Acquiring the total number of items used for the random sampling
Hello all,
Concerning Compliance Accelerator, Enterprise Vault;
I'm trying to determine the total number of items that are used (per 24 hours) in order to get the 1%+ random sampling. I understand that this is a per monitored employee query performed from the journal items passed through CA. This would be the total number of items CA would use prior to performing the random sampling. For instance, the 100,000 emails passing through the journal that CA would take it's 1% against. How would I get the 100,000.
- Is there a SQL query that anyone is aware of to get these numbers (either total or per mailbox) or perhaps a report from CA itself?
We've used the Differential Sampling Summary by Department report but there appears to be no comparison between the numbers in that report versus what CA states in the Review. I realize that scanning times and variances most likely make a difference.
We are using CA 9.0.
Thank you!
Greetings, Next012;
In order to obtain a count of items usable for Random Sampling, you would need to obtain a count of the tblVaultSamples table at the start of the Random Sampling time, which is 1:00 AM CA server time by default. This count would need to be quantified to count only those items received prior to "today" unless the hidden Random Capture option "Exclude today's items from sampling (and process them tomorrow)" is disabled.
A few things to note:
Items will not be included for Random Sampling processing if CA has not been able to obtain their KVSSavesetID.
Items wil not be included in Random Sampling processing if they do not have a message direction of 1, 2, or 3 (i.e., items with message direction of 0 will be excluded).
If you are using Guaranteed Sampling (the default sampling type) and run a Guaranteed Sample Search (GSS) to capture items with certain pre-defined hot words or hot word phrases, the Random Sampling processing will only add items to a Department's review set if the GSS does not produce enough items to meet or exceed the sampling percentages specified.
Guaranteed Sampling mode will guarantee 1 message sampled if only 1 message is sent or received by a Department's Monitored Employee. Statistical Sampling will not provide for any message sampled if the amount of messages sent or received by a Department's Monitored Employee does provide enough items. For example, if a Department's percentage of Exchange Outbound messages is set to 10%, the Department has only 1 Monitored Employeed, and that Monitored Employee only sent 1 message yesterday, that Monitored Employee would not have anything sampled for outbound messages as 10% of 1 is only 0.01. Now, if that Monitored Employee had sent 10 messages yesterday, then any 1 of those messages would be sampled using Statistical Sampling.
The sampling percentage used is the highest percentage between the Department, Group, and individual Monitored Employee. For example, a Monitored Employeed who is a member of an Employee Group which is selected for monitoring by a Department has an Employee level sampling percentage for Exchange Inbound message set to 5%, while the Employee Group's Exchange Inbound percentage is set to 10%, but the Department's Exchange Inbound percentage is set to 1%, will have 10% of the Exchange Inbound messages sampled as the Employee Group's Exchange Inbound percentage is the highest (5% vs 10% vs 1% means 10% will be sampled).
Unfortunatedly, the tblVaultSamples table does not contain a column for DepartmentID assignments per message, so we have no way via SQL query to count how many items are eligible for sampling on a per Department basis.
I hope this information helps.
Ken