Table: Report layout provides information about how reports are displayed.
Table: Report layout
Graphs and tables
The options for displaying report data for graphs and tables are as follows:
Number of rows
The maximum size for any report (including a scheduled report) is 1,000 rows. If you encounter this limitation, shorten the time range, group by a longer time interval, or decrease the top entries field (applicable to some reports).
Extra bars in report graphs
The current fractional hour is included in report graphs in its own bar. This information ensures that the entirety of the selected time range is displayed. This extra bar usually portrays noticeably less data than the rest of the bars.
Consider the following examples:
Report statistics are stored in units from 0 minutes, 0 seconds to 59 minutes, 59 seconds of every hour. For example, from 1:00 A.M. to 1:59 A.M. is one unit and from 2:00 A.M. to 2:59 A.M. is another unit. Because of this scheme, reports cannot be displayed with a time range less than an hour or grouped by a period less than an hour.
Table: Report data details provides the information to help you interpret the information in reports.
Table: Report data details
What constitutes a threat
The summary reports and the Dashboard contain threat summary graphs and tables. A threat is a harmful attribute or potentially harmful attribute of an email message. For example, threats include spam, viruses, and content filtering policy violations. Similar message verdicts are grouped into threat categories.
Single threat, multiple threat, and clean messages
The summary reports and the Dashboard categorize messages into single threat, multiple threat, and clean messages. Multiple threat messages contain more than one type of threat. For example, a message that contains spam and a virus is a multiple threat message. Clean messages contain no known threats.
Message and connection counts
The appliance uses many technologies to track email and filter email. Some of these technologies function at the email connection level before an actual email message can be generated and sent. When a connection is rejected or deferred because it triggered a bad reputation filter, that connection is counted as one message.
Verdicts of suspect viruses messages
If a message is routed to the Suspect Virus Quarantine, the outcome of rescanning the message is not counted toward total threat counts. However, the outcome of rescanning the message is displayed in the Suspect Virus Outcomes graph. The graph indicates whether quarantined suspect viruses were deleted, determined to be viruses or not, or are still in the Suspect Virus Quarantine.
Sender HELO domain or IP connection shows gateway information
Affected reports are as follows:
Processed message count
For the reports that list the number of processed messages, the number of processed messages is counted per message, not per recipient. For example, if a single message lists 12 recipients, the processed message count increases by 1, not 12.
How duplicate verdicts per messages are reported
Each email message can have multiple recipients and multiple threats. Different recipients in the same email message may have different threats triggered. This situation occurs because the different recipients may belong to different policy groups. For example, recipients in group A may have content filtering enabled for employee data protection terms, while recipients in group B may not.
Some verdicts have names associated with them to describe unique instances of that verdict type. For example, a known virus may be called W32.Zoltan or VBS.Throckmorton. Each named verdict is counted separately. If both W32.Zoltan and VBS.Throckmorton are found one or more times in a message, the virus count increases by two. The message is considered a multiple threat message.
The following verdicts have unique names:
Verdicts that are not included in this list are counted once per message regardless of the number of occurrences of the verdict in the message. For example, a single message is sent to three recipients. The message to recipient A has two matches for encrypted content. The same message that is sent to recipient B has two matches for encrypted content. That same message that is sent to recipient C has no matches. The total count of encrypted content for the message is one. The virus threat count for the message is one (encrypted content counts as a virus without a unique name). If no other threats are detected in the message, it is considered a single threat message.
IM message count
See Report types.