09-29-2011 01:12 PM
Good day all,
I am attempting to get a journaling customer filter going, I have the registry keys set correctly and I am using the following rule.
<?xml version="1.0"?>
<RULE_SET xmlns="x-schema:ruleset schema.xdr">
<RULE NAME="Junk Mail" ACTION="HARD_DELETE">
<AUTHOR INCLUDES="ANY" ALLOWOTHERS="Y">
<EA>mailsender@domain.com</EA>
<EA>another_sender001@domain.com</EA>
<EA>sender@domain.com</EA>
</AUTHOR>
</RULE>
</RULE_SET>
The problem I "think" have is getting the "custom properties.xml" correct. I have the sample one in place now but that seems to be for message class. Any assistance would be fantastic.
Thank you,
Here is the custome properties.xml I am using,
<?xml version="1.0" encoding="UTF-16"?>
<CUSTOMPROPERTYMETADATA xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="customproperties.xsd">
<CONTENTCATEGORIES DEFAULT="MsgClassTest">
<CONTENTCATEGORY NAME="MsgClassTest">
<INDEXEDPROPERTIES>
<PROPERTY TAG="MessageClass"/>
</INDEXEDPROPERTIES>
</CONTENTCATEGORY>
</CONTENTCATEGORIES>
<CUSTOMPROPERTIES>
<NAMESPACE TYPE="MAPI">
<PROPERTY TAG="MessageClass" NAME="0x001A" />
</NAMESPACE>
</CUSTOMPROPERTIES>
<PRESENTATION>
<APPLICATION NAME="search.asp" LOCALE="1033">
<FIELDGROUPS>
<FIELDGROUP LABEL="Content Category">
<FIELD TAG="MessageClass" LABEL="Message Class" CATEGORY="MsgClassTest"/>
</FIELDGROUP>
</FIELDGROUPS>
<AVAILABLECATEGORIES>
<AVAILABLECATEGORY CONTENTCATEGORY="MsgClassTest" LABEL="Message Class Test"/>
</AVAILABLECATEGORIES>
</APPLICATION>
</PRESENTATION>
</CUSTOMPROPERTYMETADATA>
Solved! Go to Solution.
09-30-2011 06:09 AM
I have seen that Tech Note, and I have removed the custom properities.xml. getting the warning. Still seems that the filter is not doing the hard delete. I found
https://www-secure.symantec.com/connect/forums/ev8-sp1-and-journalingI will make a change in my rule and see if that helps.
In the forums rule
<AUTHOR INCLUDES="ANY" ALLOWOTHERS="N">
In my rule
<AUTHOR INCLUDES="ANY" ALLOWOTHERS="Y">
Not sure but worth the try…. Thanks again
09-29-2011 01:45 PM
Why do you want to even mess with properities since you are hard deleting? Is it because of the warnings about it? Those can be safely ignored.
09-29-2011 01:53 PM
Also, you may have seen this but just in case:
https://www-secure.symantec.com/connect/articles/custom-filtering-enterprise-vault
09-30-2011 06:09 AM
I have seen that Tech Note, and I have removed the custom properities.xml. getting the warning. Still seems that the filter is not doing the hard delete. I found
https://www-secure.symantec.com/connect/forums/ev8-sp1-and-journalingI will make a change in my rule and see if that helps.
In the forums rule
<AUTHOR INCLUDES="ANY" ALLOWOTHERS="N">
In my rule
<AUTHOR INCLUDES="ANY" ALLOWOTHERS="Y">
Not sure but worth the try…. Thanks again
09-30-2011 11:20 AM
In other news, here is how you do it :-
1/ Registry
I added the following key :-
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\KVS\Enterprise Vault\External Filtering\Journaling]
"1"="EnterpriseVault.CustomFilter" << i.e. string, called 1, with the value of EnterpriseVault.CustomFilter
2/ File
<?xml version="1.0"?>
<RULE_SET xmlns="x-schema:ruleset schema.xdr">
<!--Example 8: do not archive mail that was sent to someone outside OurCompany-->
<RULE NAME="External Recipient" ACTION="MOVE_DELETED_ITEMS">
<RECIPIENTS INCLUDES="ANY" ALLOWOTHERS="Y">
<EA>tish@tish.com</EA>
</RECIPIENTS>
</RULE>
</RULE_SET>
That lives in :-
And this is how I tested it.
I sent a message from my test user jeff1, to fred@fred.com. It was successfully journaled. I then sent a message to tish@tish.com, and it got moved to the deleted items folder, this is the trace of it :
7145 13:12:58.653 [20608] (JournalTask) <22836> EV:H [CustomXMLFilter] Custom Filter processing message 'test123'
7146 13:12:58.653 [20608] (JournalTask) <22836> EV:L [CustomRules][CRuleSet] CRuleSet::HasRuleEvaluationOfType - RuleEvaluationType [4] [DOES NOT EXIST] in RuleEvaluationTypes [1],
7147 13:12:58.653 [20608] (JournalTask) <22836> EV:L [CustomRules][CRule] Evaluating item against External Recipient rule...
