EV archives items outside the configured Mailbox policy

[Marcde]

Hello together, 

a customer is facing a strange behavior with mailbox archiving. The mailbox archiving tasks archives items outside the configured policy. Policy is configured to archive everything older than 90 days and only age based but the task archives all items in the mailbox.

The mailbox archiving report states: Completed: No eligible items but the colum items archived shows us that some items got archived.

This applys to all currently activated mailboxes which are about 10 as this is still a test phase. We checked the Enterprise Vault settings in the mailbox and they seem to be as configured.

Customer has custom filtering activated for mbx (jrn as well) and sets DO_NOT_ARCHIVE to items with a specified DL as sender or recipient. May it be related to the custom filtering? 

Someone seen this before? 

Version is 11.0.1 CHF5 with Exchange 2007 SP3. Fresh installation

[Marcde]

Further testings in a lab show us that it seems to be related to custom filtering. When setting the override entry to 1 the tasks applys the filter to the items that match and it also archives items which are outside of the policy. 

Setting the override entry to 0 only applys the filter to the fitting items but does not archive additional items. items get only archived based on the policy but the custom filter does not work. 

The documentation states something completely different:

Optionally, you can create a new DWORD entry with the name Override, and set its value to 0 (zero). By changing the value of this entry you can control whether the Exchange Mailbox task applies the custom filtering rules during archiving:

■ 0 (zero) — The Exchange Mailbox task applies the custom filtering rules to all messages.

■ 1 — The Exchange Mailbox task does not apply the custom filtering rules.

If the Override entry does not exist, then the task applies the custom filtering rules to all messages.

Is the documentation wrong or do we just understand that wrong? 

[AndrewB]

can you post your custom filter settings?

[Marcde]

Content of the Default Filter Rules.xml 

<?xml version="1.0"?>

<RULE_SET xmlns="x-schema:ruleset schema.xdr">
<RULE NAME="set_NoArchive AUTHOR" ACTION="MARK_DO_NOT_ARCHIVE">
<AUTHOR>
<EA>tester@test.local</EA>
</AUTHOR>
</RULE>

<RULE NAME="set_NoArchive RECIPIENTS" ACTION="MARK_DO_NOT_ARCHIVE">
<RECIPIENTS>
<EA>tester@test.local</EA>
</RECIPIENTS>
</RULE>
</RULE_SET>

In addition the registry settings described in the setting up exchange server archiving.pdf. 

REG_SZ 1 = EnterpriseVault.CustomFilter

REG_DWORD MoveOnFilterFailure = 0

REG_DWORD Override = 1

[Marcde]

I've read the documentation carefully again and found out that this is the correct behavior when no rule matches. 

By default items that do not match any rules are archived by the mailbox archiving
task or the journal archiving task. If you want to archive only items that match a
rule, you can create a catch-all rule as the last rule in the ruleset file.

We expanded our tests and it seems that Override = 0 should be the correct setting. When setting this to 0 items get archived based on the policy and the filter applys to items which would have been archived otherwise (based on the policy).