Troubleshooting Tip: How to find out who and when released or deleted an email from Quarantine

[ovoda]

Description	This article describes how to determine what action was taken with a Quarantined email (including personal quarantine and system quarantine).
Scope	FortiMail v6.4.x, v7.2.6, v7.4.3, v7.6.1.
Solution	The cross-search log shows the email logs for a maximum of 60 minutes. In some cases, the email can be released or deleted after this time. To find out all the details about the email releasing or deleting is possible to use the Session ID and make a search in the AntiSpam log.  copy the Session ID from the related Cross search log: Search the AntiSpam log using this Session ID. Also, change the time range to start then the email was delivered and Quarantined: The search result shows who is visible and when the quarantined email has been released/deleted: