Journal Mailbox folders with Enterprise Vault

[Wayne_Humphrey]

Have you ever looked inside an Exchange journal mailbox after it's been targeted with Enterprise Vault?  If you have never opened your Enterprise Vault journal mailbox with Outlook, then you should! In this article I'll give a brief list of the folders that the mailbox may contain and what they mean to the health of your Enterprise Vault journaling environment.

Remember that not all of these folders will be present, and even if some are it doesn't mean that you have to immediately try to change something to 'fix' a problem. The list is more for you to gain an understanding of what the folders are, and what they might mean.

Above Maximum Size

In the Enterprise Vault journaling policy you can configure a limit to the size of the messages that will be journal archived. Hopefully your Exchange administrators are sensible and have some sort of maximum message size in place on the Exchange environment, so you could mirror that same size in this particular policy setting, or, you could take the decision that you want the Enterprise Vault maximum to be lower.  Whatever limit you set in the Enterprise Vault policy messages exceeding that limit will be placed here. A lot of items in the folder may mean you have either got the policy setting wrong, or something else is wrong in your environment causing massive messages to arrive (and be left unprocessed)

I always think it is a good idea to have (sensible) limits in place. The default is as you seen in the screenshot, 250 Mb. That to me seems quite large, users shouldn't really be emailing files/messages of that size.  However, if the limit is too high, or too low, you can adjust it. You can even set it to zero, which means that there is no limit whatsoever.  

I advise against using the 'no limit' option option however.  

One thing to remember here is that items above the size limit you specify will be left in the journal mailbox meaning that the mailbox grow in size.

Here is the folder in the journal mailbox on my test environment:

Failed Codepage xyz

The appropriate code pages are needed in order to process messages with that code page. So to fix this problem you should install the correct code page, or use the default ANSI code page. After you've done that step you should move these messages back in to the Inbox to be processed by the journal task. This folder shouldn't really contain any items, so if it does, rectify the problem and then retry the messages.

You can force Enterprise Vault to use the default code page by removing the entry from CodePages.txt file shown in the Enterprise Vault program folder.

Failed DL Expansion

If Distribution List expansion is turned on in the journaling policy (and it should be for journaling!) any distribution list expansion failures will result in the message being moved to this folder. The folder should not contain any items really, a build up of messages here might mean that Enterprise Vault is talking to a Global Catalogue server which has incomplete data.

You can set the option in the policy to archive the item anyway, even though it failed distribution list expansion, but before doing so it is worth investigating why the failure is happening in the first place.  Remember that if you archive the item anyway, then you're compromising in someways the integrity of the data because you can not prove who did or didn't receive that particular message.

Failed External Filter

This contains messages which have failed to be processed by a custom filter. A build up of messages here means that the filter might not be correct. The event log sometimes contains more information about the reason for the failure.  Of course if you don't use custom filters then nothing should be in this folder.

Failed to copy

This is usually messages which are corrupt. You can try dragging them to your desktop and double clicking on them. If they open correctly you can try dragging them back to the journal Inbox for reprocessing.  Again a big build-up of messages here isn't healthy for your environment.

Failed to store

This folder contains messages which cannot be archived. They may have failed because of an issue with the Storage Service. Again this folder shouldn't have any items in it, and if it does you may want to see if there is an issue with the storage service, rectify it, then drag and drop the items back to the Inbox in the journal mailbox and try them again.

Invalid Journal Report

This contains messages where the P1 envelope message doesn't conform to Microsoft standards. This folder should also not contain any items.  In the past I've seen items in this folder when Antivirus software has modified the P1 message because of suspect content.

The net result here is that these various folders should be pretty much empty all of the time in a healthy Enterprise Vault Exchange journaling environment. You can also see how it is important to check the journal mailbox regularly, as a build of messages may indicate a problem, and if nothing else is likely to mean that your journal mailbox starts to get very big, very quickly.

How do you monitor your journal mailboxes? Have you ever had a build of items in any of these queues?  Let me know in the comments below...

Reference:

Monitoring journal mailboxes

[GertjanA]

Excellent post, thanks Wayne!

[TonyD2]

We have a VBScript that runs a couple of times a day and emails a report that contains the total number of items (and MB used) in the mailbox as well as listing each (sub) folder with the number of messages in it.

We typically see DL Expansion, Invalid Journal Report, and Failed to Copy issues.

[John_Santana]

Thanks for sharing the article Wayne.

[John_Santana]

Hi Tony, can you share that script here for the benefits of the team ?

[AndrewB]

for what it's worth, you should be able to accomplish this with the get-mailbox and get-mailboxfolderstatistics powershell commands. you could have the results emailed or piped to a file and stored somewhere.

[caribtel]

Nice article ... thanks for sharing.

[Baris_A]

Thank you for your sharing!

