Enable URL Logging on Email Security Appliance (ESA)

Introduction

This document describes how to enable URL logging in URL Filtering to display URL details in Mail Logs and Message Tracking.

Prerequisites

Requirements

Cisco recommends that you have knowledge of these topics:

• The Outbreak filters feature must be enabled globally.
• Message and Content filters must have an action configured based on URL reputation or category in order to enforce acceptable use policies.

Components Used

The information in this document is based on these software and hardware versions:

• Cisco Secure Email Gateway Asyncos version 16.x
• URL Filtering
• Outbreak Filters
• Content and Message Filter

The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, ensure that you understand the potential impact of any command.

Problem

URL details do not appear in Mail Logs/Message Tracking.

Cause

URL logging is disabled by default in the URL Filtering advanced settings. URL log entries are generated only when URL Filtering is enabled and a policy action triggers URL scanning (for example, a content or message filter condition based on URL reputation or category).

Environment

ESA with URL Filtering is enabled.

Solution

Enable via CLI

The websecurityadvancedconfig command includes an option in order to enable URL logging.

1. Run the command websecurityadvancedconfig.
2. At the prompt 'Do you wish to enable logging of URLs?', enter Y.

esa01.example.com> websecurityadvancedconfig

Enter URL lookup timeout in seconds:
[15]>

Enter the maximum number of URLs that can be scanned in a message body:
[100]>

Enter the maximum number of URLs that can be scanned in the attachments in a message:
[25]>

Do you want to rewrite both the URL text and the href in the message? Y indicates that the full rewritten URL will appear in the email body. N
indicates that the rewritten URL will only be visible in the href for HTML messages. [N]>

Logging of URLs is currently disabled.

Do you wish to enable logging of URL's? [N]> Y

Logging of URLs has been enabled.

Enable via GUI

1. Navigate to Security Services > URL Filtering.

2. Under Advanced Settings, choose the Enable radio button next to URL logging.

Verification

1. In the ESA web interface, choose Monitor > Message Tracking.

The URL details will be displayed in the Message Tracking interface under the URL Details tab. This tab shows information such as the reputation score or category of the URL.

2. Example of a log line from the mail_logs:

Tue Jun 23 12:38:25 2026 Info: MID 13559 URL https://yahoo.com has reputation 6.2 matched Condition: URL Reputation Rule

Revision History

Revision	Publish Date	Comments
1.0	27-Aug-2026	Initial Release