Overview of Mail Logs

The Roller Network mail logs record the processing and handling of mail messages. There are two ways to view the mail logs: online in the account control center and by downloading the logs in a comma-separated values (CSV) file. There are three different mail logs:

• Incoming Mail Logs
• Outgoing/Delivery Logs
• Outbound Account (AUTH) Logs

Incoming Mail Logs contain information about messages originating from the outside world. This includes pre-content filtering, content filtering, additional mail handling, and similar information. The incoming logs are for the pre-queue stage. In some cases, a message will never be queued (such as for mail forwarding).

The Outgoing/Delivery Logs will contain information about delivery attempts after a message has been queued. This applies to domains in Secondary MX, SMTP Redirection, or Accept and Hold mode. Messages currently waiting in queue may also be viewed in their entirety online under the queue status page. In these logs, the "From" field is always a queue file identifier. The queue ID can be tied to the incoming mail logs by searching for it in the "Message".

Outbound Account (AUTH) Logs contain message submission data for Outbound Mail Accounts. These logs do not currently contain delivery status information.

Log entry times are time zone corrected to the setting in your account preferences. Log entries are retained for a maximum of six (6) months.

Searching the Mail Logs

The mail logs offer several search methods.

• CIDR: Search for a CIDR IP address range, IPv4 or IPv6.
• From: Search for a sender email address (incoming logs) or queue ID number (outgoing logs).
• To: Search for a recipient email address or queue ID (auth logs).
• Message: Searches the verbose status message field.
• Instance: Instance tracking number to associate multiple entries with one message.
• Filter by Status: Filter by reject/accept/deferred status.

Most log entries include a related IP address for which DNS Lookups may be enabled. When enabled, the logs must perform a lookup on each unique IP address, potentially causing a significant slowdown in log processing. It is not possible to search by DNS hostname.

Searching by email address may yield unexpected results due to common tokens (such as domain names). It may be faster to use your browser's built-in "find" function or download the CSV version for searches.

Natural and Boolean Searches

Several fields offer enhanced search capabilities in the form of natural language and boolean searching. The From, To, and Message search options allow these enhanced search capabilities. The Instance search option is exact-match only and the IP/Range requires a CIDR-formatted entry.

The search type for From, To, and Message defaults to natural language. This means you can search for a email address, domain name, or full word. Results will only be returned if the search term is only found in less than 50% of the entries as defined by the date/time range. To overcome this 50% limitation, use a boolean search.

To switch to boolean search mode, one of the following modifiers must be present: + (a leading plus sign indicates that this word must be present), - (a leading minus sign indicates that this word must not be present), and * (wildcard; this operator is appended to a partial search term). In boolean mode, you may mix and match all of these operators to refine your search.

When searching for domain names you may get better results by omitting the TLD and '.' separators. If you need to search for "exmaple.com", enter "example" or "+example" instead. You can also omit subdomains with a boolean search of "+example -subdomain".

CSV Log Downloads

You may choose to download large log sets in a comma-separated values (CSV) format to view them in a suitable analysis program, spreadsheet, or to keep them for your records. Our CSV logs are formatted according to RFC 4180. The CSV logs contain different fields depending on which log is downloaded.

Incoming Mail Logs - smtpd
ip	The IP address of the remote server.
host	The DNS name of the IP. Blank if lookup failed or DNS Lookups are off.
server	1 = mail.rollernet.us, 2 = mail2.rollernet.us
status	0 = rejected, 1 = accepted, 2 = deferred
from	The MAIL FROM (sender) email address.
to	The RCPT TO (recipient) email address.
time	Entry timestamp.
instance	Internal instance tracking number.
comment	Verbose logging message.

Outgoing/Delivery Logs - smtp
ip	The IP address of the remote server.
host	The DNS name of the IP. Blank if lookup failed or DNS Lookups are off.
server	1 = mail.rollernet.us, 2 = mail2.rollernet.us
status	0 = rejected, 1 = accepted, 2 = deferred
qnum	The queue file identifier.
to	The RCPT TO (recipient) email address.
time	Entry timestamp.
delay	Delivery time in seconds.
comment	Verbose logging message.

Outbound Account (AUTH) Logs - smtpauth
ip	The IP address of the remote server.
host	The DNS name of the IP. Blank if lookup failed or DNS Lookups are off.
account	The authenticated account name.
status	0 = rejected, 1 = accepted, 2 = deferred
from	The MAIL FROM (sender) email address.
to	The RCPT TO (recipient) email address.
time	Entry timestamp.
instance	Internal instance tracking number.
comment	Verbose logging message.