EV 9 Journal Archiving - empty embedded msg in enveloppe

[GertjanA]

Hello all,

I am investigating a little isse. We have some messages in journalmailboxes that are not archived. I checked a few, and the one common thing they have is that the original message has an embedded empty message in it. (see attachment.)

What you see is the message in the Journal Mailbox. When opening that, you see the original mail as attachment. When you open that, there is somewhere an embedded message (msg file). When you open that, it is empty, stating "this message has not been sent".

Is it expected these messages are not archived? Has anyone seen this before?

Thanks.

[TonySterling]

What events are generated when the message fails?

[GertjanA]

not sure. this is a very loaded ev-server. it looks like it is:

Log Name:      Symantec Enterprise Vault
Source:        Enterprise Vault
Date:          10-4-2013 14:33:29
Event ID:      3070
Task Category: Journal Task
Level:         Warning
Keywords:      Classic
User:          N/A
Computer:      servername.europe.intranet
Description:
The following message could not be archived as it may be corrupt.

Title: in behandeling
Mailbox: /O=removed/OU=EXCHANGE ADMINISTRATIVE GROUP (FYDIBOHF23SPDLT)/CN=RECIPIENTS/CN=ZZ_JNL_VPNLCMS92071C

No further attempts will be made to archive this message. The message has been moved to the 'Enterprise Vault Journaling Service\Failed to copy' folder.

[JesusWept3 · Accepted solution]

Yeah it should be moved to failed to store or failed to copy, it happens from time to time, usually see it when it's a txt file attached instead of a message But really it has to be troubleshooted from the exchange gateway to determine how the messages are coming through in the first place I know one company that had that it was a unix smtp server in their environment sending out non standard smtp mails that was causing issues with exchange and they simply created rules for it to not go to the journal mailbox