立即与支持人员聊天
与支持团队交流

MessageStats 7.8.1 - Administrator Guide

What is MessageStats? MessageStats Information Sources Using the Console Interface Creating a Connection to Exchange Creating Gathering Tasks Default Gatherings Extending Gathering Tasks Configuring Audits Setting MessageStats Server Properties Setting Configuration Properties Setting Exchange Organization Properties Setting Exchange Server Properties Setting Task Execution Server Properties Setting Task Default Properties Compressing Tracking Log Files Using the MessageStats Reports Console Database Management Appendix A:Microsoft ASP.NET Configuration Issues Appendix B: Gathering Task Dependencies Appendix C:Troubleshooting Permission Problems

Identifying Internal IP Addresses

MessageStats provides reports that show both internal and external email traffic. By default, no IP addresses are identified as “internal” so this means that SMTP-submitted messages are counted as “external” in the following reports:

•
Organizations—Subject Sent Audits
•
Servers—Server Activity—Advanced Details: Message Submission field
•
Servers—Server Activity Internal vs. External
•
Servers—Server Message Sizes Sent Distribution
•
Mailboxes—Mailbox Top Senders and Receivers
•
Mailboxes—Mailbox Activity
•
Mailboxes—Mailbox Profile
•
Mailboxes—Mailbox Sent Audits
•
Mailboxes—Mailbox Sizes Sent Distribution
•
All Distribution Group activity reports
•
All Mail Contact Reports

To identify all your internal IP subnets, use the Internal Subnets tab. The messages that are submitted through SMTP from those IP addresses will then be correctly reported as “internal” messages.

Using this property page, you can specify either individual IP addresses or a range of IP addresses that you want to identify as internal to your organization.

To identify internal IP addresses
1
Expand the Exchange Organizations node in the treeview and select an Exchange organization.
2
Right-click and select Properties.
3
Select the Internal Subnets tab.
4
Click Add.
5
Specify an IP address or a range of IP addresses that you want treated as internal for reports.
:
Table 1. Entering the IP addresses that should be treated as internal.
•
Enter a single IP address under the From heading.

You can specify * as a wildcard character for part of the IP address if necessary.

For example, you could enter 10.4.59.* in the field. This would result in IP addresses 10.4.59.0 to 10.4.59.255

- OR -
1
Enter the first IP address in a range of addresses, under the From headings
2
Select the To check box and enter a last IP address for a range.

If you want to specify a wildcard (*) as part of the To address, you must enter a specific number in the corresponding part of the address in the From field.

3
Click OK.

Identifying Mailboxes for Mailbox Auditing

You can audit user mailboxes for email usage. After you add mailboxes to the mailbox audit list, you can use mailbox auditing to track the sending and receiving of email messages, their intended targets, and subjects.

 
* 
NOTE: If you try to audit excluded mailboxes, the Audit reports have no content. For more information, see Excluding Mailboxes from Gatherings .

Due to the way that Microsoft Exchange logs information to the tracking logs, the Mailbox Audit reports display the recipients list as it is created by the mailbox user. Any distribution groups that are included in the recipients list are not expanded to include all members of the distribution group.

If a mailbox that is being audited receives a message that was sent to a distribution group, the received messages list does not indicate that the message was sent to a distribution group. However, it does show that the mailbox received the message.

The list of mailboxes that appears in the mailbox auditing functionality is populated by the mailboxes that have been gathered from the Exchange organization and stored in the MessageStats database.

For information about managing audited information, see Managing Audited Information .

Selecting the Mailboxes to be Audited

The Mailbox Auditing tab of the organization Properties displays the mailboxes that are currently being audited. You can use the Mailbox Auditing tab to make changes to the audit list.

The browser in the dialog box lists all mailboxes that exist in the MessageStats database. If you have not completed a gathering, the browser list is empty. You can select more than one mailbox from the list.

 
Table 2. Selecting mailboxes to audit.
Option
Definition

Select Mailbox

Select this option and select one or more mailboxes that are listed in the browser list.

Enter Mailbox Detail

Select this option if you know the display name, mailbox distinguished name, and mailbox email for the mailbox. You can enter the information instead of browsing through the list of mailboxes. You cannot select multiple mailboxes that you entered manually.

Display Name

Enter the mailbox display name.

Mailbox Distinguished Name

Enter the mailbox distinguished name (DN).

Mailbox Email

Enter the mailbox email.

