Better understanding of the daily mail report

echo501 · Post by **echo501** » Fri Dec 12, 2014 11:08 am

Hi, I'm sorta new to Zimbra and mail. If an answer is in a manual please be gentle and point me to a link. I realize most answers can be found in a manual but honestly the manuals read like stereo instructions and often create more questions. Sooo... with this said I have a few questions about the Daily Mail report. I have a stand alone Zimbra 8.5.1 instance on CentOS 6.6. I have less than 50 email accounts. We're a Java development shop. So I'm rather a smallish entity.
If logs or config data is needed, I'm happy to respond.

Zimbra Daily Mail Report questions
Section - Grand Totals
----------------------------------
I notice that in this section I have 800-1000 received email per day and 1200-3000 delivered email per day. This "seems" to be a lot to me. Thoughts??

Section - Top 50 Senders by Message count
----------------------------------
Can someone clarify this "count" definition? So if I send an email to three folks does the count increment by one or four (mine plus each of the recipients). I know this seems like a strange question, but I have a few high senders and wish to better understand why their counts are reporting so high.
Also I have a sender whose address is "from=<>". How can I discover where this comes from?
The senders message count includes names and addresses that are not part of my MTA doamin. Why? How do I get these to stop?

Section - Top 50 Recipients by Message count
----------------------------------
I have several account that receive a huge amount of email (hundreds) while other receive little (tens). Ok we can chalk some of this to more active users, but I know for a fact that a few are NOT that active in Zimbra. Example - The report shows that I received 54 messages on 12-11-2014, yet a search of my account for that day only shows 14 messages. Where are the other "40"??
The recipients message count includes names and addresses that are not part of my MTA doamin. Why? How do I get these to stop?

Section - message reject detail
----------------------------------
I'm getting few hundred Client host rejected: Access denied from IP addresses that are not in my network. Why?!? Is this the work of spammers looking for an open route thru my email server?
Thank you for all the input. Your answers and discussion welcomed.

echo501 · Post by **echo501** » Tue Dec 16, 2014 8:58 am

Bump

Anyone have any input on this?!?

ckruijntjens · Post by **ckruijntjens** » Wed Dec 17, 2014 12:57 pm

Hi yes i have the same questions??

I dong understand it.

echo501 · Post by **echo501** » Tue Dec 23, 2014 12:39 pm

Second Bump - Any one?!? Just looking for a discussion to better understand what is being reported.

Thanks

shivaprasad.naik.52 · Sun Feb 15, 2015 11:08 pm

Hi,

I have also installed Zimbra mail services, but the daily mail reports are highly confusing. Numbers do not seem to be realistic.

I would be thankful if anyone can explain the daily mail reports so that we have a better understanding of Daily mail reports.

shriram.sampat · Post by **shriram.sampat** » Mon Feb 16, 2015 8:46 am

https://bugzilla.zimbra.com/show_bug.cgi?id=96131

Maybe this is the reason.

shriram.sampat · Post by **shriram.sampat** » Mon Feb 16, 2015 8:48 am

also this is related

https://bugzilla.zimbra.com/show_bug.cgi?id=62095

echo501 · Post by **echo501** » Mon Feb 16, 2015 10:15 am

Thanks for the replies. The bug reports are interesting but for versions of Zimbra I'm not utilizing. I just upgraded to 8.6.0 Network version.

If the admin report is inaccurate then why have it? I understand that this may be low hanging fruit in the scheme of getting fixes implemented, however it frustrating to see this being reported.

Any other responses to my questions that are not count related??

Thanks for all replies.

cayaraa · Post by **cayaraa** » Mon Feb 16, 2015 10:49 am

In most cases the version in the bug report was when it was found...and if it was never fixed then its probably still in the current version as they don't go back and patch older versions of zimbra. If it was fixed unintentionally then they normally just close the existing ticket as unrepeatable in the current version.

Klug · Post by **Klug** » Wed Feb 18, 2015 5:25 am

Google for "pflogsumm", the report mail is build by this tool.

You'll find lots of explanation on what it does/counts.

Also, about the double-counting issue, this is currently a work in progress: https://bugzilla.zimbra.com/show_bug.cgi?id=61661 and https://bugzilla.zimbra.com/show_bug.cgi?id=84444