Mail Security for Windows questions

[Michelle911 0]

I'm just setting up the anti-spam features and need some clarification:

Does the web page quarantine automatically update?

Is there a log of all processed mail?

The quarantine report does not seem to be sending, where do I check that?

Edited October 8, 2017 by Michelle911

[filips 44]

Hi Michelle,

Does the web page quarantine automatically update?
No

Is there a log of all processed mail?
There is a log of all modified mail - "Mailserver protection" log, but You can create a transport rule to log all processed mail.

The quarantine report does not seem to be sending, where do I check that?
I don't know the steps You already did, but generally:
1. Create scheduled task "Send mail quarantine reports"
2. Select a user to test it on
3. Send a spam mail with GTUBE string to this user
4. Make sure the mail is in quarantine (check quarantine manager or mailserver log)
5. Right click Your task in Scheduler and hit "Run now"

If You don't receive the report within few minutes then temporarily enable diagnostic logging in Setup/Tools and repeat steps 3-5

[Michelle911 0]

Thanks for the reply.

I could not find a way to log anything through the transport or journal rules though. The closest would be to copy or forward, I don't want a copy of every email, just a report of received and how it was handled.

So if I understand correctly, the quarantine report only sends if there is something in the quarantine? Once it is released or deleted there is no longer a record of it?

[filips 44]

Hi,

i meant transport rules in ESET Mail Security (You can find them in EMSX/advanced settings/Server/Rules) - there is an option to log into EMSX events log (more info: http://help.eset.com/emsx/6.5/en-US/index.html?idh_wizard_rules_list.htm)

You are right - quarantine report is only sent if there is something in user's quarantine. If released/deleted the mail will stay in "trash" for a period specified by setting "Clear deleted files after" in advanced settings/Server/Quarantine. It can be recovered using eShell.