Forum Discussion

Matt_LB's avatar
Matt_LB
13 years ago

Age of Items Viewed/Recalled - SQL query maybe?

Hi All,

A bit of background first.....

I'm working on a client site that has an EV9 deployment, the current policies do not delete shortcut items from the user mailbox so effectively nothing gets deleted ever.  This combined with Exchange quotas being set very high means that a high volume of mailbox items can be stored.  This has resulted in numerous service stability issues and the client has become a bit agitated.  The main block for us implementing policie that automatically remove shortcut items from the mailbox is the clients perception that this will have a significant impact on the business and is therefore very reluctant to implement this.

What I'd like....

I think I need to produce a histogram that demonstrates how many items are either viewed or recalled from the vault and how old the original email was over the course of a day (or any time period for that matter) so I can plot x amount of items were viewed aged between 30 & 60 days old, y items were viewed aged between 60 & 180 days old etc.  I don't mind getting the raw data and manipulating in excel or something similar.

Thanks for any help in advance

Enterprise Vault
Information Governance
Reporting
  • Wayne_Humphrey's avatar
    Wayne_Humphrey
    13 years ago

    Hi Matt LB,

    You will firstly need to enable auditing. Please see the following technote:

    http://www.symantec.com/business/support/index?page=content&id=TECH49054

    Once you have enabled auditing you will be able to:

     

    Audit events recorded: 
     
    • The time an event occurred.
    • The account that initiated the event.
    • The archive in which an item was archived.
    • The category of the event, such as "View", "Archive", or "Delete".

    Auditing can be enabled for a number of events such as: 
     
    • Actions taken using the Administration Console.
    • Searches.
    • Viewing an item.
    • Deletions.

    For most types of events, details and summaries can be generated: 
     
    • The "Summary" returns information about the event, such as the date and time, account used, and vault used.
    • The "Details" will list more information such as excerpts from the content of a message. For example: Subject, Mailbox Owner, and Folder.
  • Wayne_Humphrey's avatar
    Wayne_Humphrey
    Level 6
    13 years ago

    Hi Matt LB,

    You will firstly need to enable auditing. Please see the following technote:

    http://www.symantec.com/business/support/index?page=content&id=TECH49054

    Once you have enabled auditing you will be able to:

     

    Audit events recorded: 
     
    • The time an event occurred.
    • The account that initiated the event.
    • The archive in which an item was archived.
    • The category of the event, such as "View", "Archive", or "Delete".

    Auditing can be enabled for a number of events such as: 
     
    • Actions taken using the Administration Console.
    • Searches.
    • Viewing an item.
    • Deletions.

    For most types of events, details and summaries can be generated: 
     
    • The "Summary" returns information about the event, such as the date and time, account used, and vault used.
    • The "Details" will list more information such as excerpts from the content of a message. For example: Subject, Mailbox Owner, and Folder.