How do I search and view the mail logs on the ESA?

Introduction

This document describes how to search for log entries that show how the ESA (Email Security Appliance) processed a message.

How do I search and view the mail logs on the ESA?

You can search the logs to gather more information about the From, To, Subject of the emails coming from this IP address that you're interested in.

The name of the log is mail_logs. You can see this in the System Administration > Log Subscriptions > mail_logs.

There are several ways to access these logs.

1. Via the web browser.
   • Go to System Administration > Log Subscription.
   • For the mail_logs, click on the ftp link to the right of mail_logs.
   • If it gives you an error, go to Network > IP interface, select the interface that you normally access to the ESA on and turn on the FTP/port 21 service.
2. From the command line:
   • Using a ssh client like Putty, log onto the CLI of the ESA appliance via port 22/ssh.
   • From the command line, use grep to search for the IP.
   • You will need to enter the # associated to your appliance's mail_logs, then enter the pattern to search, ie. 192.168.1.1 or joe@example.com.
   • For the next three questions, press enter and keep the defaults.

   The search might take a bit of time to complete. Once the output comes back, you can search either the ICID or the MID.

   grep "ICID 123456" mail_logs

   Once the output comes back, you can search for the MID

   grep "MID 78901234" mail_logs

   You should be able to see the From, To, Subject from the MID.  You should see the IP address and the HAT Sender Group from the ICID.

3. Another option is to ftp the mail_logs to a local machine (Desktop) and use your own file/text editor to search for the IP addresses.