Message Log

Administrator Help | Forcepoint Email Security | Version 8.4.x

The Message Log records information about each email message (inbound, outbound, and internal) processed by the email system. Access the Message Log on the Main > Status > Logs page.

You can configure the number of entries per log page, between 25 and 200, in the Per page drop-down list in the log table banner. At the top and bottom of the page, scroll through Message Log pages by clicking the back and next arrows, or enter a specific page number in the Page field and click Go.

The length of time message records are saved in the database depends on your message volume and database partition capacity. To preserve message records, use the Export option to export the log on a regular basis. Exporting does not remove records from the Message Log. It copies log data to a CSV or HTML file.

When the Message Log page appears, the most recent records are shown. Use the View from/to fields to specify the date/time range for the log entries you want to see. The calendar includes the following options:

Change the month and year by using the back and next arrows around the month and year at the top of the calendar.

Set the calendar to the current date by clicking the date in the lower left corner of the calendar.

Click Clean to clear the current date/time calendar selection.

Click Today to set the calendar date to today's date.

Set the time range in hours and minutes in the entry fields to the right of the calendar.

Message Log data

The following message data is collected and displayed in table format:


Message Data Item	Description
Message Log ID	A database-generated message identifier
Received Date/Time	The date and time a message was received
Subject	The message subject
Sender Address	Message sender email address
Sender IP	Message sender IP address
Recipient Address	Message recipient email address. If the message has multiple recipients, the first recipient address is displayed.
Analysis Result	Message analysis results or filter type (Clean, Virus, Spam, URL Analysis, Data Loss Prevention, Exception, Commercial Bulk, Block List, Phishing, Advanced Malware Detection - Cloud, Advanced Malware Detection - On-Premises, Email Attachment, Spoofed Email, or Custom Content). The Block List type applies to a message that is blocked by a Personal Email Manager Always Block List. When a data loss prevention (DLP) policy is indicated, a View Incident link in this column opens the incident details in the module.
Message Status	Current message status (Delivered, Delayed, Dropped, Exception, Failed, Waiting for delivery, or Waiting for message analysis). A message with multiple recipients may have multiple status entries based on the policy applied.

Message recipient details

When you click an individual message log identifier, details about that message are displayed. The following message detail items appear in table format:


Detail Item	Description
Recipient Address	Message recipient email address. If the message has multiple recipients, this column has multiple entries.
Recipient IP	Message recipient IP address
Direction	Message direction (Inbound, Outbound, or Internal). If the message has multiple recipients, this column may have multiple entries.
Delivered Date/Time	The date and time a message was delivered to a recipient
Policy	Name of the policy applied to the message. If the message has multiple recipients, this column may have multiple entries.
Rule	Name of the policy rule applied to the message. If the message has multiple recipients, this column may have multiple entries for a single message. This item is blank for a message with an analysis result of Clean.
Analysis Result	Message analysis results or filter type (Clean, Virus, Spam, URL Analysis, Data Loss Prevention, Exception, Commercial Bulk, Block List, Phishing, Advanced Malware Detection - Cloud, Advanced Malware Detection - On-Premises, Email Attachment, Spoofed Email, or Custom Content) The Block List type applies to a message that is blocked by a Personal Email Manager Always Block List.
Message Status	Current message status (Delivered, Delayed, Dropped, Exception, Failed)
Quarantined?	Indicator of whether message is quarantined (Yes or No). A View link appears for a message isolated by a DLP or advanced file analysis policy.

Message Log details

After you click a message in the Message Log ID column to view recipient details, a new View Log Details button is available at the bottom of the page. Message Log details appear in a table, with columns for the date and time of receipt, and the source of the message details. Detail sources can include message and connection control data, email policy data, and delivery data.

The log details appear in a third column, which can contain information about

Message size, sender, and recipients

Connection type, sender IP address, and the email appliance that received the connection request

Email policies and actions applied, including policy and rule names (filter and action), email direction (inbound, outbound, or internal), name of the virus or spam encountered, and the action taken as a result of filtering

Email hybrid service analysis results, including a DKIM validation, if applicable

Message delivery dispositions, including recipient email and IP address, and delivery status

When advanced file analysis is performed, a list of the files that cannot be analyzed because the file type is not supported

Message Log search options

The Message Log includes several search options, including date range or keyword searches. Determine the date/time range for a search by selecting dates in the View from/to field calendar controls. Default value for the from or to field is the date and time that you open the log.

You can perform a keyword search by selecting the log elements on which you want the search done from the Keyword search drop-down list and then entering a term in the field to the right of the list.

You can search for a keyword in 1 of the following Message Log components:


Keyword Search Option	Supported Keyword
Message Log ID	Enter the complete Message Log ID number. Wildcards (*) and non-numeric characters are not supported.
Subject	Enter any part of a message subject. Wildcards () are supported only at the beginning or end of a Subject keyword (e.g., subject, subject, subject*).
Sender Address	Enter a complete email address (e.g., sender@domain.com). Wildcards () are supported only at the beginning or end of an address (e.g., @domain.com, sender@, sender@domain*).
Sender IP	Enter a complete sender IP address. Wildcards () are supported only at the end of a partial IP address and only after a period (e.g., 10., 10.20., 10.20.30.). Non-numeric characters are not supported.
Recipient Address	Enter a complete email address (e.g., sender@domain.com). Wildcards () are supported only at the beginning or end of an address (e.g., @domain.com, recipient@, recipient@domain*).
Analysis Result	Enter any part of the message analysis result. Wildcards () are supported only at the beginning or end of an analysis result keyword (e.g., result, result, result*).
Message Status	Enter any part of the message status. Wildcards () are supported only at the beginning or end of a message status keyword (e.g., status, status, status*).

Use the All keyword search option to search using a combination of the following Message Log elements:

Alphanumeric characters are supported in the keyword search entry field.

Click Set to Default to return the keyword search options to the default settings (all Message Log components and keyword field blank).

View advanced search options for narrowing your message search by clicking Advanced Options to the right of the Keyword search box. Refine your search by selecting options in 1 or more of the following categories:


Category	Description
By Email Address	Click Specify Email Addresses to open the Specify Email Addresses dialog box. Specify your matching conditions, including email addresses and whether the address can be a sender, a recipient, or both. The search results include matches for any address you enter in the Condition Details box. Wildcard entries are not supported. Separate email address entries by a semicolon (;).
By Analysis Result	Search by message analysis results or filter type (Clean, Virus, Spam, URL Analysis, Commercial Bulk, Data Loss Prevention, Custom Content, Exception, Block List, Phishing, Advanced Malware Detection - Cloud, Advanced Malware Detection - On-Premises, Email Attachment, or Spoofed Email) The Block List type applies to a message that is blocked by a Personal Email Manager Always Block List.
By Message Status	Search by current message status (Delivered, Delayed, Dropped, Exception, Expired, or Failed)

Click Search to generate search results.

Click Set to Default to return all your search option settings to their default state.

Message Log export options

To export Message Log search results:

Click Export to open the Export Log dialog box.

Select the desired output file type (CSV or HTML).

If you select CSV, a dialog box opens to let you open or save a text file in comma-separated value format.

If you select HTML, a dialog box opens to let you open or save an HTML file containing the log data.

Indicate the pages you want to export (All, Current Page, or a page range).

Click OK.