Menu

Join the Conversation

To sign in, use your existing MySonicWall account. To create a free MySonicWall account click "Register".

Sign In Register

investigate - no message and connection logs

GaborGabor Newbie ✭
in Email Security Appliances

Hello,

Still running demo verison, with questions. although i have configured inbound traffic with 2 users i can not see significant logs in investigation. no message and connection logs ( with notice - "There are no inbound messages available in the auditing database. ")

Inbound email flow is configured as MTA, with few mail that recieved few day ago, but monitoring / incoming good vs. junk shows only incredible high number junk mail with no good mail at all. Where are the incoming mails, and why is not possible to track traffic in investigation logs?

thanks

Category: Email Security Appliances
Reply
Tagged:

Answers

  • BWCBWC Cybersecurity Overlord ✭✭✭

    Hi @Gabor

    how is your Auditing configured? Settings button on Message or Connection Logs? Did you activated the auditing?


    ESA.png

    --Michael@BWC

  • GaborGabor Newbie ✭

    Hi Michael,

    Thanks for the fast reply. Sure i have this settings, with enabled audit trail as well . Do i need some time to refresh the logs?

    image.png


  • BWCBWC Cybersecurity Overlord ✭✭✭

    Hi @Gabor

    the logs are not 100% real-time (short delay), but should catch up after a while. Maybe a reboot can be helpful, sometimes strange things happen on ESA.

    Side note, I recommend Delayed Connection Management after all recipients are know.

    --Michael@BWC

  • GaborGabor Newbie ✭

    After restarting the appiance i see connection logs now, thats great ! sent 5-10 mails inside from gmail, recieved them succesfuly, but no log in message logs.. inbound good vs. junk shows also junk mails for hours. how could it be valid?

    image.png


  • BWCBWC Cybersecurity Overlord ✭✭✭
    edited March 2021

    Hi @Gabor

    welcome to the wonderful world of ESA, not everything is explainable.

    Maybe the database is messed up, please have a look at this KB article which might be helpful:

    https://www.sonicwall.com/support/knowledge-base/auditing-junk-box-is-not-showing-latest-emails-with-an-alert-database-corrupted/170504922247917/

    It might be chilling for a new user facing this kind of problems, but believe me it can be far worse. I broke my first ESA less than 5 minutes into action by just changing the DNS server back in the days :)

    --Michael@BWC

Sign In or Register to comment.