Forum Discussion

mjkqb's avatar
mjkqb
Level 4
13 years ago
Solved

Journaling

Exchange 2007

EV 10

My goal is to eliminate Read Receitps and other message classes from being archived.

I am using journaling on the Exchange server to a mailbox. That mailbox is the target of Exchange Journaling on EV server.

I do not have report.Report.IPM.Note.IPRN added a a message class on the EV  server. Yet, Read Recipts get archived. I also do not have IPM.Octel.Voice added but all the voice mail messages get archived also. It seems that anything that goes into the journal mailbox gets archived.

Question: Everything going into the journal mailbox is basically a report with the actual message included as an attachment. The journal  report has a message class of IPM.Note. Do you think that is why everything is being archived, maybe it doesn't look at the attached message, only the report? Also, what happens to the report? I don't see it in the archive, only the messages that were contained within the report.

I'm curious if others are doing the journaling the same way I am or some other approach.

I have had success removing some of these messages using custom filters, but I would prefer to use the message class approach instead.

Thanks in advance.

 

 

 

 

 

Configuring
Enterprise Vault
Information Governance
  • JesusWept3's avatar
    JesusWept3
    13 years ago

    i think you have it pretty much done with the custom filters.
    what is the reason for not wanting to use them if it resolves the issue?

7 Replies

  • AndrewB's avatar
    AndrewB
    Moderator
    13 years ago

    since you're doing envelope journaling, the original message gets wrapped with an envelope which is a valid message class per the archiving rules you configured. as far as i know, the way you're doing it with filtering is the right approach. as for what happens to the envelope when it gets archived, the data is indeed stored but it is split up into different parts of EV and indexed so that it can be searched on.

  • mjkqb's avatar
    mjkqb
    Level 4
    13 years ago

    Thanks Andrew. Is there any other method of journaling that would not include the report, just the message itself?

  • JesusWept3's avatar
    JesusWept3
    Level 6
    13 years ago

    i think you have it pretty much done with the custom filters.
    what is the reason for not wanting to use them if it resolves the issue?

  • mjkqb's avatar
    mjkqb
    Level 4
    13 years ago

    So, I'm assuming that the enveloping doesn't affect the way the attched message gets processed. SIS would still be working for duplicate attached messages.

    Also, I need to get the absolute most out SIS since we have very limited disk space.

    I was reading the following thread:

    http://www.symantec.com/connect/forums/single-instancing

    You commented:

    by default its 5 threads per task, whether its the journal task, archive task or what not.
    You could have 3 journal mailboxes looked after by the same task, and since you can only have one thread per mailbox, you would theoretically have three mailboxes processing at the same time with two threads spare as opposed to serially processing them.

    So if you have one task, three journal mailboxes, the same item hitting all three mailboxes at the same time, you could see this situation quite often

    Is this an issue I would need to be concerned about? Is there a way to avoid it. Should a separate journaling task be created for each journaled mailbox?

     

     

     

  • John_Chisari's avatar
    John_Chisari
    Level 6
    13 years ago

    Well by the sounds of things you only have one journal mailbox you are archiving - so it shouldn't affect you too much - unless of course someone sends separate emails with the same attachment at the same time and they are both archived at the same time - what are the chances of that happening?

     

  • mjkqb's avatar
    mjkqb
    Level 4
    13 years ago

    For every message that is filtered, there is an error in the Enterprise Vault event log:

    Event ID 3435

    "Failed to process a message. This message will not be archived and could not be changed back from the Archive Pending state. This problem can occur when a message has large numbers of recipients or attachments."

     Is this normal?

    Can it be turned off?

    Thanks