Messaging Gateway

We obviously have 2 scanners (otherwise this would be trivial :) and one control center. Both scanners can handle incoming and outgoing mail.

Is there a way to see how much incoming mail is processed by each scanner? All I was able to find is the Inbound summary in the dashboard, which does not distinguish which scanner it was received on. Nothing in the reoprts, as far as I can tell.

Basically what I would like to be able to do is monitor to see if our incoming mail actually gets reasonably well balanced between the two scanner appliances.

Here's to hoping that someone else has already tried this :)

We are running on V 9.0.0-20
Scanners are 8240, Control Center is 8360

Thanks,
Karl

Per box, local - monitor mta  might help.  I use an SNMP tool and monitor interface traffic.  Neither will give you the same information that the dashboard does.  monitor does report inbound and outbound separately.  No easy way to get monitor off box - you can log to disk (/tmp/output.txt), but you can't pull the log using scripts via admin account, and of course support times out.

You can get this data from the Message Audit logs.
Just do a search for a wildcard * and then export to CSV and it will show which host the mail passed through.

Would be nice if it was something you could get out of the GUI though...

Slow, and inaccurate if you get a lot of mail.  And remember that message audit logs are limited to 1000 records per MTA.  Doesn't scale over time or workloads.

I am not sure why Symantec wouldn't have included taht in the Dashboard, the Control Center is specifically set up to monitor multiple scanners, and you would think people would be interested in how well balanced their setups are..... but then again, we don't get any historical CPU reporting either, just little snapshots.

We are now monitoring SNMP, which at least gives us some historical data and shows if / when things behave in an unusual manner, but I would have liked to just grab that info from the Dashboard.

Symantec, this could be added to the wishlist :)

zer0, wildcard searches in Message Adit Logs have never worked for me, I have tried before with variations (how many e-mails do we get from domain xyz.com, but Sender  *@xyz.com yields no results) Am I doing somehting wrong?

Thanks,
Karl

Karl - I have the same issue with message audit logs.  If can search on @example.com and get 200 records and then search on Bob@example.com and get 210 rows (for a non-current time period, so it's not "new" mail).

We use SNMP for historical and more complete alerting - we are tracking queues - in / out / delivery - deferred & queued, memory usage, disk: boot, data, opt, swap,  5/10/15 min load average, interface traffic in/out KBs for each i/f, CPU - User/Sys (we are using the raw counters, as the managed counters are "sticky" - there is an open defect on this).

I'm interested in what useful MIBs you have found.

Hey phhowe17,

Well at least I learned something form all of this, I always tried actually using a wildcard (* or %) to search, seems that Brightmail inserts those automatically, so @xyz.com gets results, while *@xyz.com doesn't. Unexpected bonus.

As to useful MIB's, we tried all the OID's listed here but besides the Queue counters they really didn't work for us. Mostly rely on the built-in CPU counters and the NIC monitors.

Thanks,
Karl

Always wondered why that was a image and not a text table.

wouldn't want to make things too easy, I guess.