Cisco ESA - Find messages and increase size for Antivirus scanning

[mikiNet]

HI,

I have a question related to find message. Is it possible to find ALL mails which size are more than 2MB and pull result up to output in ssh or like cvs/other extensions file? It is important that this output should have info from which domain this mail arrived. 

Second question, how can increase value of maximum size message to be scanned for Antivirus ? In Security Services->Antivirus I have only option to enable this service

[Ken Stieers · Accepted solution]

For the most part the reports are built around security outcomes, not operations outcomes.
The easiest option would be to add a new Log Subscription, set the type as Consolidated Event logs, and add the fields you need/want, and then you can use that to find what you need.
Once you enable the AV, you'll get a couple more options... its not size but time...