Filtering the Message Log

Use simple search to run a fast search based on a word, search pattern, or phrase.

Use advanced search to further filter or search for specific messages.

Simple Search

1. Under Domains, select All domains or the desired domain.

2. Under Direction, select either Inbound or Outbound.

3. Under Date Presets, select Last 1 day, Last 2 days, Last 1 week, Last 2 weeks, or Last 1 month.

4. Under Action Taken, select Any, Allowed, Blocked, Deferred, Quarantined, or Encrypted.

5. Under Delivery Status, select Any, Delivered, Not Delivered, Deferred, Rejected, or Spooled.

6. Under Reason, select the reason for messages with actions taken. For a description of reasons, see Message Actions. Example:

7. Enter a whole (not partial) word, search pattern, or phrase in the Search box in the form described below. Using the field name is not necessary, but narrows the search. So, for example, if you search on myaddress@example.com, the From, To, and Subject fields of the message are all searched.

   • IP_address
     Example: ip:10.1.1.1

   • Message_id
     Click on the message, and click Show Details to find the message_id. Use this format in the Search box: message_id:
     Example: message_id:1374102064-320627-22657-10347-7

   • Attachment filename
     Use this format in the Search box: attachment:
     If the attachment filename contains spaces, you can represent the space with %20 or enclose the filename in single or double quotation marks.
     Example: To search for an attachment titled Blue Skies.txt, type any of the following:

     • attachment:Blue%20Skies.txt or

     • attachment:"Blue Skies.txt" or

     • attachment:'Blue Skies.txt'

   • Spam
     This filter operates on messages determined by Email Gateway Defense to be Spam. To display messages identified as Spam, enter this in the Search box: filter:spam

   • Envelope_from
     Example: envelope_from:myaddress@example.com or myaddress@example.com

   • Envelope_to
     Example: header_to:myaddress@example.com or myaddress@example.com

   • Subject
     Example: subject:Tomorrow or Tomorrow

   • Score_lt(e)
     Example: score_lt:5.2 lists all messages where the score is less than 5.2.
     Example: score_lte:3.0 lists all messages where the score is less than or equal to 3.0.

   • Score_gt(e)
     Example: score_gt:6.8 lists all messages where the score is greater than 6.8.
     Example: score_gte:2.5 lists all messages where the score is greater than or equal to 2.5.

   • Size_lt
     Example: size_lt:500 lists all messages where the size, including attachments, is less than 500 bytes.

   • Size_gt
     Example: size_gt:1000 lists all messages where the size, including attachments, is greater than 1000 bytes.

   • Delivery status
     Delivered, Deferred, Not_Delivered, Spooled. Use this format in the Search box: delivery_status:<delivery status>
     Example: delivery_status:deferred

   • Reason_extra
     Example: reason_extra:machine lists all messages tagged with "machine learning".
     Example: reason_extra:domain identify policies that have been configured at the domain level.
     Example: reason:extra:origin<country> lists all messages blocked by GeoIP settings. For countries with 2 names, connect with a dash.

     • reason_extra:origin:russia

     • reason_extra:origin:north-korea

     • reason_extra:origin:the-netherlands

8. Press Enter to start your search. All fields are searched based on your criteria, so you may get a larger set of messages returned than you wanted.
   Note that the display time zone is based on the Barracuda Cloud Control administrator account settings.

   • Use the My Profile > Time Zone Details in Barracuda Cloud Control to set the time zone for an individual user’s account.

   • Use the Admin > Options > Time Zone Details in Barracuda Cloud Control to set the time zone for all administrators and end users in this account.

Advanced Search

To further filter or search for specific messages, click the advanced filter search button to display the Advanced Search options. To hide these options, click Cancel. Click Save to save your search. Click Open to open a saved search.

Select or enter a word or phrase to search on in one or more of the following fields, then click Search.

• Keywords
  Relevant words or phrases to search for.

• From
  Sender email address (this may not match the address in the headers that mail clients display to an end-user).

• To
  Recipient email address(es).

• Envelope From
  This is the (sender) email address to which bounce messages are delivered. This field is also sometimes known as envelope from, envelope sender, MAIL FROM, return address, and other names. All of these names refer to the email address found by the SMTP MAIL FROM command. The Envelope From field contents are generally not seen by the email user.

• Envelope To
  The real destination email address.

• Subject
  Messages where any portion of the "Subject:" field contains the specified text.

• Start Date, End Date
  Use to limit date/time range of message search results. Examples:

  • To view 10 minutes of results
    Start Date: 2016-10-01 12:00am    End Date: 2016-10-01-12:10am    Returns messages from 12:00 AM through 12:09 AM, not including 12:10 AM.

  • To view a 7 day range
    Start Date: 2016-09-24 12:00am    End Date: 2016-10-01 12:00am

  • To view yesterday's messages through today
    Start Date: Yesterday   End Date: blank   (leave the End Date field blank)

• Attachment
  Attachment file name.