I'm trying to understand how this actually works as reviewing the logs there seems to be the same messages from other days. Also the initial day we enabled the policy the logs are like 5mb compares to the past few days 1mb??
I assume the BES is taking an "inventory" of what is either on the SIM or left in the PIN/SMS "mailbox" .. is that correct?
It's pulling the content from the message database(s) on the device itself.
On the device, even if a user deletes a PIN or SMS message from the inbox, it is still kept in the message store on the handheld so BES can log it. Sneaky.