The Message Log is a log of all inbound and outbound messages that are sent to and from your domain(s), regardless of whether they were delivered. Each time an attempt is made to send mail to or from your domain(s), it is recorded in the Message Log. For example, if a message sent to your domain is deferred, it appears in the Message Log as Not Delivered. If and when the sending server retries this message, a new entry appears in the Message Log. The original entry and delivery status in the message log does not change. A new entry appears each time. Therefore, there might be multiple entries/attempts to deliver the same email and each of these entries might have a different delivery status and different message ID.
The Message Log is a window into how the current spam, virus, and policy settings are filtering email coming through the Barracuda Email Security Service. Use the information in the log to help tune your inbound and outbound policy settings.
Note that messages expire after 30 days. Initially the reading pane is hidden by default, enabling you to quickly scan through messages.
Sort messages using the Advanced Search feature to quickly view email by allowed, deferred, quarantined, encrypted (outbound), or blocked messages by domain, sender, recipient, time range (last 2- 30 days), envelope to, envelope from, reason, action taken (see Message Actions), date or subject. The Message Log reflects all email traffic through the Barracuda Email Security Service at the global level. If you click on a verified domain on the Domains > Domain Manager page, a tab for the Message Log for that domain displays. Additionally, you can track end-user quarantine notifications in the Message Log.
Filter the Message Log
When viewing the global Message Log, you can choose to view only Inbound or only Outbound mail using the Message Log Filter. You can filter on All, Allowed, UI Delivered, Email Continuity, Not Allowed, Blocked, Deferred, or Quarantined messages. For details on each of these actions, see Message Actions.
The User Message Log is less comprehensive than the global, administrator's Message Log. For example, users cannot see outbound mail in their Message Log. For more information about viewing and filtering messages, click Help on the Message Log page at the global level or after logging into a User account.
Create Saved Searches
You can save a search so it is convenient to use in the future.
To create a saved search:
- Do one of the following:
- Enter a search term in the Search box, then click Search.
- Click Advanced Search, enter one or more search terms, then click Search.
- Click Saved Searches. In the blank space, type a name for your search, then click Save. Confirm you see the search you just created in the list.
- When you are ready to run a saved search, click Saved Searches, then click the name of that saved search.
To delete a saved search, in the Saved Search panel, click Remove.
Spam or Not Spam
Occasionally the Barracuda Email Security Service may incorrectly identify a piece of mail as Spam (false positive) or Not Spam relative to the policies you have set. You can tune the Advanced Spam Detection Scoring levels on the Inbound Settings > Anti-spam Antivirus page by selecting Custom and adjusting the score for each category based on what type of mail you consider to be spam.
Use the Spam and Not Spam options on the Message Log page (both at the global level and the user account level) to mark a message as such. Those messages are then sent to Barracuda Central for analysis.
Deliver Messages to Recipient
You can click Deliver for one or more selected messages in the Message Log if you decide the message is valid.
- If a message is successfully delivered, a new message entry appears in the Message Log with the Delivery Status of UI Delivered.
- If a message cannot be delivered, you are notified by a message in your browser. A new message entry appears in the Message Log with the Delivery Status of Not Delivered.
If delivered messages are not making it to the recipient's mailbox, it may be due to a filter on your mail server or a service on your network catching the mail as spam. Check your local trash/spam folder to locate the mail.
Click on a message in the table, and click Show Details in the message header to view additional information including IP address, recipients, action, reason, and delivery status. The administrator (or user, when viewing their own account) can then elect to View the entire message and take actions on the message.
Investigating and Remediating Emails
If you find a questionable email in the message log, you can move seamlessly from Barracuda Email Security Service to Barracuda Forensics & Incident Response to investigate it.
To find messages similar to the questionable email:
- Log into Barracuda Email Security Service as an administrator.
- In the Message Log, find the questionable email and click it to view its details.
- Click Search for similar messages. The Barracuda Forensics & Incident Response wizard opens in a new browser tab.
- Continue with the wizard, as described in Using the Barracuda Forensics & Incident Response Wizard. Note that the fields in the wizard are pre-populated with the information from the email in the message log.
With Barracuda Forensics & Incident Response, you can find similar emails, then if needed, take action to remediate any issues, including removing emails from users' mailboxes and creating policies to block senders. Refer to Barracuda Forensics & Incident Response Overview for details.