Email Journaling vs. Email Mailbox Collection

[Darryl_R]

Email Journaling vs. Email Mailbox Collection

Many questions have appeared over the last few months regarding the differences between Mailbox collection and Journaling.. So What are the differences and how can we use them in our presentations?

We see all sorts of different system configurations and variations to cater for different customer scenarios, but in most cases you’ll need to consider which combination of “journaling”, and direct connection to individual mailboxes you’re going to use to archive your email.

Method 1: Direct mailbox collection

This archive option is available to you by configuring Enterprise Vault so it connects to your Exchange or Domino server with the ability to access all of your accounts in one go, or with the credentials of each user to access your mailboxes individually.

The pros and cons of connecting directly?
 

Pros:

Historic mail – If you want to pull in some existing mail, so anything older than this point in time, this is really the only effective way to do it quickly and the way we’d recommend you do it.

Mailbox management – Connecting to mailboxes individually gives you the ability to purge messages once they’ve been collected. This is how you’d automatically manage mailbox sizes to prevent them from becoming overloaded.

Folder structures -  Connecting directly enables you to synchronize the folder hierarchy and essential if users wish to have the ability to browse their folders exactly as they’re used to seeing them in Outlook.

Exclusions - unlike journaling which would simply take a copy of everything, you’ll also be able to add exclusions so certain folders aren’t archived when your jobs run.

Message locations – As users move messages between folders in Outlook, connecting directly synchronizes the locations with those stored in the archive so emails are always where you expect them when you use the browse view in Enterprise Vault.
 

Cons:

Not a good compliance tool – running archiving jobs periodically allows a window of time when users could potentially delete or modify email before they’re archived. This means you can’t class this method as suitable for audit purposes. You would need safeguards in place so mail items were not deleted prior to the archive run.

Job times – the main drawback on larger deployments is that just the time it takes to connect and view lots of mailboxes can be lengthy, this restricts this type of job to being suitable for running once a day only.

Slow initial import – when you pull in your historic email, you’re likely moving a significant amount of data so this is always going to take quite a while due to network/ bandwidth limitations. Of course you only need to do this once.

Network load – the overhead of connecting to multiple mailboxes is much greater than polling a journaling account and usually something we see users schedule outside of working hours.

Method 2: Journaling

Despite the fact it’s a feature of Exchange, it’s a term that when I mention it to customers, still causes those momentary silent pauses so a quick clarification before I start. In this context, it’s the process of using another dedicated mailbox to store perfect, unmodified copies of every message that comes and goes from the mail server (including messages sent between users internally). These mail “copies” are sometimes referred to as compliance copies.

Enterprise Vault uses this journal mailbox archiving 24/7/365 then clearing out the contents from the Exchange Information store. As a result, this journaled mailbox should only ever contain messages that haven’t yet been archived.
 

So a quick look at why journaling may or may not be a good idea for you…
 

Pros:

Compliance – this is the only way to ensure a copy of every email ends up in your archive store. Particularly if you need to keep mail for long periods because of industry legislation, you’ll definitely need to journal.

Regularly updated – it’s not practical to check lots of mailboxes regularly on an individual basis as it would take too long in most cases, but using a journaling account you can keep your archive updating every few minutes should you wish.

Sorting – this method automatically reads the information in the email headers to sort and allocate messages to the relevant users

Low overheads – it’s an efficient way to trickle email into the archive all day

Cons:

Historic mail – journaling only archives new email from the time it is configured, it’s not possible with this method alone to archive old existing messages (although you can still upload PST’s)

Mailbox management – there’s no direct connection to users mailboxes so it’s not possible to prune older, already archived messages. Used alone, a Journal job wouldn’t tackle the issue of users keeping hold of large volumes of email 

Folder structures – Journaling will only create in a single layer archive with no individual user folder structure. Since the Journal mailbox is technically just another mailbox, the mail arrives and would be archived from the Journal account “inbox”.

So that’s cleared it up then? Which is best for my environment?

My advice is that if you can, configure Enterprise Vault to run both a regular journaling job, and a daily mailbox archiving task. While this article is a compare and contrast article, ideally you will not have to choose. There are many articles and tools available for accurate sizing of these environments.

Using each method really does provide you with the best of both worlds, in summary, the combined headline benefits being:-

- Protection against message deletion/ modification

- Fully audit compliant

- Automated management of mailbox sizes

- Ability to browse folders AND to search the archive

Hope this clears up some of the mystery around this topic!