Google Message Security for Google Apps Administration Guide - Manual (Page 356)

356 Message Security for Google Apps Administration Guide
About the Data
Note the following about Log Search data:
• Message Log Search data is available within approximately 3 hours of
message processing (sent or delivered through the message security
service), and messages remain in the log for approximately 45 days. If you
want to save search results for later analysis, you can export a .csv file.
• As your messages are processed, information about the messages is
captured and stored in a log, but the message security service does not store
copies of these messages.
• The maximum number of messages that a Log Search query can return is
approximately 15,000. Queries that return more than this limit result in an
error message. If this occurs, you can refine your search by including
additional criteria -- for example, you can search both by sender and recipient.
• Log Search data for Google Apps Gmail messages is captured for all
intradomain mail. Note that separate message IDs will be logged for each
message in a Gmail conversation.
• Log Search data is managed and stored securely in Google data centers. For
more information, see the Security and Privacy help center article.
The Message Log Search feature is different from the Traffic Activity Log, which
displays data for outgoing messages only. The Traffic Activity Log includes some
fields with similar names to those available with Log Search,
and contains data
from 20 minutes prior.
Administrative Privileges for Message Log Search
Administrators can use Log Search if they’re assigned Modify privileges for this
feature. Log Search access privileges are inherited automatically by
administrators who have View Reports privileges for the same organization. If you
want to add or remove Log Search privileges for an administrator, follow the steps
below.
To set administrator privileges for Log Search:
1. From the Administration Console, click the Orgs and Users tab.
2. Click the Authorizations link on the tab bar.
3. Select the org from the Choose Org pull-down list.
4. Click the List button.
5. Click the View/Edit Profile link for a specific user.
6. Scroll down to the Organization Management section of the page.