When querying the Message Audit Log (MAL) via the graphical user interface (GUI) for message details on a Symantec Messaging Gateway, there is a message displayed on the screen.

The message audit log query may have returned partial results.  Please use the Audit ID filter and select All Scanners to get complete results.

In some multi scanner environments a message can be processed by multiple different scanners and the Control Center, depending on the actions taken. Holding a message in the content quarantine and then releasing it can generate audit events not only on the scanner which initially scanned the message but also on the Control Center host when quarantined and possibly on a difference scanner when released.

Selecting a single SMG scanner when doing audit log queries may not collect all audit date for a particular message. If information is missing from MAL query results, ensure that all SMG systems are selected when querying audit log data.