Mail Security logs performance counters and events to the following locations:
Windows Application Event Log
Server events and policy violations are reported in the Windows Application Event Log. The Mail Security console provides an Event Log page that lets you view Windows Application Event Log entries in chronological order with the most current event at the top. The Event Log page displays information, warning, and error events.
Mail Security logs extensive report data on threats, security risks, violations, spam, and server information to a reports database. You can use this data to generate summary or detailed reports based on different subsets of the data. When you define a report, you specify criteria such as the time span of the collected data, whether to show specific violations or all violations, and the output format of the report.