Custom rule to remove jpg's from archiving ?

[pss53]

Has anyone done this ?

We have two mail accounts that mass a lot of photo's which is causing an extra 300gb of data to be archived...

Is there a way we can put in some sort of rule to stop this happening ?

I've read something about the custom filter options, but I've no idea where to start?

Any help would be welcome, 

Thanks,

Paul.

[TonySterling]

I have used Custom Filters to do just this and it works great. 

Rob did a pretty guide write up about the process so between his article and documentation you shouldn't have too much of a problem setting it up.

https://www-secure.symantec.com/connect/articles/custom-filtering-enterprise-vault

Your ruleset will look like this:

<RULE NAME="DeleteJPGs" ATTACHMENT_ACTION="REMOVE">
<AUTHOR INCLUDES="ANY">
    <EA>mike.senior@management.com</EA>
    <EA>jon.little@management.com</EA>
  </AUTHOR>
  <FILES>
    <FILE FILENAME="*.JPG"/>
  </FILES>
</RULE>

See also:

Article URL http://www.symantec.com/docs/HOWTO58121

Article URL http://www.symantec.com/docs/HOWTO37055

HTH

[JesusWept3]

i dont think it will work for embedded images though, right?

[pss53]

So could I just have a "default rules.xml" with just the above in as not sure we need the 60 day retention as explained in Rob's article ?

(And it's attached images not embedded).

[TonySterling]

Right, you don't need to worry with Retention. 

[TonySterling]

Oh, and sorry the article was a bit off topic for you. 

[pss53]

So as I read, I'd just need a default rules xml with the above in and the appropiate registry entries and that's it ???

(sorry am a novice with E.V. but learning very quickly) :)

[TonySterling · Accepted solution]

No problem, but I think you got the concepts.  Set the registry keys and the default rules xml and you should be good to go.

Hopefully you can do this in a lab environment first.  :)

[pss53]

Yes I'll will try it in a lab enviroment first, thanks for your help, much appricated...

[pss53]

Tony, instead of them been "AUTHOR" can I change to "RECIPIENT" as it's not them sending, it's two accounts recieveing them?

Not sure if that's the correct syntax to use ??

[TonySterling]

Yes, it would look like this:

   <RECIPIENTS INCLUDES="ANY" ALLOWOTHERS="N">
     <EA>mike.senior@management.com</EA>
     <EA>jon.little@management.com</EA>
   </RECIPIENTS>

[pss53]

Magic thanks for that !!!

Is there a way to get rid of the exsisting jpegs that may have been missed or will this go through the exsisting stores and get rid of them ?

[TonySterling]

No, the filter will only work on new items.  You could do a search on item in the archive with jpegs but you would have to delete the entire email.

[pss53]

Is there a way to run a query on the database to clear these out ? as doing 50 a time over 36000 emails may take some time...

[TonySterling]

No, you will have to use the WebApp search.  If you do a search with the criteria of recipient and jpeg attachment it will limit your results.

Also, use the advanced search.  http://evserver/enterprisevault/search.asp?advanced