Showing results for 
Search instead for 
Did you mean: 

Message tracking display and reporting


I am newish to the email appliance. We have a c370.

I am told we need reports daily detailing each email address leaving the ironport each day.

If we could also see the sending address that would be great.

message tracking seems to have this information but there are two problems:

1. it only lists 250 items.

2. i cannot  schedule this report?

Any ideas as to the 2 items?

Everyone's tags (3)

You are correct, this is not

You are correct, this is not possible because:

- Tracking can show only up to 1000 items.
- It is not possible to schedule Tracking searches.

There is an Internal Users Report that tracks how many clean/threat messages for each user.  However, these are just counters and will not show the details for each message.  I'd still suggest looking over that page (from Monitor tab) to see if it meets your needs.

So the only other suggestion I can offer is manually parsing the mail_logs each day for all the required data.  Sorry.

- Jackie


Message Tracking and reporting

May I know is current version have this request resolve?


- Possible the tracking "export all" can export more than 100,000 items?
- It is not possible to schedule Tracking searches and send/archive the report?

Cisco Employee

Re: Message Tracking and reporting

You can find more details on the tracking search behavior within the User Guide(s) under the 'Working with Message Tracking Search Results' section. Currently, you can export up to 50,000 events (not necessarily messages - could be less than 50,000 if some messages have been re-written causing new MIDs to be formed). You're also not able to schedule tracking reports, so they need to be done manually. 



-Dennis M.


Re: Message Tracking and reporting

Hi, I have read the KBA as post, but it still not able to answer my query.

I try to download 100k message events but seem like I can't. Is there CLI command that i can export out the message events to a .csv? (Not from Mail_logs)

Cisco Employee

Re: Message Tracking and reporting



As I previously mentioned, (up to) 50,000 is the max number of events you're going to be able to export. So, what you're asking for is not currently possible. 


Your best bet would be to start pushing off the mail_logs via SCP/Syslog/ETC and then performing searches on those logs.



-Dennis M.

CreatePlease to create content
Content for Community-Ad
FusionCharts will render here