Incoming Log Search
The Incoming Log Search is a comprehensive search tool which allows you to filter on all incoming messages over the past 28 days. In this page you can also access Quarantined messages, those that are in the Incoming Delivery Queue as well as those that are Archived.
To access the Incoming Log Search, in the Admin, Domain or Email level Control Panel, select Incoming > Logs.
Using the Log Search you can:
- Perform powerful filtering to find the results you need including:
- Filtering on message size and the From, To and CC headers
- Filtering on the outgoing IP used for delivering or attempting to deliver the message and the location of the sending server (based on the IP address) - See Run Custom Log Search
- Perform various action on single or multiple messages - See Actions Available on Log Search Results
- Customise available actions on specific messages - Add Customised Action Using Log Search
- Regenerate the index to search all archived message content - Regenerate Content Index
- Export archived messages - Export Archived Messages.
- Create and email a report of your log search results (and schedule at a specified frequency) - Create Email Scout Report.
Click on the classification link in the page description at the top of the log search to display the Classifications side-bar which shows more information on the classifications available:
In the Admin or Domain Level Control Panel, search incoming or outgoing logs by selecting Incoming > Logs or Outgoing > Logs
Query Rules Panel
The Query Rules panel allows you to customise your search filters. The default query rule for the Log Search is the Timestamp rule.
Use the shortcuts beneath the Timestamp filter to quickly select results from Yesterday, the Last week and Last month.
- Click on + New rule and select from the filter options available:
The Query Rules are constructed of three parts:
- The part of the message/metadata you are looking for - Select from the first dropdown in the Query Rules panel
- The type of match e.g. contains, does not start with etc. - Select from the second dropdown in the Query Rules panel
- The content you are trying to match
|Message Part||Match Type||Content|
||Text box; enter Message ID to search for|
||Text box; enter the Admin to search for and select from the drop-down|
||Text box; enter the domain to search for and select from the drop-down|
||Text box; enter Filtering Host to search for|
||Date and time selector|
||Text box; enter Sender address to search for|
||Text box; enter Recipient address to search for|
||Text box; enter Sender Hostname to search for|
||Text box; enter Sender IP to search for|
Text box; begin typing a country to see a list of pre-populated locations or type:
||Text box; enter number of bytes to search for|
||Text box; enter number of bytes to search for|
Text box; begin typing a message class or click to see a pre-populated list of suggestions split into:
||Text box; enter the Sub Class of a message to search for|
||Text box; enter Extra Class to search for|
||Text box; enter Error Class to search for|
||Text box; enter From address to search for|
||Text box; enter To address to search for|
||Text box; enter CC addresses to search for|
||Text box; enter Subject to search for|
|Original Message ID||
||Text box; enter the Original Message ID to search for|
Text box; begin typing a message Status or click to see a pre-populated list of suggestions split into:
||Date and time selector|
||Text box; enter Delivery IP address to search for|
||Text box; enter Delivery Hostname to search for|
||Text box; enter Delivery Port to search for|
||Text box; enter Delivery Data to search for|
||Text box; enter Delivery Interface to search for|
The Status of a message tells you what stage the message has reached in the filtering process e.g. rejected, queued for delivery, quarantined etc. To search for messages with a specific status, use the Status rule and tick the checkboxes of the statuses you wish to include.
Quick select options differ depending on the query rule selected, so check the options below the rule to see what is available at that time.
There are many options available, with the most popular choices outside of the defaults being:
- Main Class - How the message was classified which determines what happens to the message (e.g. temporarily or permanently rejected, for example, Spam).
- Sub Class - Why the message was given the Main Class that it was given. For example, if the message was classed as Spam, the Sub Class may be DNSBL (DNS Block listed).
- Delivery Data - Shows the destination mail server's most recent response to the filtering server's attempt to deliver. For example, if a message is accepted by the filter but can't be found in the recipient's Inbox, this field will show if the message was delivered to the destination mail server or not. To see all delivery attempts that have been made for a message, see the Delivery Details page.
