EV duplicate items with journaling

Two things -

Prevent them getting to the journal mailbox

* setup journaling rules (Exchange 2007 or higher)

Custom Filtering once they hit the journal mailbox

* You could write a custom filter rule (maybe) to not journal archive the items via EV

so you're journaling the "journalmailbox_IM" mailbox? can you move it to its own store without journaling enabled?

>> * setup journaling rules (Exchange 2007 or higher)

Unfortunately still running Exchange 2003

>> * You could write a custom filter rule (maybe) to not journal archive the items via EV

I looked into this, we already do some custom filtering, but the options are pretty limited (e.g. no option to not archive an email based on an originating server IP) so don't think that will work. These items still need to be journaled, it's just that they are currently getting journaled twice. The IM and Email journaling is in the same site and therefore shares the same custom filter. I guess I could have a custom filter to send stuff to a specific vault store based on subject, but I think I will still end up with duplicates.

EDIT - also thought about a transport rule to change the message class of the IMs and have the custom filter archive based on that... but no transport rules in Exchange 2003.

>> so you're journaling the "journalmailbox_IM" mailbox? can you move it to its own store without journaling enabled?

We could, what would that give us? We need to journal these IMs for compliance purposes. Are you proposing we archive that mailbox instead of journaling it?

Thanks!

Put this mailbox:

 (journalmailbox_IM)

On it's own Exchange Information Store, and don't enable journaling for that particular store.

Then you can either 'archive' that mailbox or target it with journal archiving (i'd suggest the former)

Sorry, I was mistaken journalmailbox_IM is not journaled, it is an ordinary mailbox just targeted for journal archiving.

Okay, so please re-summarise.

And try to explain why things are being archived/journaled twice.. and where.

And try to mention actual product names, this might also be helpful.

in exchange 2003, journaling is at the store level. is the journalmailbox_IM in its own store where journaling is not enabled?

Thanks all. Let me try to clarify:

1. We have a 3rd party product from Actiance called Vantage which proxies IM traffic - it emails IM transcripts to a mailbox called journalmailbox_IM

2. journalmailbox_IM is an ordinary mailbox targeted by journal archiving in EV, going to Vaultstore_IM

3. When Vantage emails the IM transcripts to journalmailbox_IM, it spoofs the TO/FROM headers, so these transcripts appear as being sent to/from ordinary Exchange users instead of IM buddy names (this allows for easy searching in DA etc.)

4. We have another mailbox called journalmailbox_email where ordinary mail is journaled to, this is targeted by a separate journal archiving task in EV, going to Vaultstore_Email

5. So this is what happens. John Citizen's ordinary email is archived to Vaultstore_Email. John Citizen's IMs are archived to Vaultstore_IM. All good so far.

6. However, when Exchange 2003 receives an IM transcript emailed from Vantage, because the TO/FROM headers are spoofed and appear as an ordinary email, Exchange also journals this email, and therefore it winds up in Vaultstore_Email. This is the problem - we're getting IM transcripts archived to 2 vault stores.

Hope this is clearer! 

until you tell me otherwise, i feel like i just have to repeat what i said at first. it sounds like you have the journalmailbox_IM sitting on a database in an information store in Exchange 2003 that is enabled for journaling. if you move it to its own IS and don't enable journaling, you'll solve the problem.