Video Screencast Help

Message Status Summary Drill Down Report - Employee Journaled Message Stats Summary

Created: 03 Feb 2014 • Updated: 25 Feb 2014 | 6 comments
This issue has been solved. See solution.

Is there documentation for the drilldown report within "Message Stats Summary"?  The drilldown report reads "Employee Journaled Message Stats Summary".  Specifically, I cannot reconcile the counts within "Received" and "Sent".  Thank you.

Operating Systems:

Comments 6 CommentsJump to latest comment

TonySterling's picture

There is this TN:

Message Stats Summary report

Article:HOWTO74903  |  Created: 2012-03-30  |  Updated: 2013-07-12  |  Article URL http://www.symantec.com/docs/HOWTO74903

and this for all reports:

Available Compliance Accelerator reports

Article:HOWTO58536  |  Created: 2011-08-01  |  Updated: 2013-07-12  |  Article URL http://www.symantec.com/docs/HOWTO58536

What is up with the count?  More than expected or something?

admin laura's picture

I did not perform a complete investigation to confidently comment if counts are consistently off more/less.  However, for two monitored employees the "Sent" count is lower than expected.  I could not find guidance if "Sent" count represents all messages authored by the employee regardless if captured for review or not.  When comparing the count listed, I find it does not tie to the number of messages authored by the employee within the review results nor to the total number of message authored exclusive of any searches.

Kenneth Adams's picture

The CA reports can only provide data for the messages that have been captured for review.  We don't have data for all messages authored by any given Monitored Employee.

Now, depending on the report and the criteria you provide during its creation, the report may only provide data on items that were reviewed during the date span provided, or it may only report on items that have been reviewed that were captured during that date span, or...

Can you provide a specific example of what you are seeing and what you are expecting (without providing specific Monitored Employee names, of course)?

Ken Adams

Backline Support for CA, DA, ACE, UCE, PSTD, ARMS, EVDC
US Support Region

admin laura's picture

I have attached two files with monitored employee and manager names redacted. 

File Message Stats Summary - Example2.pdf contains the report and a screen print from the Review Tab for same time frame; the counts are the same.

File Employee Journaled Message Stats Summary - Example.pdf contains the report and a screen print from the Review Tab for same time frame and Monitored Employee. From my review, I was unable to match the report count to Review Tab.

Please advise if more details or explanation are necessary.  Thank you.

AttachmentSize
Message Stats Summary - Example2.pdf 52.98 KB
Employee Journaled Message Stats Summary - Example.pdf 76.04 KB
admin laura's picture

Upon further review, the same issue exists with the Differential Sampling Summary report.  Although the counts are different, the total sampled amount is consistent.  As I understand, our firm's searches are  based on key words and do not utilize random sampling or guaranteed sampling.  I could not readily determine from the documentation if this report assumes random and/or guaranteed sampling.  I have attached a redacted copy of Differential Sampling Summary report which includes a reference to Employee Journaled Message Stats Summary.

AttachmentSize
Differential Sampling Summary - Example2.pdf 42.8 KB
Kenneth Adams's picture

When I look at HOWTO61052, "Differential Sampling Summary by Department Report" (http://www.symantec.com/docs/HOWTO61052), I read that this report's data depends on the use of the Guaranteed Sampling Search and Random Sampling to capture messages for review.

We have 2 modes of Random Sampling (also called Random Capture).  The default mode is Guaranteed Sampling.  The alternate mode is Statistical Sampling.  Both of these sampling modes require the Journal Connector (JC) to be installed and properly configured to process journal archiving messages.  The JC looks at every message that is in the journal mailbox just before each message is sent to the archiving process.

Guaranteed Sampling causes the JC to tag items with the appropriate Department Tag for each Department to which the message author and / or recipient(s) belong.  The JC then passes certain information for each message to the CA Customer database in an XML file that contains up to 10,000 messages (this is a configurable number).  Guaranteed Sampling guarantees at least 1 item for each Monitored Employee will be in the review set, even if a Monitored Employee only sent or received 1 message during the previous day - all depending on the sampling percentages not being set to 0 and if the Monitored Employee is not suspended from sampling.

Statistical Sampling causes the JC to do the same Department Tag processing, but also causes it to randomly pick the messages to be sampled.  Only those messages the JC picks to be sampled will be added to the XML file that is passed to the CA Customer database.  Statistical Sampling does not guarantee that all Monitored Employees will have items to be reviewed.  For example, if a Monitored Employee only sent or received 1 message during the previous day AND the sampling percentages for inbound or outbound messages is 10%, then 10% of 1 is too small of a number for Statistical Sampling to consider sufficient, so that one item would not be included in the review set and that Monitored Employee would not have anything to be reviewed.

When the Random Sampling processing runs, which is 1:00 AM CA server time by default, items are moved from holding tables in the the database and put into the individual Department review sets.  If Statistical Sampling is the chosen mode, then all items that have been passed to the database during the previous day will be put into the review sets.  If Guaranteed Sampling is the chosen (default) mode, then all items in the holding tables will be parsed and a random set of messages will be chosen in the amounts needed to satisy the sampling percentages required for each Department and Monitored Employee.

In reviewing your "Employee Journaled Message Stats Summary - Example.pdf" file, I see where you may be confused.  Your screen shot is pointing to the Direction facet where it shows 153 for External Outbound messages, the Capture Method of Search with 154 items AND having the Author of Employee 1.  What we can't see is if the searches used to capture the 153 external outbound messages ran against archives other than just the journal archive.  From what we see, this report is only showing items captured by the Policy Engine, Random Sampling and Guaranteed Sampling Search processing, not through scheduled or immediate search processing.

In reviewing your "Differential Sampling Summary - Example2.pdf" file, I see where this report only includes items that were captured by the Policy Engine (0 items), Guaranteed Sample Searches (0 items) and Random Sampled items (28 items) out of a total of 958 items for Employee 1.  This report does not include any items captured by any scheduled or immediate searches.

As the numbers in the "Employee Journaled Message Stats Summary - Example.pdf" file and the "Differential Sampling Summary - Example2.pdf" file match, I believe both reports only show information on items captured by the Policy Engine, Random Sampling and Guaranteed Sampling processing - not through any scheduled or immediate searches.

 

 

Ken Adams

Backline Support for CA, DA, ACE, UCE, PSTD, ARMS, EVDC
US Support Region

SOLUTION