Chat now with support
Chat with Support

MessageStats 7.8.1 - Administrator Guide

What is MessageStats? MessageStats Information Sources Using the Console Interface Creating a Connection to Exchange Creating Gathering Tasks Default Gatherings Extending Gathering Tasks Configuring Audits Setting MessageStats Server Properties Setting Configuration Properties Setting Exchange Organization Properties Setting Exchange Server Properties Setting Task Execution Server Properties Setting Task Default Properties Compressing Tracking Log Files Using the MessageStats Reports Console Database Management Appendix A:Microsoft ASP.NET Configuration Issues Appendix B: Gathering Task Dependencies Appendix C:Troubleshooting Permission Problems

Transport-Level Audits

Transport-level audits use information that is gathered through the Default Gathering task. You select the information to be gathered using specific audit property tabs in the Exchange organization properties. You can specify audit information for auditing mailboxes, Internet sites, and delivery times for messages.

Auditing Mailboxes

You can audit user mailboxes for email usage by adding mailboxes to the mailbox audit list on the Exchange organization property page. Mailbox auditing allows you to track the sending and receiving of email messages, intended targets, and subject line text.

Due to the way that Microsoft Exchange writes information to the tracking logs, the Mailbox Audit reports display the recipients list as it is created by the mailbox user. Any distribution groups that are included in the recipients list are not expanded to include all members of the distribution group. If the mailbox that is being audited receives a message that was sent to a distribution group, the received messages list does not show that the message was sent to a distribution group instead of directly to the mailbox.

For information about selecting the mailboxes to be audited, see Identifying Mailboxes for Mailbox Auditing .

Auditing Internet Domains

You can create a list of Internet domains that are considered restricted by your email usage policy. MessageStats can audit all tracking logs to identify email traffic to or from the specified domains. If you want more than one Exchange organization to audit for a particular Internet domain, you must configure each Exchange organization individually.

Use Internet domain auditing to track the sending and receiving of Internet email messages, intended targets, and subject line text for a defined list of domains.

For about configuring audits for Internet domains, see Configuring Internet Domain Auditing .

Auditing Message Subjects

Many email viruses have similar text that appears in the message subject line. Being able to see the volume of messages that are sent and received with these subject lines is beneficial in understanding the impact that email viruses can have on an Exchange organization.

In Microsoft Exchange, you must specifically select the Enabled subject logging and display option on the Exchange server to include message subjects in an audit. If you do not select this option, the subjects for the audited messages is empty.

For information about configuring audits for message subjects, see Auditing Subject Text in Messages .

Auditing Message Delivery Times

You can use message delivery time auditing to identify messages that take an unusual amount of time to be delivered. When a message takes longer to deliver than the audit threshold that you define, MessageStats records the message originator, recipients, subject, messageID, timestamp, and size.

Ensure that the delivery threshold that you set is large enough so that the audit does not capture too many messages.

When you create a Default Gathering task or Exchange Tracking Logs task, the Delivery Time Threshold dialog box is displayed. You can use it to set a delivery time threshold for the task.

For information about setting a message delivery time threshold for auditing purposes, see Setting a Threshold for Delivery Time Audits .

Storage-Level Audits

The Content and Attachments audits use information gathered through the Exchange Mailbox Content and Attachments and Exchange Public Folder Content and Attachments Gathering Tasks.

Auditing Mailbox Content and Attachments

MessageStats provides content and attachment audits for mailboxes. You can audit the count and volume information for the items in the mailbox databases on the selected server. You must create a gathering task to collect the content and attachment details from the mailboxes.

For information about creating a gathering task to collect mailbox content and attachment information, see Gathering Mailbox Content and Attachments .

After you have run the dependent gathering tasks, you can use the Content Analysis Audit reports to review the audited information. Mailbox Content Analysis Audit reports include the following:

•
Audit Mailbox Content for Subject Keyword, Body Keyword, Size, Number of Recipients, or Date
•
Audit Mailbox Attachments for File Extension or File Name Keyword
Auditing Public Folder Content and Attachments

MessageStats can gather mailbox content and attachment information for public folders through audits. You can audit the count and volume information for the items in the public folder database of a selected server.

You must create a gathering task to collect the content and attachment details from the public folders.

For information about creating a public folder content and attachment gathering, see Gathering Public Folder Content and Attachments .

After you run the dependent gathering tasks, you can use the Content Analysis Audit reports to review the audited information. Public Folder Content Analysis Audit reports include the following reports:

•
Audit Public Folder Content for Subject Keyword, Body Keyword, Size, or Date
•
Audit Public Folder Attachments for File Extension or File Name Keyword.

Managing Audited Information

Audits affect the overall size of your database, as well as affecting gathering performance time. It is recommended that you carefully select the audits that you want to perform, rather than auditing large amounts of information in your organization.

Estimating Database Growth

Before you define audits, consider the amount of data to be added to the database. You can contact Professional Services to help determine the growth rate of your database based on your MessageStats configuration.

Effects of Changing Audit Configuration

If you change the configuration settings for audits, MessageStats automatically reimports the tracking logs that already exist or have existed in the database. During the gathering processes, MessageStats determines if any logs must be imported again.

If another import is required, MessageStats searches tracking logs in the following locations:

•
The individual server’s archive log path
•
The individual server’s tracking log share
•
The mailbox database share
•
The system-wide archive log path

The newly gathered audit information is written to the database, supplementing the data that was already gathered.

 
* 
NOTE: For more information, see Scenarios for Configuring Date Ranges .

Considerations for Performing Audits

To ensure that your audits are efficient and provide the results that you want, consider the following factors:

•
Audits cannot be run for mailboxes that appear on the Excluded Mailbox list.
•
Audits are only run for the last seven days of Exchange logs and new logs as they become available. To perform audits on archived logs, you must reimport the logs. For more information, see Scenarios for Configuring Date Ranges .
•
To include message subjects in the audit, you must select the Enabled subject logging and display option for the Microsoft Exchange server. If you do not select this option, no subjects appear in the audited messages.
•
Mailboxes that you want to audit must exist in the MessageStats database. If you want to audit a mailbox that does not currently exist in the database, you must enter the internal mailbox identification information (including the Name, Display Name, Legacy Distinguished Name, and the Email Address) into the Add New Mailbox to Audit dialog box.
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating