Journaling archive quantity against Exchange Journal Mailbox

I guess you could collect your email stats and compare to what was archived per day:

http://blogs.technet.com/b/samdrey/archive/2013/07/17/exchange-2007-2010-2013-gather-email-statistics-like-exchange-profile-analyzer-used-to-give-in-the-past-but-now-using-powershell.aspx

--Daily Rate by archived date
select "Archived Date" = left (convert (varchar, archiveddate,20),10),"Daily Rate" = count (*),"Size" = sum (Convert(bigint,itemsize))/1024
from saveset
where archiveddate > dateadd("dd", -30, getdate ())
group by left(convert (varchar, archiveddate,20),10)
order by "Archived Date" Desc

or

--Daily Rate by item date
select "Item Date" = left (convert (varchar, iddatetime,20),10),"Daily Rate" = count (*),"Size" = sum (Convert(bigint,itemsize))/1024
from saveset
where iddatetime > dateadd("dd", -30, getdate ())
group by left(convert (varchar, iddatetime,20),10)
order by "Item Date" Desc

tony.wu, i also answered the same question when you posted it last time here https://www-secure.symantec.com/connect/forums/verify-number-mail-between-ev-and-exchange-journal-mailbox

Be cautious when comparing what EV says it did to what Exchange says it did because there are conditions that lead to those numbers not being consistent with each other; for example, the more recent versions of Exchange perform message grouping within the Journal mailbox to allow for additional recipients to be added to the single instance of the message (perhaps there is a server that is slow to expand distribution lists). EV pauses for a few minutes after recognizing that a message has arrived and before archiving it, to allow Exchange to add any additional recipients.  The timing of when EV actually starts archiving and when Exchange stops adding new recipients can potentially lead to situations where the EV numbers and the Exchange numbers no longer match.  This would send you on a wild goose chase looking for those missing messages and could be a very long troubleshooting process (when in reality there is no actual trouble to shoot).

I had a customer many years ago who engaged a partner to write a monitoring solution for the Journal mailboxes. I did not have a lot of visibility into the solution so I unfortunately can't describe what they ended up with.   If your goal is to have a legally defensable proof that you have archived everything that Exchange said it had, then you would need to engage someone for some custom development (and even then, the measure of "legally defensable proof" may not be fully achievable just due to the fact that you have two different products in the mix).  If you just want a decent confirmation that you've done everything you should have, then use Tony's methods above but come up with your environment's unique range of variance. In other words, accept that the numbers might not always be identical and figure out how much variation is normal for you.

Hi,

The EV journaling still has 300 ~ 400 delta different daily.

Do you know why?

Thanks.

Tony