Looking for "bad" events in mail_logs

[sherane_ironport]

Hi,

We have a C100, and once in a while I have to go through the mail logs to look for certain events. Is there a documentation that lists the keywords that I can look for to find out if certain messages were rejected becasue of any number of reasons - such as the attachment size was too large, the recipient address is invalid, server is blacklisted, etc...

Also, some comcast.net email users are saying that they are getting a bounce back saying "size exceeded limit"; however, when I search the mail logs for any "from" entries with their comcast.net emails address, nothing shows up. However, I do see a bunch of "reject sg blacklist" from comcast.net servers around that date/time. I realize that a lot of comcast.net mail servers are blacklisted. Is it possible that when the connection is rejected because of a blacklisted server (due to low SBRS) that the bounce back will read "size exceeded limit"? Do senders even get bounce backs when the email server connection is rejected?

Thank you. :)

[tminchin_ironport]

With your size exceeded error messages - if you look at the THROTTLED sender policy settings you will see that if Comcast goes into that group (from having a negative Senderbase score) they not only get rate limited to one message per hour, they also have a smaller maximum message size limitation.

There's probably not much point throttling their message size* - so change it to whatever your normal accepted size is.

* happy to hear any reason as to why