7148 13:12:58.653 [20608] (JournalTask) <22836> EV:L [CustomRules][CNameList] User(EA:tish@tish.com) found in rule clause
7149 13:12:58.653 [20608] (JournalTask) <22836> EV:L [CustomRules][CRecipClause] Evaluated item against recipient list - matched.
7150 13:12:58.653 [20608] (JournalTask) <22836> EV:L [CustomRules][CRule] Finished evaluating item against External Recipient rule; matches
7151 13:12:58.653 [20608] (JournalTask) <22836> EV:M CRule::GetRuleProperties - m_RuleProps is not NULL
7152 13:12:58.653 [20608] (JournalTask) <22836> EV:M [CustomXMLFilter] Reading External Recipient rule properties...
7153 13:12:58.653 [20608] (JournalTask) <22836> EV:L [CustomRules][CRuleSet] CRuleSet::HasRuleEvaluationOfType - RuleEvaluationType [2] [DOES NOT EXIST] in RuleEvaluationTypes [1],
7154 13:12:58.653 [20608] (JournalTask) <22836> EV:M [CustomXMLFilter] Setting recognised ACTION to [3]
7155 13:12:58.653 [20608] (JournalTask) <22836> EV:M [CustomXMLFilter] Filter has set ACTION to [3] - no more filters will be processed for this message.
7156 13:12:58.653 [20608] (JournalTask) <22836> EV:M CEVFilterController::ProcessAllFilters - Time Taken to Process External Filter [EnterpriseVault.CustomFilter]: [0.430948] seconds
09-30-2011 12:48 PM
Hi Richard,
This is what I set up …
1/ Registry
I added the following key :-
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\KVS\Enterprise Vault\External Filtering\Journaling]
"1"="EnterpriseVault.CustomFilter" << i.e. string, called 1, with the value of EnterpriseVault.CustomFilter
2/ File
<?xml version="1.0"?>
<RULE_SET xmlns="x-schema:ruleset schema.xdr">
<!--Example 8: do not archive mail that was sent to someone outside OurCompany-->
<RULE NAME="External Recipient" ACTION="MOVE_DELETED_ITEMS">
<RECIPIENTS INCLUDES="ANY" ALLOWOTHERS="Y">
<EA>tish@tish.com</EA>
</RECIPIENTS>
</RULE>
</RULE_SET>
That lives in :-
And this is how I tested it.
I sent a message from my test user jeff1, to fred@fred.com. It was successfully journaled. I then sent a message to tish@tish.com, and it got moved to the deleted items folder, this is the trace of it :
7145 13:12:58.653 [20608] (JournalTask) <22836> EV:H [CustomXMLFilter] Custom Filter processing message 'test123'
7146 13:12:58.653 [20608] (JournalTask) <22836> EV:L [CustomRules][CRuleSet] CRuleSet::HasRuleEvaluationOfType - RuleEvaluationType [4] [DOES NOT EXIST] in RuleEvaluationTypes [1],
7147 13:12:58.653 [20608] (JournalTask) <22836> EV:L [CustomRules][CRule] Evaluating item against External Recipient rule...
7148 13:12:58.653 [20608] (JournalTask) <22836> EV:L [CustomRules][CNameList] User(EA:tish@tish.com) found in rule clause
7149 13:12:58.653 [20608] (JournalTask) <22836> EV:L [CustomRules][CRecipClause] Evaluated item against recipient list - matched.
7150 13:12:58.653 [20608] (JournalTask) <22836> EV:L [CustomRules][CRule] Finished evaluating item against External Recipient rule; matches
7151 13:12:58.653 [20608] (JournalTask) <22836> EV:M CRule::GetRuleProperties - m_RuleProps is not NULL
7152 13:12:58.653 [20608] (JournalTask) <22836> EV:M [CustomXMLFilter] Reading External Recipient rule properties...
7153 13:12:58.653 [20608] (JournalTask) <22836> EV:L [CustomRules][CRuleSet] CRuleSet::HasRuleEvaluationOfType - RuleEvaluationType [2] [DOES NOT EXIST] in RuleEvaluationTypes [1],
7154 13:12:58.653 [20608] (JournalTask) <22836> EV:M [CustomXMLFilter] Setting recognised ACTION to [3]
7155 13:12:58.653 [20608] (JournalTask) <22836> EV:M [CustomXMLFilter] Filter has set ACTION to [3] - no more filters will be processed for this message.
7156 13:12:58.653 [20608] (JournalTask) <22836> EV:M CEVFilterController::ProcessAllFilters - Time Taken to Process External Filter [EnterpriseVault.CustomFilter]: [0.430948] seconds