How to extract an email from archive mbox logs on the Email Security Appliance?

Introduction

This document describes how to extract an email from archive logs created by the Email Security Appliance (ESA).

How to extract an email from archive mbox logs on the ESA?

1. Retrieve the archive mbox log you would be extracting the email from. How to retrieve the archive mbox is available in the provided article. (https://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/118315-technote-esa-00.html)
2. Open the archive file using text editor. The examples below are shown using Notepad++.
3. Identify the email you would like to extract out of the archive log. Each email in the archive will begin with From <address>.
4. Copy contents of a single email to a new text file and save it as .eml extension.
5. Open the extracted email in your mail client, such as Outlook to view the contents. 

Note: An archive mbox log may contain multiple emails.

Sample email source within the archive log:

Sample email extracted and opened in Outlook:

Related Information

• Cisco Email Security Appliance - End-User Guides
• Technical Support & Documentation - Cisco Systems
• What is UNIX mbox (mailbox) format?
• Where are logs stored on the Cisco Email Security Appliance (ESA) and how do I access them?
• How to archive emails on the Email Security Appliance (ESA)