Where Message Tracking logs are saving in Cisco Ironport C170

[Fares7]

Dears 

I have Cisco Ironport C170  which is retired but it have some very important logs about email which I would like not to loose them by pushing them to our SIEM and get copy of them. 

I can find Message Tracking logs and search about any email but when I am searching in Log Subscription I do not find any logs have the same result as Message Tracking logs. Kindly support.  

[balaji.bandi · Accepted solution]

enable FTP from GUI and you can find the Logs folder.

https://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/118315-technote-esa-00.html

you can also download from GUI :

https://www.cisco.com/c/en/us/support/docs/security/cloud-email-security/215858-downloading-logs-from-the-gui-of-your-es.html

[Udupi Krishna. · Accepted solution]

Message tracking is an underlying database and its not in a log format that one can copy/export out of the appliance.

Mail logs is an equivalent to message tracking which is in a text format which also supports export however this data will be limited. Meaning every time there are new emails, new logs are written into this file and with the default config older log files may get rotated and you will not see the complete data.

[Fares7]

It is clear for me now that it will not be found in logs. I am trying to export them as Excel file but the problem is for the time column it is showing GMT but the correct time zone is GMT+3 which I can see it is correct when reviewing the report in Message tracking in the GUI. the issue is only in the exported excel sheet.