CA and reviewing messages ???

[Phil_McDougal]

Hey all,

I created some new departments and employee groups and I have the journaling connector running.  But it's been about 24hrs and I don't see any messages available for review.  Do I have to enable a search schedule or something?  I was hoping to have it run automatically with the journaling to pull our 10% monitoring of messages.

Any thoughts or sugggestions?

Thank you!
PM

[Rob_Hanson]

Phil,

I assume that you have set up all of your departments and added the user's to the departments, and you have correctly configured all the roles within CA?

Check the Customer database, do you have entries in the the following tables? (one is all you need)

tblCapturedItems

tblVaultSamples

tblIntDiscoveredItems

If not then you need to log a support call, as there is an issue gathering the data from the Journal connector.

Also try Dtrace on the the Compliance Service and see if that is processing anything.

Regards

Rob

[Phil_McDougal]

Thanks Rob.

Yes, all the department, users and roles are set up.  I just noticed that the messages run exactly 24 hrs after the time I activated the departments.  It ran Yesterday and Today at 1:30PM Central which is the same time I finished creating all the departments.  Does the Journaling manage and calculate the 10% to be reviewed all day and then dumps those messages to the Departments at a specific time (like my 1:30PM) frame?

I'll log a call with Symantec to see what their thoughts are.

Thank you for the info Rob.

PM.

[Rob_Hanson]

The answer is yes, because the sampling is based on a 24 hour period.  It is a random selection from the journal for that period.