Email Track and Trace tool best practices and common issues

Products

• Email Security.cloud

Issue/Introduction

The Email Track & Trace tool for Email Security.cloud is a powerful tool that helps you:

• Trace specific emails and determine if and when they were processed. You can search for an email that was processed within the last 30 days.
• Determine if any actions were taken on an email by Broadcom services.

The following best practices will help you optimize your searches for Email Track & Trace.

Resolution

Limit the time window and refine your search criteria

For the best results, limit the time window and refine your search criteria.

• If you knowf the specific time window of the email you are attempting to locate, restrict the search to a shorter time period (days or hours). This provides a quicker search response.
• Using one or more indexed fields in your search criteria will significantly improve search performance. 
  • Subject
  • Service
  • Sender IP
  • Sender Address
  • Recipient Address
  • Time stamp
  • Date
• Add fields in the "Select more search options" where available; add a Service, Sending server, external IP etc. to significantly narrow the search results.

Result format (UI vs CSV files)

When asking for results in the UI versus asking for a CSV file through email, consider the following:

• UI - The UI will return results for up to 2,000 rows.
  • If you expect that results will be greater than 2,000 rows, request a CSV file to be emailed.
• CSV - The CSV file will deliver results up to 10,000 rows.

When to expect results

How long should a report take?

• Results should return in the UI within seconds or minutes.
  • The search will time out if it is too complex and/or takes over 30 minutes to complete. 
• Results that are requested via emailed CSV can arrive within minutes.
  • During peak periods, results may take a few hours depending on the query load. 

Search timeouts

What causes timeouts and failed searches?

• Using any non-indexed fields (indexed fields are listed above) for searches, especially multiple non-indexed fields, will greatly increase the chances of a failed search.
  
  Note: We have recently surveyed the most frequently used non-indexed fields and we are working to add them to our next release. If non-indexed fields are essential in the search then adding one or multiple indexed fields, in addition, will improve the chances of success.
• When searching on a subject field based on a word, use all the characters you have. For example:
  • Don't use the letters "Ref" when searching for the word "Referral" as you significantly increase the chances of a failed search by widening the search parameters.
  • Additionally, using "subject starts with" or "subject ends with" provides faster results than "subject contains".
Avoid using *@*.* in sender & recipient fields when combining with other search parameters. 

Additional Information

For more information about Email Track & Trace, see:

• About Email Track and Trace
• Searching for an email with Email Track and Trace
• Searching by message ID in Email Track and Trace
• Requesting Email Track and Trace results by email
• Viewing Email Track and Trace search results
• Viewing email delivery details in Email Track and Trace
• Enabling a user for Email Track and Trace