When searching for messages in the Message Audit Log for the time selected (past week, past month, customized), it might be expected that the list would contain exactly 1000 entries. Still sometimes the results would contain less than 1000 entries. Sometimes results would contain more than 1000 entries but still do not cover the time range selected.
The Symantec Messaging Gateway works as designed.
The Message Audit Log provides information on each message received by each recipient. For example, if the same message is received by 10 recipients, you see 10 entries in the Message Audit Log. The number of messages that a query can return is limited to 1000. However, to reach this limit Symantec Messaging Gateway counts multiple entries for the different recipients of the same message as one message.