It's possible to generate dozens of email reports in a given SMTP environment, and I'm interested in learning what reports are common in large installations and how they are used.
- Messages sent/received per user /day (Check for spam, routing loops with bouncebacks)
- Bytes sent/received per user / day (Check for abuse, ISOs over email, and data theft)
- Last message sent / received (Check for unused dormant accounts)
- Last Logon date (Unused accounts)
- Relay source IP / User (spam)
- Failed SMTP authentication attempts (User/Pw brute force)
I read on SO Meta that scoped, finite "list" questions are on topic, and am therefore asking here with the expectation it won't be closed.
Please note: for broad utility, I'm only interested in SMTP-POP3-IMAP reports.
Exchange and AD specific reports are probably best for another question