How do I search and view the mail logs on the ESA?

Available Languages

Updated:October 10, 2014

Document ID:118552

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Document ID: 118552

Updated: Oct 10, 2014

Contributed by Cisco TAC Engineers.

Download PDF

Introduction

How do I search and view the mail logs on the ESA?

Introduction

This document describes how to search for log entries that show how the ESA (Email Security Appliance) processed a message.

How do I search and view the mail logs on the ESA?

You can search the logs to gather more information about the From, To, Subject of the emails coming from this IP address that you're interested in.

The name of the log is mail_logs. You can see this in the System Administration > Log Subscriptions > mail_logs.

There are several ways to access these logs.

Via the web browser.
- Go to System Administration > Log Subscription.
- For the mail_logs, click on the ftp link to the right of mail_logs.
- If it gives you an error, go to Network > IP interface, select the interface that you normally access to the ESA on and turn on the FTP/port 21 service.
From the command line:
- Using a ssh client like Putty, log onto the CLI of the ESA appliance via port 22/ssh.
- From the command line, use grep to search for the IP.
- You will need to enter the # associated to your appliance's mail_logs, then enter the pattern to search, ie. 192.168.1.1 or joe@example.com.
- For the next three questions, press enter and keep the defaults.
The search might take a bit of time to complete. Once the output comes back, you can search either the ICID or the MID.
```
grep "ICID 123456" mail_logs
```
Once the output comes back, you can search for the MID
```
grep "MID 78901234" mail_logs
```
You should be able to see the From, To, Subject from the MID. You should see the IP address and the HAT Sender Group from the ICID.
Another option is to ftp the mail_logs to a local machine (Desktop) and use your own file/text editor to search for the IP addresses.