Using MailStore audit logs to track what messages a MailStore user has searched for

You can create an audit of user access to the MailStore database including what messages MailStore users have searched for and viewed. This information is recorded into the Windows Event Application log.

An example of one of these logs in the Event viewer would look like the following…

Event Type: Information
Event Source: MailStore Server Auditing
Event Category: None
Event ID: 0
Date:  08/06/2011
Time:  09:09:03
User:  N/A
Computer: MAILSTORE
Description:
A complete message, its message body or an attachment has been retrieved.

Action
 EventType: MessageRetrieveContent
 FileGroupID: 45
 MessageID: 30165

Identity
 IdentityUserName: fred
 IdentityRemoteEndPoint: 10.0.0.23:49819
 IdentityWorkstationName: USER1-PC
 IdentityUserAgent: MailStore Client 6.0.0.6173

This log shows that user ‘fred’ on PC with an IP of 10.0.0.23 has viewed the message with ID ‘30165’ which exists in filegroup id ’45’ at 09:09:03

Unfortunatly this information does not show what that message contains but you can find this out by typing a search in the format (filegroupID:MessageID) in the mailstore Quick search field within the MailStore client. For example..

Next click Search and the contents of that message will be shown

Copy link
Powered by Social Snap