Monitor search not showing email that is in logs

[forlorn1_ironport]

Ironport X1050, v6.1.0-306

Using the Monitor->Incoming Mail search feature

Looking for messages from a particular domain, that have arrived today.
Selecting Time Range : Day
Data in time range: 100.0 % complete

and then searching for the domain name of the sending host (agencymail.com) , yields a screen that says basically "no results"

Yet the mail is logged on our syslog server.

Any idea why the search feature doesn't seem to work on this domain name, but does for some other domains?

Is it a threshold thing? We are looking for a few dozen emails in the millions that we get daily?

Jeff

[steven_geerts]

Hi Jeff,

As far as I know the search GUI only displays accepted (and afterwards delivered) messages. Can you collect the info that is in your log and post it to give some insight in what has happened with the message?

the most convenient way to do this is using the "FINDEVENT" command on the MGA's command line interface.