Every so often I hear about a case where an administrator is looking for auditing of Control Center Quarantine administration or other configuration events. Generally, there is some surpise when they are told that the Control Center does have an audit log for such administrative events. Since log reviewing is a core part of security, I do recommend taking a look at the Brightmail Admin Events log and familiarizing yourself with the types of data it contains.
To access the Brightmail Admin Events log from the Control Center: 1. Click on Status. 2. Click on System | Logs in the left pane. 3. Change the Component to Control Center. 4. Change the Log type to Event Logs. 5. Set the Time Range to desired length. 6. Click on Display. Here is an example of the things you will see in the Brightmail Admin Events:
Nov 23 2011 08:55:53 - Messages older than 2011-11-23 02:55:53 have been released. User: HOLDING_QUEUE_EXPUNGER. Nov 23 2011 09:33:59 - User 'admin' session has timed out. Nov 23 2011 09:55:53 - Messages older than 2011-11-23 03:55:53 have been released. User: HOLDING_QUEUE_EXPUNGER. Nov 23 2011 10:05:11 - An administrator 'Logs Admin' has been changed by admin. Nov 23 2011 10:05:23 - User 'admin' has logged out. Nov 23 2011 10:05:45 - User 'admin' has logged in. Nov 23 2011 10:06:09 - User 'admin' has logged out. Nov 23 2011 10:06:19 - User 'logs admin' has logged in. Nov 23 2011 10:07:18 - The Log settings have been updated by Logs Admin. Nov 23 2011 10:07:27 - User 'Logs Admin' has logged out. Nov 23 2011 10:07:39 - User 'quarantine admin' has logged in. Nov 23 2011 10:07:58 - Released 0 messages in spam quarantine. User:Quarantine Admin. Nov 23 2011 10:08:19 - The message 'Undelivered Mail Returned to Sender' was viewed by Quarantine Admin. Nov 23 2011 10:09:34 - Released 0 messages in spam quarantine. User:Quarantine Admin. Nov 23 2011 10:10:30 - Released 1 messages in spam quarantine. User:Quarantine Admin. Nov 23 2011 10:10:34 - Deleted 1 messages in spam quarantine. User:Quarantine Admin. Nov 23 2011 10:10:39 - User 'Quarantine Admin' has logged out.