Using MailStore audit logs to track what messages a MailStore user has searched for

You can create an audit of user access to the MailStore database including what messages MailStore users have searched for and viewed. This information is recorded into the Windows Event Application log.

An example of one of these logs in the Event viewer would look like the following…

Event Type: Information
Event Source: MailStore Server Auditing
Event Category: None
Event ID: 0
Date:  08/06/2011
Time:  09:09:03
User:  N/A
A complete message, its message body or an attachment has been retrieved.

 EventType: MessageRetrieveContent
 FileGroupID: 45
 MessageID: 30165

 IdentityUserName: fred
 IdentityWorkstationName: USER1-PC
 IdentityUserAgent: MailStore Client

This log shows that user ‘fred’ on PC with an IP of has viewed the message with ID ‘30165’ which exists in filegroup id ’45’ at 09:09:03

Unfortunatly this information does not show what that message contains but you can find this out by typing a search in the format (filegroupID:MessageID) in the mailstore Quick search field within the MailStore client. For example..

Next click Search and the contents of that message will be shown