You can create an audit of user access to the MailStore database including what messages MailStore users have searched for and viewed. This information is recorded into the Windows Event Application log.
An example of one of these logs in the Event viewer would look like the following…
Event Type: InformationEvent Source: MailStore Server AuditingEvent Category: NoneEvent ID: 0Date: 08/06/2011Time: 09:09:03User: N/AComputer: MAILSTOREDescription:A complete message, its message body or an attachment has been retrieved.
Action EventType: MessageRetrieveContent FileGroupID: 45 MessageID: 30165
Identity IdentityUserName: fred IdentityRemoteEndPoint: 10.0.0.23:49819 IdentityWorkstationName: USER1-PC IdentityUserAgent: MailStore Client 126.96.36.19973
This log shows that user ‘fred’ on PC with an IP of 10.0.0.23 has viewed the message with ID ‘30165’ which exists in filegroup id ’45’ at 09:09:03
Unfortunatly this information does not show what that message contains but you can find this out by typing a search in the format (filegroupID:MessageID) in the mailstore Quick search field within the MailStore client. For example..
Next click Search and the contents of that message will be shown