Email Track and Trace tool best practices and common issues

Products

• Email Security.cloud

Issue/Introduction

The Email Track & Trace tool for Email Security.cloud is a powerful tool that helps you:

• Trace specific emails and determine if and when they were processed. You can search for an email that was processed within the last 30 days.
• Determine if any actions were taken on an email by Broadcom services.

The following best practices will help you optimize your searches for Email Track & Trace.

Resolution

Limit the time window and refine your search criteria

For the best results, limit the time window and refine your search criteria.

• If you know the specific time window of the email you are attempting to locate, restrict the search to a shorter time period (days or hours). This provides a quicker search response.
• Using one or more indexed fields in your search criteria will significantly improve search performance. 
  • Subject
  • Service
  • Sender IP
  • Sender Address
  • Recipient Address
  • Time stamp
  • Date
• Add fields in the "Select more search options" where available; add a Service, Sending server, external IP etc. to significantly narrow the search results.
• Please note, it will take up to 15 minutes to display new email transactions on Track and trace.

Result format (UI vs CSV files)

When asking for results in the UI versus asking for a CSV file through email, consider the following:

• UI - The UI will return results for up to 2,000 rows.
  • If you expect that results will be greater than 2,000 rows, request a CSV file to be emailed.
• CSV - The CSV file will deliver results up to 10,000 rows.

When to expect results

How long should a report take?

• Results should return in the UI within seconds or minutes.
  • The search will time out if it is too complex and/or takes over 30 minutes to complete. 
• Results that are requested via emailed CSV can arrive within minutes.
  • During peak periods, results may take a few hours depending on the query load. 

Search timeouts

What causes timeouts and failed searches?

• Using any non-indexed fields (indexed fields are listed above) for searches, especially multiple non-indexed fields, will greatly increase the chances of a failed search.
  
  Note: We have recently surveyed the most frequently used non-indexed fields and we are working to add them to our next release. If non-indexed fields are essential in the search then adding one or multiple indexed fields, in addition, will improve the chances of success.
• When searching on a subject field based on a word, use all the characters you have. For example:
  • Don't use the letters "Ref" when searching for the word "Referral" as you significantly increase the chances of a failed search by widening the search parameters.
  • Additionally, using "subject starts with" or "subject ends with" provides faster results than "subject contains".
Avoid using *@*.* in sender & recipient fields when combining with other search parameters. 

Additional Information

For more information about Email Track & Trace, see:

• About Email Track and Trace
• Searching for an email with Email Track and Trace
• Searching by message ID in Email Track and Trace
• Requesting Email Track and Trace results by email
• Viewing Email Track and Trace search results
• Viewing email delivery details in Email Track and Trace
• Enabling a user for Email Track and Trace