is there a trick to using Message Tracking for empty senders?

[Tomki]

"Internal users" available under the 'Monitor' menu shows lists of user addresses that you can click on, leading over to useful Message Tracking details. 

However one of the most common entries is one like "No User Information"

e.g. try https://YOUR.IRONPORT/monitor/reports/internal_user_search and if I sort by 'Outgoing spam detected' for example, I get a number in the corresponding column, which I can click on to try to find out what internal messages are being sent which get identified as spam. Useful info to try and investigate.

However the link populates "No user information" straight across into the Message tracking, which fails to find anything at all.  I've tried various things without luck; is there a trick to getting consolidated message tracking for an empty sender value?

 

[marc.luescherFRE]

Hi Tomki,

can you try using ^(?![\\s\\S]) in the from field and let me know if you get any hits ?

-Marc

[Tomki]

No hits.

[UdupiKrishna]

There's an existing enhancement bug surrounding this - CSCvm52083. You can use the CLI and look into mail logs for these message using something like  - grep -p "Feb 15.*From: <>" mail_logs