Greetings,
550 5.3.4 SMTPSEND seems to be a Microsoft thing:
https://social.technet.microsoft.com/Forums/en-US/1121a4f4-c1ea-4744-b1a9-5306303030bb/requested-550-534-smtpsendoveradvertisedsize-message-size-exceeds-fixed-maximum-size?forum=exchangesvrsecuremessaginglegacy
If that is truly the case, then I assume the message indeed passed by your C170.
I recommend you to:
a) Use Message Tracking and search for From and To and Subject. You can also search by the attachment name, but if you know the sender email address and the recipient email address and the subject of the message, then you have a good start.
Once you find the exact message you are troubleshooting, you will have a better view of why and if the message passed through.
Keep in mind that a message will grow in size, aproximately 37% when being scanned by AsyncOS. That is based on my experience. You will need to contact Cisco TAC for a definitive answer on this.
So, if the message passed, you will know and if the message was stopped, you will know as well.
I honestly prefer the CLI and commands like findevent and grep for this kind of troubleshoot. You can also export a copy of Text Mail Logs to an external server, via SCP, FTP and/or SYSLOG. From that server than, you can use the full power of text searching from grep, sed, awk, sort, unique and may other tools.
To answer you question directly, yes, tracking (and CLI search to mail_logs) will have info about message size and an action that the system took on it.
Hope that helps.
P.S. Althouh I am sure Enginners from Cisco TAC will be assisting with this forum, as well as many other folks that have experience with the product, I highly encourage you to contact Cisco TAC should you have an important/critical issue in your hands.
Warm regards,
-Valter
