Differen approaches: more journal mailboxes, longer mailbox archiving?

[Simon_Eijs]

Hi,

As you may have noticed, we're still working on possible archiving scenarios for out project. Now that we have more realistic numbers on # emails to journal, # of mailbox items to archive, SIS requirements, etc. we have come up with some options which we would like to validate.

Assumptions:

- Use as less as possible Exchange mailbox servers.

- Use as less as possible journal archiving servers (virtualized).

- Use as less as possible mailbox archiving servers.

- Keep the number of items in a Journal mailbox limited to 15.000-25.000 (in case the journal archiving is shut down for whatever reason).

Option:

1) Use a Journal mailbox for every mailbox store. We would start with around 20, and grow to around 35 journal mailboxes.

We know about additional load on the Exchange servers, but assume the Exchange server could be configured to allow for this additional archiving load from the Journal archiving processes.

Q1: Which parts of the Exchange (2007) is important to review? Store process (more memory), Network, IOPS, other areas? Would a separate Journal Mailbox server be an alternative?

2) Don't run mailbox archiving only after office hours, but also during the day (18-24 hours per day).

Q1: Is there any experience with this, and if so, what to look for?

Q2: Is there a reason not to do it?

Thanks in advance.

Regards, Simon

[GertjanA]

Hello Simon,

I am not sure I can advise on your Exchange setup, as I have no experience yet with Exch2007, but here is my thought.

It seems overhead to have a journal mailbox per store. We have 1 journalmailbox per cluster (exch2003) (6+2, where 1 = only journaling) This works very well. Journalmailbox has on average less than 100 items in it. I do not see the need to prepare for 'shut down', because in the last 4 years this did not happen at all, except for maintenance. I feel this all depends on your retention for the journals (indefinite? 1 year?). We have retention of 182 days. Our journal stores are constantly around 900GB. (per journalserver)

We run all EV-servers on VM, ESX, which runs very well. We virtualized last december, no complaints. The index and store disks are still in a SAN, and perform well. MSMQ is in the VM, and works well.

2) Don't run mailbox archiving only after office hours, but also during the day (18-24 hours per day).

Q1: Is there any experience with this, and if so, what to look for?

Depends on what you allow users to do. Can they delete items from archive? volume? age and quota based archiving? Possibly risk of users deleting mails that are at the same time being processed by EV? Not sure, because I am not in this position. I personally do think that it is best to archive out of office hours.

Q2: Is there a reason not to do it?

Backup. To make sure you have a consistent backup, EV needs to be in read-only. EV8 is 'easier' as it uses these powershell cmdlets, which allow the backup team to decide when to run backup (ie set EV in read-only). Depending on mailboxsize, mailvolume, mailsize, it might be benifical to have EV archive as long as possible, again, your call. We have EV archiving from 18:00 tot 06:00, as the majority of users is not in the office at that time. Backup's are being done from 06:00 to 18:00 obviously.

Hope this helps.

Gertjan

[Alan_M]

1) One journal mailbox per store is excessive. It just adds administrative overhead with limited benefits. Each store should be relatively small (depending on E2K7 configuration 200GB is going to be max (for SCC or CCR) and realistically you will probably need to make it much smaller to meet restore time SLAs.). I would certainly suggest a dedicated journal storage group and db but unless you have thousands of users a dedicated journaling server would also be excessive. There are some fairly standardized calculations for determining the impact of journaling.

Q1) All of the core hardware resources (memory, cpu, disk, network) are important to Exchange but memory and disk need special attention. There are simple guidelines from MS on memory so follow them. Storage is a different matter but the MS storage calculator for Exchange will help you through the IOPS calculation process. One thing to focus on with journaling is if your typical read/write ratio for exchange is 2:1 then you should normally allow 30% overheard for journaling IOPS (because Exchange only writes to the journal) however with EV you need to allow for reads. These reads typically aren't in the same pattern as a user so I would not suggest 100% overheard for Journaling but somewhere in the region of 50% to 60% overheard is reasonable. Some people suggest that 1:1 read/write ratio is possible with E2K7 but this is heavily dependent upon your user usage profiles.

2) I would suggest not running mailbox archiving during the  day. It adds a load to Exchange and your EV server. In larger environments this load might be sufficient to impact the server significantly. Run it every night and user larger archiving periods over the weekend.

[Simon_Eijs]

Hi,

The main reaons for having 1 hournal mbx for every store is that:

- people will be spread over the 20-35 mailbox stores

- there are/may be different retention policies for different people

- we expect around 300.000 journal reports per day (this is before recaclculation with 'unique sharers' and with the fan-out factor) and growing each year

- the use of Jorunal Rules for different retention catagories was not acceptable: a mailbox will always be journaled (when journaling is enabled on the Store), while a user 'may not be part of a journal rule' for whatever reason which means his/her Email may not get journaled. Paranoia??

The main reason for the longer archiving period is that:

- there is no real weekend (this is a global company)

- we expect around 225.000 items to be archived per day (and growing each year)

- calculations showed we needed 4x 8 cores to process this in 6 hours (18:00-24:00) which we tried to bring down

Maybe we're to pessimistic.

Simon

[GertjanA]

Hi Simon,

My 2-cents.

Journaling is set per store, not per user. If you are not using a cluster setup, you might need to setup a few journalservers. Let's say you have 35 standalone exchangeservers. Let's say these are spread through 6 or 7 locations. Setup 1 journal server per location, and have the seperate mbxservers journal to that one journalserver. JournalArchive that one server.

Assuming you talk about EV Retention, that is no problem. You set this up in EV, choosing an OU or whatever differentiation you want to use.

Your amount of journaling should not be a problem.

Mail is either journaled or not. EV archives journal or not. If needed, you will have to put all users you do not want to be in the journalmailbox on a server where you set NO Journaling.

All depends on retention for the journaling, backup schema's etc. You might want to draw a final plan, then ask Symantec for a scan of the plan, and possibly advice.

Again, good luck.

Gertjan