CSC SSM How do I track blocked email?

[kevand]

I have an ASA 5510 with the CSC-SSM module. We get alot of people telling us they sent us email though I do not know how to check to see what email has been blocked. In Exchange server I can verify exactly when any email hit the server and what the server did with it, i.e., blocked, sent to email box, etc. Is there a similar feature that I can access and if so, how? Thanks! Kevan

[Panos Kampanakis]

In the CSC GUI page you can go under logs and set it up to log for emails and send the logs to a syslog server. That you tell you what the CSC blocked. The emails cannot be retrieved because they are not stored anywhere.

Also you can go under SMTP and Flag the messages that are caught for various reasons and thus set filters in exchange to block them and be able to r4etrieve them.

I hope it helps.

PK

[Kureli Sankar]

Do you have the following configured to notify the administrator?

http://www.cisco.com/en/US/docs/security/csc/csc63/administration/guide/csc6.html#wp1041550

Once done follow this link below and configure notification for SMTP and POP3.

http://www.cisco.com/en/US/docs/security/csc/csc63/administration/guide/csc3.html#wp1041177

These blocked messages will be sent to the administrator.

-KS