Mimecast Administrators who have been granted access to the Archive will by default only have access to view the metadata of the email. Those who have been given Content Viewing permissions additionally will be able to view both the content and the metadata of all emails. Message View logs provide a full audit trail of all Administrator views of both the metadata and content of emails in the Archive.
For those Administrators with Content Viewing rights, the logs will always show that the content of the email has been viewed, so it is recommended to use a normal Administrator account when performing general searches on emails. The logs are immutable, and will be available indefinitely for the Mimecast account, regardless of the retention period.
To view the archive message logs:
- Log in to the Administration Console.
- Click on the Administration toolbar button. A menu drop down is displayed.
- Click on the Archive | View Logs menu item. The log list displays a number of fields, detailed in the table below:
|Viewer||Identifies which Administrator performed the search|
|Indicates that the Administrator could only access Metadata of the messages|
|Indicates that the Administrator could access the content of the emails|
|Message From||Sender address on the email viewed|
|Message To||Recipient address on the email viewed|
|Message Subject||Subject line of the email on the email viewed|
Click on the log to view the Event Properties, and use the View the Email Message button to view the email itself. Remember, you will only be able to access the content of the email with the appropriate permissions.
Accessing the message in this way, a new Message View log entry will be created.