Email Appliance Mail Trend Reports

Hi everyone,

On the Sophos Email Appliance, I've been comparing the Mail Trends-Volume report and the Mail Trends-MessageActions report, and i find discrepancies that cannot be reconciled. I'm trying to get a count for how many messages have been quarantined due to additional policies other than spam. does anyone have specific details on how each of these reports are configured to report data? For example:

• does 'message actions' report include both inbound and outbound messages? The message volume report separates incoming and outgoing messages, but the message actions doesn't appear to.
• if so, should the 'delivered' field in message actions roughly equal the 'legitimate' field from message volume (if i total inbound and outbound 'legitimate' messages)? Mine don't match by a wide margin.
• if i subtract 'blocked connections' from the totals in the volume report, i actually get less than my totals for message actions, but there is no matching field for 'blocked connections' in message actions, and the difference isn't apparent in any other field on the message actions report.

I need to report on message trends to Management, as well as decide on whether another mail solution will be necessary. Can anyone help make sense of the reports? Thanks,

Brian