Using the malquery command line tool to search the Message Audit Logs for subjects containing multiple words returns an error.

smg> malquery -p 1h -e "SUBJECT*test message"
Unable to run query. Query may be badly formed.

This issue is due an error in the way user supplied data is parsed and provided to the querying engine.

This issue will be corrected in a future release of the Symantec Messaging Gateway.

This issue can be worked around by supplying a quoted-printable encoded version of the desired string. For example, to search for subjects containting the string "This is a test":

Normally (which produces and error):
malquery --previous 1h --event "SUBJECT*this is a test"

Quoted-printable:
malquery --previous 1h --event "SUBJECT*this=20is=20a=20test"

In the above example, the quoted-printable code =20 is equivalent to a space. Various quoted-printable conversion sites can be found on the Internet to help encode strings.

Subscribe to this document to be notified of any updates to this issue.