To add mailboxes to the audit list
1
Expand the Exchange Organizations node in the treeview and select an Exchange organization.
2
Right-click and select Properties.
3
Select the Mailbox Auditing tab and click Add.
4
Click Select Mailbox to select one or more mailboxes from the browser list and click OK.
The list is populated with the mailboxes that have been gathered from the Exchange organization and are stored in the MessageStats database.
- OR -
Click Enter Mailbox Detail, enter the specific mailbox information, and then click OK.
To edit mailboxes on the audit list
1
Expand the Exchange Organizations node in the treeview and select an Exchange organization.
2
Right-click and select Properties.
3
Select the Mailbox Auditing tab.
4
Select the mailbox you want to change and click Edit.
5
Change the details as required and then click OK.
To remove mailboxes from the audit list
1
Expand the Exchange Organizations node in the treeview and select an Exchange organization.
2
Right-click and select Properties.
3
Select the Mailbox Auditing tab.
4
Select the mailbox you no longer want to audit.
5
Click Remove and click Yes to confirm.
6
Click OK.

Auditing Subject Text in Messages

Many email viruses that exist have similar text that appears in the subject of the message. Viewing the volume of messages that are sent and received with these subject lines is beneficial in understanding the impact that email viruses can have on an Exchange organization.

Message Subject Auditing allows you to enter text that can be compared to a message subject line. MessageStats compares the text you specified to each message subject and captures the message if any part of the text is contained in the subject line.

If a message satisfies the subject criteria, MessageStats records the information for the message. This information includes originator, recipients, subject, messageID, timestamp, and size.

Prerequisites

In Exchange, you must have enabled message subject logging on the Exchange server to include message subjects in the audit. If you do not select this option, the subjects for the audited messages are empty.

If you want to audit a message subject in more than one Exchange organization, you must configure each Exchange organization individually.

Entering the Subject Text to be Audited

The Message Subject Auditing tab displays the subject text words that are currently being audited and allows you to change the audit list.

When identifying the audit text, be very specific. The less explicit you are, the greater the number of captured messages. As the number of captured messages increases, the more time it takes to complete the gathering.

To add message subject text to the audit list
1
Expand the Exchange Organizations node in the treeview and select an Exchange organization.
2
Right-click and select Properties.
3
Select the Message Subject Auditing tab and click Add.
4
Enter the subject text to be included in the audit.
5
Click OK.
To edit message subject text in the audit list
1
Expand the Exchange Organizations node in the treeview and select an Exchange organization.
2
Right-click and select Properties.
3
Select the Message Subject Auditing tab.
4
Select the subject text you want to change and click Edit.
5
Change the subject message text as required and click OK.
To remove message subject text from the audit list
1
Expand the Exchange Organizations node in the treeview and select an Exchange organization.
2
Right-click and select Properties.
3
Select the Message Subject Auditing tab.
4
Select the subject text you no longer want to audit and click Remove.
5
Click OK.

Configuring Internet Domain Auditing

Sometimes message traffic between your Exchange organization and some Internet domains can constitute inappropriate email use. You can create a list of Internet domains that are considered restricted by your email usage policy.

MessageStats can audit all tracking logs to identify email traffic to or from the specified domains, their intended targets, and subjects for a defined list of domains. To audit a particular Internet domain for more than one Exchange organization, configure each Exchange organization individually.

The Domain Auditing tab displays the domains that are currently being audited and allows you to make changes to the audit list.

To add Internet domains to the audit list
1
Expand the Exchange Organizations node in the treeview and select an Exchange organization.
2
Right-click and select Properties.
3
Select Domain Auditing.
4
Click Add.
5
Enter the name of the domain you want to add to the list.
Enter domain names at the level you want to ensure that appropriate information is audited. A domain name usually consists of two or more parts (technically labels), separated by dots. The top-level domain is the right-most label and any subdomains are the labels to the left. MessageStats includes domains and subdomains according to the level of domain name you enter.
For example, if you entered DomainA.com, MessageStats captures both ChildDomain.DomainA.com and DomainA.com in the audit. However, if you entered ChildDomain.DomainA.com, MessageStats does not capture DomainA.com.
6
Click OK to save the domain to the list.
To edit Internet domains on the audit list
1
Expand the Exchange Organizations node in the treeview and select an Exchange organization.
2
Right-click and select Properties.
3
Select Domain Auditing.
4
Select the domain and click Edit.
5
Make any changes and click OK.
To remove Internet domains from the audit list
1
Expand the Exchange Organizations node in the treeview and select an Exchange organization.
2
Right-click and select Properties.
3
Select Domain Auditing.
4
Select the domain and click Remove.
相关文档

The document was helpful.

选择评级

I easily found the information I needed.

选择评级