From http://kc.mcafee.com/agent/index?page=content&id=KB78783

 

One of the things you can do to enable better compliance and auditing is have MEG create audit copies of email messages.  This creates an additional copy of a message sent to a location of your choosing.  While this is great for your next audit, it can also lead to you having a lot of extra email for things that were blocked due to Antispam, Antivirus, or other such scanners.  You can however, have MEG only create an audit copy of messages that were delivered and so messages that were blocked aren't duplicated.  For version 7.0.4 and higher, v. 7.5 and higher, as well as v. 7.6.0 and 7.6.1, you have to edit the smtp-config.xml manually.

 

To enable this functionality, edit the config file as follows:

  1. Open the Appliance management console.
  2. Click System, System Administration, Backup and Restore, and save a copy of the configuration file.
  3. Create a new directory on your client.
  4. Extract smtp-config.xml from the saved configuration file into the new directory and create a backup copy of this file.
    NOTE: Ensure that you do not extract the full zip file, only the XML to be edited. Extracting the full configuration can cause corruption in the configuration.
  5. Open the smtp-config.xml file with Notepad or another plain text editor.
  6. Change the CopyOnlyIfDelivered value from 0 to 1:
    1. Locate the following entry: CopyOnlyIfDelivered="0"
    2. Change "0" to "1".
      For example:
      CopyOnlyIfDelivered="1"
  7. Save smtp-config.xml. If prompted, select .txt and ignore any warnings about removing the formatting.
    IMPORTANT: If you save smtp-config.xml in a rich text format, the data will be corrupted.
  8. Update the configuration zip file with the modified smtp-config.xml. Use Winzip or an equivalent application that works with long filenames.
    NOTE: If you use Winzip, ensure that the full path info option is not enabled. 
  9. Restore the modified zip file to the Appliance via the Backup and Restore page.
  10. Click Apply Changes.

    NOTE: For full instructions on how to back up and edit an Appliance configuration file, see KB56323.

 

 

Starting in v. 7.6.2, we have added a GUI option to enable this functionality.


shot1.png

Click Manage Templates above and a dialog bos like the one below comes up for the notification templates.

shot2.png

Now, click Add to create a new notification template similar to: "Deliver an audit copy to 'Auditing Email List'

shot3.png

Click Next

shot4.png

Click Next

shot5.png

Click Next

shot6.png

Click Next and select the option "Only generate the notification when the email is delivered"

shot7.png

Click Finish and you have a new template called "auditcopy_only_if_delivered" which only generates audit copies for delivered messages.

shot8.png

Click OK and then use the template you just created when sending the notification as seen below.

shot9.png

 

 

This should help reduce the amount of junk you have in your audit mailbox and make it easier to find what you are looking for!