Google Message Security for Google Apps Administration Guide - Manual (Page 379)

Message Log Search 379
To track all messages for a sender or recipient, follow these steps:
1. From the Log Search page, run the following query:
• Enter the sender’s address in the From field, and/or the recipient’s
address in the To field.
• Select Inbound or Outbound for the Direction. Leave this field blank to
search on both inbound and outbound mail.
• Click Search.
2. On the search results page, view the following fields:
• View the To field to view a complete list of recipients for the sender’s
messages.
• View filter fields such as Commerce Score, Finance Score, or Legal
Score if you want details about which filters may have been triggered for
the sender or recipient.
• View the Content Filter field to see if Content Manager filters were
triggered.
• View the Attachment Type field to see if Attachment Manager filters were
triggered for that sender or recipient.
Results of this query will include all successful messages delivered by a sender or
received by a recipient for the specified time period.
Note: Log Search data is available for approximately 45 days. To save data for a
specific user over a longer time period, you can export it to your computer
occasionally. Click Export All or Export Selected on the search results page.
I want to track messages by subject
Using Log Search, you can track all messages by subject for a specific time
range. Searches on both exact and partial text are supported, as well as phrases
within the text. Searches are case insensitive. For example, you can find search
results for an email with the following subject line, "New time for Staff Meeting," by
using any of the following search strings in the Subject field:
New time for Staff Meeting
staff meeting
new time
Note that non-ASCII characters in the Subject field are currently not supported.
Why was a message delivered or quarantined?
The Log Search tool enables you to track missing messages for inbound and
outbound traffic, or to track all messages for a specific sender, recipient, domain,
or IP address. In the search results, you can also view message details to confirm
whether specific filters were triggered when the message was sent, and confirm
the message disposition. (See “Log Search Fields” on page 362 for a definitions
and descriptions of the different fields.)