Let's say I have 5 messages that all originate from the same DL. This DL contains 6000+ plus recipients and also includes several nested groups. It takes sometimes 45 minutes to archive a single message as the Journal Task is attempting to expand this list prior to archival. The problem is that it takes 45 minutes each, for all of these messages. Does EV not cache this DL and then reuse for purposes such as this?
EV journalling does have a DL cache so it should come into play here. Like all caches however they have a certain size and a lifetime. So it's possible that between one instance and another instance of the message, perhaps the DL cache is becoming full or expirying.
If you dtrace the journaltask you should see mentions of cache refresh etc and that i think may tell you why it's deciding to clear the cache and therefore we can work out what we need to tune on your system to make the cache more effective.
One other point that I would like to add is the following. I have noticed that since upgrading to Exchange 2K3 the amount of time that it takes to expand these DL's has nearly trippled. One thing that was noticed in the DTrace is that apparently we now make calls to AD to verify the validity of the AD account, see as follows:
CLDHelper::ExpandDistributionList - Member has associated AD account
When Journaling against Exchange 5.5 this entry is not in the DTrace. Please provide some details if possible, but if that is the case, are we making calls to AD to make sure that the address being cached does exist?