# Search mail logs and server activity

To search server logs, open the admin console and go to **Manage Server › Search**. The **Search** tab finds mails by sender or recipient over up to 31 days. The other tabs show Traffic Analysis, Password Log, Service Log, Login Log and Storage Log. Pick a tab, enter the dates or address and click the search button.

## How to search mail logs and server activity

1. Open **Manage Server › Search**. The **Search** tab opens first.
2. Set **From Date** and **To Date**, then type a **Mail From** or **Rcpt To.** address.
3. Add **SMTP IP**, **Subject** or **Size** to narrow the result, then click **Search**.
4. To see another report, click its tab: **Traffic Analysis**, **Password Log**, **Service Log**, **Login Log** or **Storage Log**.

## Search tab

The box is called **Find all mails that have**.

| Field | What it does | Default |
|---|---|---|
| **From Date** / **To Date** | The days to look in, picked from the calendar as dd-mm-yyyy. You cannot pick a future date. The two dates can be about one month apart at most. | Today |
| **Mail From** | Sender address. Must be a valid email address. | empty |
| **Rcpt To.** | Recipient address. Must be a valid email address. | empty |
| **SMTP IP** | The IP address of the machine that sent the mail. Must be a valid IP address. | empty |
| **Subject** | Words from the subject line. | empty |
| **Size** | Choose =, <, >, <= or >= and type a number in KB. | = |
| **Search** | Runs the search. | |

You must fill **Mail From** or **Rcpt To.** (or both). The result table has the columns **Header**, **Mail From**, **Rcpt To**, **Attachments**, **Subject**, **KB**, **Received** and **Last Action**. Use **Header** to see the mail's header lines.

## Traffic Analysis tab

This tab has four sub-tabs.

| Sub-tab | What you enter | What you see |
|---|---|---|
| **Total Traffic** | **From Date** and **To Date**, then **Go**. | Per day: **Incoming** mails and **Total Data (KB)**, **Outgoing** mails and **Total Data (KB)**, for the whole server. |
| **Domain Traffic** | A domain name (check it with the validate button), the dates, then **Go**. | The same figures for that domain. |
| **User Traffic** | A user's **Email Address** (check it with the validate button), the dates, then **Go**. | The same figures for that mailbox. |
| **Top Traffic** | Nothing. | A **Top 10 Traffic** table with **Max Incoming** and **Max Outgoing** columns. |

## Password Log tab

Use it to find accounts whose passwords have or have not been changed.

| Field | What it does |
|---|---|
| **From Date** / **To Date** | The period to check. |
| **Email / User / Domain name** | Limit the report to one address, user or domain. Leave it empty to see results for the whole server. |
| Selector | **Never changed**, **Not changed** or **Changed**. |
| **Go** | Shows the result: **Active user**, **Last Login On**, **Last Password Change On** and **Expiry Date**, with page links. |

Above the result, **EXPORT TO EXCEL** downloads it and **send Mail** lets you mail the people listed.

## Service Log tab

Shows four panels side by side, one for each of **SMTP-IN**, **SMTP-OUT**, **IMAP** and **POP**, with that service's recent log.

## Login Log tab

| Field | What it does |
|---|---|
| **Email Address** | The mailbox to check. Click **Go**. |

The result lists **Last Login Ip**, **Login Date**, **Service** and **Browser**, then a table of **Login IP**, **Date**, **Time** and **Service**. A login IP shown in red is logged in now or did not sign out properly. **Export To Excel** downloads the log.

## Storage Log tab

Enter **Date From** and **Date To** and click **Submit Query**. You see the **Currently Running Plan** and a table with **Sr. No.**, **Activation Date**, **Activated Upto**, **Plan Name** and **Available Space**.

## Example

> A client of acme.in says a mail from tender@vendor.in never arrived. Rohit opens **Manage Server › Search**, sets the dates to the last three days, types tender@vendor.in in **Mail From**, and clicks **Search**. He sees the mail in the list and reads its header to confirm it reached the server.

## Good to know

- Only a server administrator sees **Search** under **Manage Server**.
- To find a single domain or user quickly, use the box at the top of the admin console instead.

## Common questions

**Why does the search say the date range is out of range?**

The gap between **From Date** and **To Date** can be about one month at most, and **From Date** cannot be later than **To Date**. Search in smaller slices.

**Can I search without giving an address?**

No. Enter at least one of **Mail From** or **Rcpt To.** in the **Search** tab.


Source: https://docs.xgenplus.com/server/search-server-logs/