Attachment Profiling

[MikeK_ironport]

Hello,
Has anyone setup filters to perform outbound attachment profiling?

For example, how many excel docs per hour, how many word docs per hour, and what sizes?

I am sure there is a filter that could be written, but then how do you report on that filters findings?

Thanks!
Mike

[chuntmd_ironport]

That would be nice to have. I would also like to see a "Executive dashboard" type screen with this info on it. I've pulled attachment size data out of the Mail Flow Central MySQL DB using custom queries but I'm not sure the attachment name is stored in a field.
CH

[tminchin_ironport]

You might want to play with turning up the debug in the Sophos log stream. I think you can get attachment name listed in there - not sure about the size though.

[shannon.hagan]

Or you could put it in the mail_logs.

If you have a filter that adds an x-header with the filenames and then change the mail_logs to have include the x-header you added. I believe you have to wait until 4.7 to have it work correctly though.

[MikeK_ironport]

We started putting in our mail_logs right after I posted the note. That is working, but it takes quite a bit to write the perl scripts to pull out all the data.

The Virus stream I did last year. That's not bad, but again, it's hard to gather all the data.