cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1515
Views
5
Helpful
3
Replies

is there a trick to using Message Tracking for empty senders?

Tomki
Level 1
Level 1

"Internal users" available under the 'Monitor' menu shows lists of user addresses that you can click on, leading over to useful Message Tracking details. 

However one of the most common entries is one like "No User Information"

e.g. try https://YOUR.IRONPORT/monitor/reports/internal_user_search and if I sort by 'Outgoing spam detected' for example, I get a number in the corresponding column, which I can click on to try to find out what internal messages are being sent which get identified as spam. Useful info to try and investigate.

 

However the link populates "No user information" straight across into the Message tracking, which fails to find anything at all.  I've tried various things without luck; is there a trick to getting consolidated message tracking for an empty sender value?

 

Screen Shot 2021-10-23 at 11.55.04.png

 

3 Replies 3

marc.luescherFRE
Spotlight
Spotlight

Hi Tomki,

 

can you try using ^(?![\\s\\S]) in the from field and let me know if you get any hits ?

 

-Marc

No hits.

UdupiKrishna
Cisco Employee
Cisco Employee

There's an existing enhancement bug surrounding this - CSCvm52083. You can use the CLI and look into mail logs for these message using something like  - grep -p "Feb 15.*From: <>" mail_logs