. Deleted from message area Deleted from a message area. Delivered to destination SMTP server Delivered to the recipient's SMTP server. Delivery failed to destination SMTP server Unable to be delivered to the recipient's SMTP server. Discarded Discarded as a result of expiry or being non-delivered. Discarded by Exchange Interceptor Discarded by Exchange Interceptor. Document Sanitization Successful Document Sanitization successful. Document Sanitization Failure Document Sanitization failed. Downloaded attachment Attachment clicked and downloaded by an administrator. Expiry time set Designated to expire from a message area, after a user-defined time period. Finished delivery attempts Attempted to be delivered. Failed to apply Encryption Endpoint delivery policy Unable to be delivered, due to no recipient key available. Forwarded from message area Forwarded from a message area. Held Held in a message area. Marked for deletion from message area Designated for deletion from a message area. Marked for relay to specific host Designated for relay to a user-defined host. Message discarded Discarded by policy. Message Sanitization Successful Message sanitization successful. Message Sanitization Failure Message sanitization failed. No Encryption Endpoint for recipients Unable to be delivered, due to no encryption endpoint defined for recipient. Non-delivered Non-delivered. Non-delivered from message area Non-delivered from a message area. Notify sender about unreachable recipients Unable to be delivered and the sender has been notified with a non-delivery email. PMM Auto-release Released from a PMM-enabled message area automatically. PMM Delete Deleted from a message area by a PMM user. PMM Release Released from a message area by a PMM user. Placed in problem message area Detained because the Processed Mail Initiated Key Exchange request Processed Mail Initiated Key Exchange request. Processed Smart Domain Signing message Processed Smart Domain Signing message. Queued for relay to an encryption portal Placed in queue to be relayed to an encryption portal. Rejected Rejected at the Received by MTA Received for processing (inbound). Released from message area Released from a message area. Redaction Successful Redaction successful. Redaction Failure Redaction failure. Reprocessed from message area Reprocessed manually from a message area. Sandboxing started Sandboxing started. Sandboxing complete Sandboxing complete. SDS message discarded as it does not have a valid recipient Invalid SDS message discarded. Send a copy (BCC) Copied and emailed to a user-defined email address. Send a copy (Relay Server) Copied and archived to a relay server. Split into multiple messages Split as a result of policy. Split to apply Encryption Endpoint settings Split as a result of applying an encryption endpoint. Successfully processed Successfully processed by the Timed out waiting for sandboxing to complete Sandboxing timed out. Viewed in message area Viewed by an administrator. Viewed message body Message tab viewed by an administrator. Viewed raw message Raw Message tab viewed by an administrator.
-
Below each message event, a summary of additional information is also displayed.
Show details
In the following table, there may be items that are not applicable to the product you are using, for example, Secure Email Gateway or Secure Exchange Gateway. Additional Information Description Actioned by The user who processed the message. Address Route The policy route that was applied to the message. Attachments Filenames of attachments included with the message. Delivery failed Delivery was unsuccessful. Encryption Endpoint The name of the mail encryption endpoint A profile of encryption settings for the Email Gateway to use for recipients that match the endpoint. applied to the message.Encryption Error Specific error while applying encryption. Encryption Method The method used to encrypt the message. Held Area The message area where a message is held. Hostname The name (or IP address) of the relay server hosting archived or relayed messages. Never Expire The message has been configured to remain indefinitely in a message area. New MessageId Unique identity of a message following a processing event (release, reprocess, forward, non-deliver) or a relay event. Receiving Peer The Recipients A list of recipients of the message. Sending Host The IP address of the sender's host server. Set expiry days The number of days configured for the message to remain in a message area before expiring. SMTP Auth SMTP Authentication status. Authentication type and connection details are displayed in brackets. Threats Found Potential threats or issues detected by policy or a failure to process. TLS Cipher The name of the TLS cipher used to encrypt the communication channel. TLS Requested The level of TLS requested for encrypting the communication channel. The TLS Requested value can be None, Opportunistic, or Mandatory (forced). TLS Version The version of TLS used to encrypt the communication channel. Transport Security Protocol providing encryption at the transport layer (TLS). Triggered Rules A list of the content rules that have been triggered by the message. User The PMM user who processed the message. Use the Show Log button to view SMTP logs associated with the selected message. The Show Log button is not displayed if the SMTP log level is lower than 4. See Log Levels for more information.
Split messages
Occasionally, a message can be split by a policy route, or for encryption. Split messages might be processed differently, despite originating as a single message. Message Tracking highlights messages that have been split by displaying subsequent message events with a shaded background in the Message Events area.
Search for a message
-
Navigate to Message > Track Messages. The Track Message page is displayed.
-
In the Search Criteria panel, specify your search.
Show details
Search Criteria Description Sender The email address of the message sender. Recipients The email address of the intended recipient. Subject Text contained in the subject line of a message. Sending Host The upstream SMTP host responsible for sending the message.
Attachment An attachment filename. Reject Reason A reason for message rejection. Select a Reject Reason from the list of options in the drop-down menu.
Message Security The encryption method used. Select a method from the list of options in the drop-down menu. PGP*, S/MIME, Password* encryption methods are available. Select Any Encrypted to search for messages encrypted with any of the available methods, or None to search for messages with none.
Transport Security The type of encryption security used for message delivery. You can search for messages that are delivered using Forced TLS, Opportunistic TLS, or Encryption Portal. Message Action The policy or process action performed on the message. You can search for Accepted, Rejected, or Any messages. Received The time period in which the message was received for processing. You can select a preset value (for example, Today, Yesterday, Last Week) or set a Custom time period. Peers The Peer
*PGP and Password encryption types are not available if your - You can search for a fragment, or part of a word, in any of the text fields. For example, searching for file in the Attachment field returns messages with attachments named file.xls, file.doc, and filestore.ppt
- If you are searching by Subject, you can also precede your search string with the character ^ to search for subjects that begin with common characters. For example, searching for ^Pers returns messages with subjects starting with Persons, Personal, or Personnel.