[Ben_Shorehill]

Great post!

[patriot3w]

Thanks for sharing.

[TonyD2]

I didn't write this and I'm not sure where i originally found it (maybe scriptingguys?). It's not very pretty but works...good luck!

Output looks something like this:

Mailbox - JournalMBX
Top of Information Store
-- Conversation Action Settings : 0
-- Deleted Items : 0
-- Enterprise Vault Journaling Service : 0
---- Failed DL Expansion : 5
---- Failed to copy : 3
---- Failed to store : 0
---- Invalid Journal Report : 10
-- Inbox : 37
-- Junk E-Mail : 0
-- RSS Feeds : 0
-- Sent Items : 0
Storage Used in Mailbox - JournalMBX            (msgs):     60 (bytes): 6,144,457

Code to send email message with file, note you will need to redirect the output or modify the script to output to a file rather than the console. We email the report a couple of times a day to monitor the number of messages in the mailbox.

ToAdd = "user1@foo.com;user2@foo.com"
FromAdd = admin@foo.com
SMTPServer = "smtp.foo.com"

ServerSubject = ("Journal Repository Mailbox Count")

MsgBody = ("Journal Repository Mailbox Status") & vbcrlf & vbcrlf

MsgBody =  MsgBody & CreateObject("Scripting.FileSystemObject").OpenTextFile("C:\Status\JournalMBX-Status.txt", 1).ReadAll

Set objEmail = CreateObject("CDO.Message")
 objEmail.Configuration.Fields.Item ("http://schemas.microsoft.com/cdo/configuration/sendusing") = 2
 objEmail.Configuration.Fields.Item("http://schemas.microsoft.com/cdo/configuration/smtpserver") = SMTPServer
 objEmail.From = FromAdd
 objEmail.To = ToAdd
 objEmail.Subject = ServerSubject
 objEmail.Textbody = MsgBody
 objEmail.AddAttachment "C:\Status\JournalMBX-Status.txt"
 
objEmail.Configuration.Fields.Update
objEmail.Send

Here's the code to generate the report. You might need to run cscript.exe from c:\windows\syswow64\

' USAGE: cscript ProcessNotesEmails.vbs SERVERNAME MAILBOXNAME

' This requires that CDO 1.21 is installed on the computer.

Dim rc, strDate, strLogFile, Level

'Get date/time formatted as YYYYMMDD_HHMMSS
strDate= Year(Now) & Right(Month(Now)+100, 2) & Right(Day(Now)+100, 2) & "_" & Right(Hour(Now)+100, 2) & Right(Minute(Now)+100, 2) & Right(Second(Now)+100, 2)

'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
' START OF USER CONFIGURABLE VARIABLES '''''''''''''''''''''''''''''''''''''''''''''

strLogFile="C:\temp\chk-ev-myvault.log"

' END OF USER CONFIGURABLE VARIABLES '''''''''''''''''''''''''''''''''''''''''''''''
'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''

PrintLog "Starting script"

' Get command line arguments.
Dim obArgs
Dim cArgs

Set obArgs = WScript.Arguments
cArgs = obArgs.Count

Main

Sub Main()
   Dim oSession
   Dim oInfoStores
   Dim oInfoStore
   Dim oInfoStore2
   Dim oRootFolder
   Dim oFolders
   Dim StorageUsed
   Dim NumMessages
   Dim strProfileInfo
   Dim sMsg

'   On Error Resume Next

    'Open log file
    'Append to log file
    '

    Dim oFSO, oFile
    Dim strData
    Dim strPattern, strReplace
    Dim strD

    Const ForAppending = 8

    strD = FormatDateTime(Now(),0)

    Set oFSO = CreateObject("Scripting.FileSystemObject")

'    If NOT oFSO.FileExists(strLogFile) Then
         Set oFile=oFSO.CreateTextFile(strLogFile)
'    End If
   
    oFile.WriteLine strD & " - " & "End of Run"

   If cArgs <> 2 Then
      printlog( "Usage: cscript script.vbs SERVERNAME MAILBOXNAME")
      printlog( "  e.g. cscript script.vbs svr smitha")
      Exit Sub
   End If

   'Create Session object.
   Set oSession = CreateObject("MAPI.Session")
   if Err.Number <> 0 Then
      sMsg = "Error creating MAPI.Session."
      sMsg = sMsg & "Make sure CDO 1.21 is installed. "
      sMsg = sMsg & Err.Number & " " & Err.Description
      printlog( sMsg)
      Exit Sub
   End If

   strProfileInfo = obArgs.Item(0) & vbLf & obArgs.Item(1)