- Status - Shows the current status of the message. For example, Delivered, Rejected, Quarantined, Queued etc. Note that Rejected includes both temporary rejections (where the sender will most likely automatically retry delivery later) and permanent rejections (where the sender will not automatically retry).
There are three options available for this:
- None - this will disable the summary row so nothing will be displayed
- Total - this will display a row at the bottom of the table which will calculate the total of any columns containing number values such as Bytes Sent and Bytes Received.
- Average - this will display a row at the bottom of the table which will calculate the average of any columns containing number values such as Bytes Sent and Bytes Received.
In the Search Results listed you can carry out a variety of actions. These differ depending on the status of the message, but include but are not limited to:
These options will also change, depending on the status of the message and whether you are on the Incoming or Outgoing Log Search page.
- Telnet SMTP Test - Run an SMTP test with the envelope sender and envelope recipient addresses of the selected message, to the destination server for the incoming domain.
- Sender callout - Run an SMTP test to verify the sender address is accepted on the destination server for the incoming domain. See What are recipient callouts/recipient verification?
- Recipient callout - Run an SMTP test to verify the recipient address is accepted on the destination server for the incoming domain. See What are recipient callouts/recipient verification?
- Add Sender to Allow list - Add the sender to the Allow list, causing all future messages from this sender address to be accepted by the filter. See Manage Incoming Sender Allow list
- Block Sender - Add the sender to the Block list, causing all future messages from this sender address to be treated as spam. See Manage Incoming Sender Block list
- Block recipient - Add the recipient to the Block list, causing all future messages to this recipient address to be treated as spam. See Manage Recipient Block list
- Add Allow list filtering rule - Add a custom incoming Allow list filtering rule. See Add an Incoming Allow list Filtering Rule
- Add Block list filtering rule - Add a custom incoming Block list filtering rule. See Add an Incoming Block list Filtering Rule
- Delivery issue log - See Delivery Issue Log
- Change Action for specific message - Incoming messages only - Add a custom action to incoming messages to change the response from Spam Experts, see Customise Actions
- Block sender and remove from quarantine - Remove the message from the quarantine and Block list the sender, causing all future messages from this sender address to be treated as spam. See Remove and Block list Quarantined Messages.
- Remove from quarantine - Delete the message from quarantine storage. See Remove Messages from Quarantine.
- Release from quarantine - Attempt deliver of the quarantined message. See Release Quarantined Messages.
- Release and train from quarantine - Submit quarantined message(s) to be delivered, and flag for training as not spam. See Release and Train Quarantined Messages and Report messages as Spam or Not Spam.
- Download Quarantined message - Download the email(s) as .eml format in a .zip.
- Compose reply - Reply to the sender of the message using the inbuilt using the Compose Email tool with the original message subject and recipient prepopulated.
- View email - View the content of the email in the dashboard. See View Quarantined Message Content.
- Export as .CSV - Download the report in Excel CSV format - using the Export button.
If you want to be able to search all Incoming or Outgoing archived message content in your domain, click on the Regenerate Content Index button at the top of the Domain Level Log Search page.
The index is regenerated and any messages archived since the last time the index was generated are added to the index - allowing you to search all archived message content for that domain.
- Once you have run your log search and the search results are listed, select the dropdown to the left of the message and select Change action for messages like this.
- The Add a new custom action for emails dialog is displayed with the fields pre-populated according to the message.
- Click Save.
The new custom action is listed in the Incoming - Protection settings > Customise actions page accessible from the Admin and Domain Level Control Panels.
You can now use the dropdown to the left of the new action and select Find similar messages to redirect you to the Log Search where the query based on your rule is automatically run and matching results are listed.
Alternatively, you can set up custom actions manually on the Customise Actions page. However, using the log search, as described here, is quicker, easier and more versatile.