Cisco Cisco Email Security Appliance C690 User Guide

If you have configured your anti-virus settings to deliver unscannable or 
encrypted messages, these messages will be counted as clean messages and not 
virus positive. Otherwise, the messages are counted as virus positive.

Stopped by Content Filter: The total count of messages that were stopped by a 
content filter.

Clean Messages: Mail that is accepted and is deemed to be virus and spam free 
— the most accurate representation of clean messages accepted when taking 
per-recipient scanning actions (such as splintered messages being processed by 
separate mail policies) into account. However, because messages that are marked 
as spam or virus positive and still delivered are not counted, the actual number of 
messages delivered may differ from the clean message count.

Messages that match a message filter and are not dropped or bounced by the filter 
are treated as clean. Messages dropped or bounced by a message filter are not 
counted in the totals.

As messages proceed through the email pipeline, they can apply to multiple 
categories. For example, a message can be marked as spam or virus positive, it can 
also match a content filter. The various verdicts follow these rules of precedence: 
Outbreak Filters quarantining (in this case the message is not counted until it is 
released from the quarantine and again processed through the work queue), 
followed by spam positive, virus positive, and matching a content filter.

For example, if a message is marked as spam positive, and your anti-spam settings 
are set to drop spam positive messages, the message is dropped and the spam 
counter is incremented. Further, if your anti-spam settings are set to let the spam 
positive message continue on in the pipeline, and a subsequent content filter 
drops, bounces, or quarantines the message, the spam count is still incremented. 
The content filter count is only incremented if the message is not spam or virus 
positive.