We have been journaling for 6 months and have now installed CA. Having installed CA and created the appropriate departments, we find that we cannot run ad-hoc searches prior to the creation of the department in CA even though we have historical data in the journal archive reaching back 6 months.
Has anyone else run into this? We have made committments to the compliance team that we could start capturing data while they worked out the details of the CA user synchronization and departments and they could preform reviews to satisfy the SEC back to the point we started journaling.
Is there any way to correct this?
I am curious what Symantec tells customers who already have EV and are journaling when they try to upsell the CA product...."sorry but all the previous journaling you have been doing is worthless?"