   'Log on.
   oSession.Logon , , False, True, , True, strProfileInfo
   if Err.Number <> 0 Then
      sMsg = "Error logging on: "
      sMsg = sMsg & Err.Number & " " & Err.Description
      printlog( sMsg)
      printlog( "Server: " & obArgs.Item(0))
      printlog( "Mailbox: " & obArgs.Item(1))
      Set oSession = Nothing
      Exit Sub
   End If

   'Grab the information stores.
   Set oInfoStores = oSession.InfoStores
   if Err.Number <> 0 Then

      sMsg = "Error retrieving InfoStores Collection: "
      sMsg = sMsg & Err.Number & " " & Err.Description
      printlog( sMsg)
      printlog( "Server: " & obArgs.Item(0))
      printlog( "Mailbox: " & obArgs.Item(1))
      Set oInfoStores = Nothing
      Set oSession = Nothing
      Exit Sub
   End If

   'Loop through information stores to find the user's mailbox.
   For Each oInfoStore In oInfoStores
      If InStr(1, oInfoStore.Name, "Mailbox - ", 1) <> 0 Then
         '&HE080003 = PR_MESSAGE_SIZE
         StorageUsed = oInfoStore.Fields(&HE080003)
         if Err.Number <> 0 Then
            sMsg = "Error retrieving PR_MESSAGE_SIZE: "
            sMsg = sMsg & Err.Number & " " & Err.Description
            printlog( sMsg)
            printlog( "Server: " & obArgs.Item(0))
            printlog( "Mailbox: " & obArgs.Item(1))
            Set oInfoStore = Nothing
            Set oInfoStores = Nothing
            Set oSession = Nothing
            Exit Sub
         End If

         '&H33020003 = PR_CONTENT_COUNT
         NumMessages = oInfoStore.Fields(&H36020003)

         if Err.Number <> 0 Then

            sMsg = "Error Retrieving PR_CONTENT_COUNT: "
            sMsg = sMsg & Err.Number & " " & Err.Description
            printlog( sMsg)
            printlog( "Server: " & obArgs.Item(0))
            printlog( "Mailbox: " & obArgs.Item(1))
            Set oInfoStore = Nothing
            Set oInfoStores = Nothing
            Set oSession = Nothing
            Exit Sub
         End If

     ProcessMailbox(oInfoStore)

         sMsg = "Storage Used in " & oInfoStore.Name & space(40 - len(oInfoStore.Name))
         sMsg = sMsg & " (msgs): " & space(6 - len(FormatNumber(NumMessages,0,,-1))) & FormatNumber(NumMessages,0,,-1) & " (bytes): " & FormatNumber(StorageUsed,0,,-1)
'         printlog( sMsg)
'         printlog( "Number of Messages: " & NumMessages)
         WScript.echo sMsg
'         WScript.echo "Number of Messages: " & FormatNumber(NumMessages,0,,-1)
      End If
   Next

   ' Log off.
   oSession.Logoff

   ' Clean up memory.
   Set oInfoStore = Nothing
   Set oInfoStores = Nothing
   Set oSession = Nothing

   oFile.WriteLine strD & " - " & "End of Run"
   oFile.Close

End Sub

Sub ProcessMailbox(oIS)
  WScript.echo oIS.Name
  WScript.echo oIS.RootFolder.Name

  For Each oF in oIS.RootFolder.Folders
    'Process top-level folders

    'Ignore non message folders?
    'If Name in ("Journal, Contacts, etc") then continue.

    If oF.Name = "Calendar" OR oF.Name = "Contacts" OR oF.Name = "Drafts" _
    OR oF.Name = "Tasks" OR oF.Name = "Notes" OR oF.Name = "Outbox" _
    OR oF.Name = "Journal" OR oF.Name = "Calendar Attachments"   Then
    printlog ("Skipping:   " & oIS.Name & "/" & oF.Name)
    Else
'       printlog(  "Processing: " & oIS.Name & "/" & oF.Name)
       Level = 0
       ProcessFolder(oF)
    End If

  Next

End Sub

Sub ProcessFolder(StartFolder)
   Dim objFolder
   Dim objItem
   Dim iCount

   Level = Level + 1

'   printlog( "                     " & StartFolder.Name)

    iCount=0
    For Each objItem In StartFolder.Messages
       iCount=iCount+1
    Next
    WScript.Echo String(Level*2,"-") & " " & StartFolder.Name & " : " & FormatNumber(iCount,0,,-1)
       
   ' process all the subfolders of this folder
   For Each objFolder In StartFolder.Folders
       Call ProcessFolder(objFolder)
   Next
   

'End If

    Level = Level - 1
    Set objFolder = Nothing
End Sub

Sub printlog(strMessage)
    Dim strD

    strD = FormatDateTime(Now(),0)

'    oFile.WriteLine strD & " - " & strMessage

'    Wscript.Echo strD & " - " & strMessage
   
End Sub