message filter BCC all mail to test device missing half the mail

[SanityCheck]

I've set up a message filter to bcc all mail to a secondary device for testing. I want to get all mail (including spam, viruses, spoofs, *everything*) preserved to test different approaches.

The message filter is set as follows:

if (true) {

bcc ("$EnvelopeRecipients", "$Subject", "$EnvelopeFrom", "[IP of test appliance]");
          }

This seems to be incorrect as the test appliance is only getting somewhere between a third to a little under half the emails the primary device is reporting for incoming mail. Is this the appropriate approach? What am I doing wrong?

Edit: Would the BCC copy generated by the message filter show up on the overview incoming mail graph? Is the number of incoming mail being inflated by these duplicates (hence a dramatic increase in "clean" messages but no apparent increase in spam)?

[marc.luescherFRE]

Is this filter set as the first one on the CLI level of your ESA ?

[SanityCheck]

Yes

[Libin Varghese]

The filter appears to be correct and should match all emails since there are no specific conditions.

What are the emails you do not see processed by this filter?

Only emails missing this should be emails rejected at the connection level such as sending servers with poor reputation, invalid recipients rejected by LDAP, etc. 

Regards 

Libin Varghese 

[SanityCheck]

I don't have any particular messages which are not being sent through, just looking at the raw numbers recorded. The live ironport's overview graph of incoming mail shows more than double the number of incoming mail show by the test appliance.

Could it be that the BCC duplicates created by the message filter are counted separately for the incoming mail graph and overview summary?

[Libin Varghese]

Since the bcc emails are generated by the ESA they should not be counted as incoming mail on the reports. 

However, emails with 3 recipients are counted as 3 emails in the report from what I recall.

Regards

Libin Varghese