E-mail tracking/log retention

[RYAN KIM]

Not so much of a technical issue, but was wondering how long everyone keeps their message tracking and/or e-mail logs around?  We use an M-Series, and it looks like you can't specify retention time, rather, you have to manually configure your disk size to limit or increase the amount of data you're keeping.

I'm curios what other folks are doing, how long they're keeping message tracking data available and/or if they have an overall e-mail retention policy.  I know some firms are under government guidelines to archive all electronic communication for 7 years or similar.

Thanks.

[Jason Meyer]

This is something that we are starting to discuss in our shop.   We are just starting to have e-mail retention/archive/discovery conversations and the logs on the IronPort appliances come into that every once in a while.  If it is something that is easy to do it may be advantageous to add the ability to set retention of these logs by length of time.  From a technical stand point so many MB is great, logic, easy to understand.  Unfortunately in the business/legal world they use a different type of thinking and like to speak in terms of days.  At least, that's been my expierience.

Long live the Iron Nation

Jason

[Ken Perdue]

We use the "SCP on Remote Server" option to push our Delivery Logs and IronPort Text Mail Logs from our X-Series appliances to a centralized log server and manage them there. We haven't defined a long-term retention period for the logs on the log server yet, though.

.....Ken

[RYAN KIM]

Thanks for the feedback, fellas.  We also SCP our logs to a dedicated server, and we have message tracking via our M-Series.  As Jason validated as well, we can't set our Message Tracking to go back to a specific date, like we can for our mail logs.  On our log server, I can delete items that are older than say 6 months old, but I can't do that as precisely with our Message Tracking.

Not sure about you guys, but I haven't gotten real firm direction from other business units on what their requirements are for e-discovery.

[steven_geerts]

Hello,

We use syslog forwarding to our central (maildata-)syslog server and keep the log there for 3 months. after that period we move the files to a "log storage" server (using a scheduled SCP job). on this system we keep 7 years of history available.

Steven