When searching for messages in the Message Audit Log (MAL) from the Control Center Status > Message Audit Logs page, the results contain more than the expected 1000 entries or fewer than the expected number of entries for the specified time range.

This is expected based on the operation of Message Audit Logging and query limits.

The MAL query results displayed in the SMG Control Center contain one entry per recipient for each matching message result. This means that a message which matched the query parameters which has multiple recipients would display one result line in the SMG GUI per recipient. So while the total number of results may be limited to 1000 per scanner, this can results in more than 1000 entries in the displayed query results.