Hi,
The TLS configuraiton guide has examples on how the logs appear for TLS success and failure.
https://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/118844-technote-esa-00.html
You can use the below grep command to look for TLS failures.
grep "TLS failed" mail_logs
To redirect emails from one device to another you can use multiple methods such as command "redirectrecipients" or by adding a single SMTP route for all other domains to point to the other ESA.
However, you would need to take care the second ESA has the IP for the first ESA added to its Relaylist, without which the emails would be rejected when they get redirected there.
Regards,
Libin Varghese
