Forum Discussion

Igs's avatar
Igs
Level 3
12 years ago

filtering for Journal Archiving

Hi everyone,

I did some checking and found that our SCOM server generates so much mail that it's probably worse than any spam. Obviously it gets archived as it passes through the journaling mail box and ultimately ends up in the Journal Archive. It always comes from the same address scom.admin@mycompany.com.

I wish I could filter this sender out from archiveing completely. And probably same goes for the reciepient. Has anyone emplemented anything similar? I will appriciate any help.

I'm running EV 901 and Exchange 2007

Igs

Enterprise Vault
Information Governance
  • TonySterling's avatar
    TonySterling
    Moderator
    12 years ago

    Your filter will look something like this:


     <RULE NAME="SCOM Mail" ACTION="HARD_DELETE">
       <AUTHOR INCLUDES="ANY" ALLOWOTHERS="Y">
          <EA>scom.admin@mycompany.com</EA>
       </AUTHOR>
     </RULE>

     

    Also, here is the link to Robs article, the above link didn't seem to work:

    https://www-secure.symantec.com/connect/articles/custom-filtering-enterprise-vault

    Since his article is for Mailbox you will need to tweak it for Journaling.  Also check out these TN's:

    Example ruleset file for custom filtering

    Article:HOWTO58121  |  Created: 2011-08-01  |  Updated: 2012-09-23  |  Article URL http://www.symantec.com/docs/HOWTO58121

     

    Exchange Server and journal filtering

    Article:HOWTO56325  |  Created: 2011-08-01  |  Updated: 2012-09-23  |  Article URL http://www.symantec.com/docs/HOWTO56325

     

  • Igs's avatar
    Igs
    Level 3
    12 years ago

    Tony. Thank you. Excatly what I needed. Adopting it for Journaling is no problem.

     

  • Igs's avatar
    Igs
    Level 3
    12 years ago

    After I create the reg entries and the Filter Rules.xml, the task appears to start. However, I did not create the Custom Properties.xml file, as I really can't figure out what it's for. As this file is missing EV gives off a warning:

    The custom properties definition file could not be found - custom property indexing and categorisation functionality has been disabled.

    I'm not sure if EV journaling functionality is impacted by this.

  • Rob_Wilcox1's avatar
    Rob_Wilcox1
    Level 6
    12 years ago

    No it'll be fine without it.

     

    Remember one of the other reasons for doing custom filtering is to add additional index attributes and categorisation to messages - that's what the custom property file is for.  As you're not doing that, you don't need it.

  • Igs's avatar
    Igs
    Level 3
    12 years ago

    Rob, thank you very much. Appriciate your help

  • Igs's avatar
    Igs
    Level 3
    12 years ago

    Just put it in. All started OK (with that warning message). Running dtrace to test. and will search the journal mail box