-
Click Search. The results are displayed below the Search Criteria panel.
Click  Reset Filter to clear the existing search and start a new one. |
Reject Reason
Under Search Criteria, each Reject Reason is displayed in the drop-down menu with its system name in brackets.
| In the following table, there may be reject reasons that are not applicable to the product you are using, for example, Secure Email Gateway or Secure Exchange Gateway. |
| Reject reason | (System name) | Description |
|---|---|---|
| Bad Reputation | TRUSTmanager:reject | Sender has a bad reputation with Spamlogic. |
| Badly Tagged Recipient | spam:badlytaggedrecipient | Invalid BATV Bounce Address Tag Validation recipient. |
| Banned Sender | spam:bannedsender | Sender blocked by Spamlogic. |
| BATV | spam:batvfailure | Probable spam detected by BATV. |
| Confirmed Junk Email | spam:confirmedjunkemail | Junk email detected. |
| Confirmed Phishing Email | spam:confirmedphishingemail | Phishing email detected. This is a sub-category of Junk email. |
| DKIM DomainKeys Identified Mail Hard Fail |
spam:dkimhardfail | Email failed DKIM verification check. |
| DMARC Domain-based Message Authentication, Reporting & Conformance Reject |
spam:dmarcreject | Email failed DMARC verification check. |
| Domain of Sender Address does not exist | spam:unresolvablesenderdomain | Sender's domain is unresolved. |
| Grey Listed | spam:greylisted | Sender temporarily rejected by a greylist. |
| Host Denied | spam:hostdenied | Sending host rejected. |
| Other Reject Reason | spam:otherrejectreason | Rejected for reason not listed. |
| Oversized messages | smtp:oversized | Email contains oversized attachment or content. |
| Real-time Block List | spam:rbllookup | Sender's IP address added to the block list by Spamlogic. |
| Recipient Verification | spam:recipientverification | Recipient unknown. |
| Relaying Denied | spam:relayingdenied | Relayed message denied. |
| Sender Spoofed | spam:spoofedsender | Sender attempted to spoof an approved email address. |
| SPF Sender Policy Framework DNS Error |
spam:spfdnserror | Sender policy framework validation could not contact DNS. |
| SPF Fail | spam:spf | Sender policy framework validation check failed. |
| Suspected Junk Email | spam:suspectedjunkemail | Junk email suspected. |
| Suspected Phishing Email | spam:suspectedphishingemail | Phishing email suspected. This is a sub-category of Junk email. |
| SMTP AUTH Error | SMTP Auth:error | Unable to verify a connection using SMTP authentication. |
| TLS Authentication Failed | TLS:authenticationfailed | Unable to authenticate using TLS. |
| TLS Handshake Failed | TLS:connectionlost | Unable to connect using TLS |
Search for multiple senders or recipients
Message Tracking allows you to search with a single entry in either the Sender or Recipients field. You can also search for email addresses using a domain. For example, searching with @company.org returns matches for all users within the company.org domain.
You can search for messages with 'no sender' (such as delivery reports or other automated messages) by using <> in the Sender field. |
Search for messages received within a time period
You can search for recently processed messages in a variety of ways using Message Tracking. You can also search for older messages, or refine the search criteria to a time period of your choice. The available preset values for messages Received are:
- Today
- Last Hour
- Last 30 minutes
- Last 5 minutes
- Yesterday
- This Week
- Last Week
- Custom
|
This Week is defined as the time period between the first day of the week and Today. You can use the Tracking And Report Settings page to define the Start Day and End Day of the week. For example, if the Start Day of the week is Monday, This Week refers to the period between Monday and Today, while Last Week is defined as the time period between the previous Monday and Sunday. |
Search for messages received within a customized period
- Set the messages Received value by selecting Custom from the drop-down menu. The date and time settings are displayed.
- Use the calendar icon
and time values to specify the time period. Time values are displayed in the 24-hour clock format. - Click Search. The matching results are displayed.
| The |
Search for messages on the Peer Gateways
If you are searching with the Attachment or Reject Reason criteria across
Explore the search results
Search results are displayed in a list, indicating the status of the message, the Sender, Recipients, Subject, and the Processed date and time.
The current status of a message is displayed by one of the following icons:
| Icon | Description |
|---|---|
|
The message has been successfully delivered. |
|
The message was rejected by the |
|
The message is being processed by the |
|
The message has been split by the security policy. |
|
The message is currently in the deferred queue as it was unable to be delivered on the first attempt. |
|
The message has been blocked by the security policy, or has timed-out while in the deferred queue. |
|
The message has been deleted. |
|
The message has been redirected to a held message area. |
|
A PMM action (delete, release, auto-release) has been applied to the message. |
If a large number of messages match your search results, the list of messages is displayed on multiple pages. Page navigation buttons enable you to scroll through each page of results, or select pages individually. You can also specify the number of results displayed per page (20, 50, 100, 150, 200, or 300) using the drop-down menu in the results toolbar.
| Search results are displayed in reverse chronological order, with the most recently processed message displayed at the top of the list. |
Export the search results
Search results can be exported as a CSV file. This enables you to save and archive the search results for future use.
- From the Track Message page, enter your search criteria and perform a search. The search results are displayed.
-
Click
Export. A dialog is displayed enabling you to configure the save or export options.The exported CSV contains the data pertaining to the messages displayed in your search results including the Timestamp, Event type, Message ID and Peer ID (name), Sender, Recipients, Subject, Message Outcome, Attachment names, and Encryption Type.