Messaging Gateway

Hi,

I have started using symantec messaging gateway 1 month back to filter outgoing and incoming mail. I know that message audit log exist and allows you to check whether a mail has been delivered or not. The problem though is that when I set up the symantec messaging gateway, messages were kept for only 2 days; I have now changed it to 7 days. What is the ideal number of days?

My problem is that a user asked me to check whether his mails sent on 5/03/13 and 26/02/13 were successfully delivered. I cannot do so with the message audit log. Can you please tell me how I can do that? Is there a way to keep the log, even if need copy from Symantec messaging gateway?

Thanks a lot,

Arvind

There is not an ideal number of days. Typically you do don't want to keep much more in the audit logs as it can consume lots of drive space and possibly a performance hit. Typically the audit log is used to troubleshoot filtering, flow issues currently happening not as a historical record. If the SMG cannot send a message it will send a warning it was delayed, then once it fails it will send an NDR.

You may want to consider sending Message Audit Log entries to a syslog server. This can be done under the Administration -> Logs -> Remote tab.

We keep 30 days on the control center.  But agree that using a syslog server would help if you have a longer retention.

How can I have access to the logs that are kept for 30 days? I need logs of specific days. Please help thanks!!!

If you want a longer storage time than the default 2 days, you would do this via the logs configuration page:

Administration > Logs > Message Audit Logs : Days to store log data before deleting

It may be best to increase this incrementally. Depending on your hardware, number of scanners, and mail flow, increasing the time that Message Audit Logs are stored can have a negative impact on searching the Message Audit Logs over time.