This article explains why you may find differences between data represented in the Reporting section of the Administration Console, and an Archive search.
Q: If you send a message to six external recipients, how many messages is that in total?
A: It depends on where you look.
The index doesn't return all recipient addresses. For example:
Even though the message was sent to four addressees, the information stored in the index is one message sent to one recipient and three others. If you were to run an export of the results, it wouldn't be possible to display all the recipients. You can search based on the other recipients, but they'd be returned visually by the index due to the way the data is held.
The Message Transfer Agent (MTA) however, sent the message to four recipients. Therefore the total outbound message flow was four, but there was only one message sent by the sender in Mimecast. Mimecast's reporting also includes all rejected / bounced messages.
The main aim of our reporting functionality, is to provide business intelligence relating to mail flow through Mimecast. These can be:
- Point in time based using predefined options in the Administration Console with the date picker.
- Scheduled via PDF compilation.
As we are concerned with mail flow, each recipient is counted as a separate message sent.
Take the following example of an apparent issue with daily message totals. There is a significant difference between the total email flow for outbound messages via reporting, and an Archive Search conducted for all outbound messages. The image below shows the breakdown for the day in question, which displays 91977 outbound messages.
If an Archive Search is run with the same date selected, and all outbound messages selected as the route filter, 7760 results are returned. This is a significant difference between the number displayed in the report. However a quick check of the top outbound senders report, shows that one user sent 83898 messages.
If you compare that to an Archive Search for the same date and address, 674 results are returned. On further investigation it shows a series of messages were sent from this address to 291 recipients. In fact 295 messages were sent to the same 291 recipients, resulting in a total mail flow of 85550 messages.
Don't compare Archive Search results with Reporting. The data included in each is very different. If you need to account for any differences, look at the Top Outbound Senders reports to show who sent the most. A little time spent looking into the 'and X others' parts of the results usually point you in the right direction.