Cisco Cisco Email Security Appliance C160 Mode D'Emploi

New MIDs (message IDs) are created for each message splinter (for example, MID 1 becomes MID 2 
and MID 3). For more information, see the “Logging” chapter. In addition, the 

trace

 function shows 

which policies cause a message to be split.

Policy matching and message splintering in Email Security Manager policies obviously affect how you 
manage the message processing available on the appliance. 

Because the iterative processing of each splinter message impacts performance, Cisco recommends 
configuring your content security rules on a managed exception basis. In other words, evaluate your 
organization’s needs and try to configure the feature so that the majority of messages will be handled by 
the default mail policy and the minority of messages will be handled by a few additional “exception” 
policies. In this manner, message splintering will be minimized and you are less likely to impact system 
performance from the processing of each splinter message in the work queue. 

↓ 

 

Messages are splintered immediately after 
message filter processing but before anti-spam 
processing:

 

 

 

 

DLP scanning is only performed on 
outgoing messages.