cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1125
Views
0
Helpful
1
Replies

Cisco ESA Released Emails Query

dijeshkeloth
Level 1
Level 1

Hi,

 

Is there anyway to get the list of senders for emails released from Spam quarantine?

 

Thanks

1 Reply 1

Mathew Huynh
Cisco Employee
Cisco Employee
Hey Dijesh,

From what I can see; we cannot get this information readily on the ESA via the GUI or CLI.
To do this would require some checks inside the mail_logs or so for specific log lines, then running a grep against it:

EG:
grep "Start MID.*ICID 0 (ISQ Released Message)"

Then this yields:
Wed Nov 13 10:41:56 2019 Info: Start MID 403511 ICID 0 (ISQ Released Message)

Where if you grep the MID here you will get the sender.

Another log is euq_log
This will give you the recipient IDs of released emails, rather than the sender.
example:
--
Info: ISQ: Released MID 403421 to 1676@cisco.com

Regards,
Mathew