Enterprise Vault 9.x - Virtual Vault only?

[BigAnvil]

I'm thinking about creating a policy that would NOT automatically archive user emails in the mailbox policy but would let them archive their emails by dragging them to their virtual vault.  I trying to think of why this might not be a good strategy.  Apart from those users bumping against their Exchange mailbox quotas, I can't think of one.  If anyone has some input on this, I'd love to hear it.

Thanks!

[JesusWept3 · Accepted solution]

Well it depends what you're using it for, mailbox management or compliance?
ff it's compliance (which end user archiving isn't compliance anyway) then it becomes selective

The downsides though really come from the fact that the EV servers have a finite amount of connections that can be made at one time, so if everyone is hitting the server, attempting to upload, download, sync etc, a lot of people may end up getting an error saying that the connection is busy.

Also you have to be careful in regards to the fact that Virtual Vault and Vault Cache can become a little bit of a headache and isn't the easiest thing to troubleshoot if/when something goes wrong, such as a continual failure to synchronize or getting error messages that say they're corrupt

Most of the updates to client always tend to have fixes to the virtual vault client (This has been especially true with the EV8 SP4 hotfix, EV8 SP5, EV9, EV9 SP1, EV9 SP1 cumulative hotfix etc) so you are continually getting fixes and improvements which mean the users have to reinstall newer clients etc if they have issues or to pre-empt issues they might see down the road.

There is also a chance of dataloss with Virtual Vault that cannot be overlooked, for instance lets say someone is going away on vacation for two weeks, to try and stop their mailbox from going overquota they shove *Everything* in to their virtual vault...... for those items to be safe on the enterprise vault server, they need to synchronize and give it enough time to synchronize.

But on the same token, lets say that the help desk have arranged to re-image the machine whilst the user is on vacation (very convenient for the end user), well if the synchronization did not go through properly and it gets re-imaged, then they have just lost all the email that they thought they had synchronized.

Also in the same breath, a lot of helpdesks will end up just resetting the vault cache because a lot of times it can resolve issues when they come up, but it ends up being a sledgehammer approach, if the user is awaiting to upload items, or has moved a bunch of items around that haven't been synchronized, and then the help desk or someone else resets the cache, well they've just lost all the changes they've made

And lastly if you are in a position where there are failures to synchronize and someone has moved a ton of items in to the virtual vault, the only way to determine the items that are awaiting to upload is by using Virtual Vaults "Search Folders" where it has a section of items that are awaiting upload, or items that have failed to upload.... The problem being though is that it all appears as one folder, so if they have dragged in say 100 folders, and the vault cache becomes corrupt, sure they can get the items back by copying the items back to their mailbox, but they will lose the folder structure, not knowing where the items came from.

[teiva-boy]

Control.  You control and manage the Exchange environment, not the users.  Why would you reverse the control and give it to the end-users?  Policies in EV can be very aggressive or not, it's up to you.  Start at 1yr, start at emails over 8MB, heck only do it for certain users or groups.  

Virtual Vault is a "NICE to have."  

Archiving data to optimize storage, improve server performance, improve maintenance tasks, and shrink backup windows; not to mention fulfill compliance needs, is a "NEED to have."

[JesusWept3]

Well compliance isn't really driven off of user archiving, real compliance is gained from journaling
But you'd be surprised at the amount of companies that will give users things such as 1 year, 3 year and 7 year folders within outlook and will not archive anything from inbox\sent items etc, and will only archive out of those retention folders.

In practice, using Virtual Vault and only virtual vault is no different.

[BigAnvil]

JW2  - So if understand correctly, with regards to limited connections/resources, if I move forward with only providing users the ability to drag and drop items into their virtual vault as a means of archiving I will likely run into issues due to the connections and I/O demand placed on the EV server.

Would setting a policy to automatically archive items based on age reduce that I/O problem consderably though? I understand that items would be archived off-hours based on the schedule we set, but there would still be many users moving files to their virtual vault.

In my environment, I disagree with tevia-boy.  We have tons of users, many with very large PSTs and we have less control over users putting everything ever sent or received in there.  That, combined with users really needing to be able to organize everything in a folder hierarchy, the need for things to be simple (read: PST like), and to also keep user interaction at a minimum (or the policy won't be successful).  Virtual Vault is a NEED to have and not a NICE to have.

There is a NEED to have PST like functionality that is reliable and easy in order to reduce the email management headache.  You'd be amazed (or maybe not) at the number of users who would have no idea what to search for if they need to find an archived email.  Those same users would know they kept an email in a certain PST folder though and would be able to find it quickly.

[JesusWept3]

Have a read of this

http://www.symantec.com/business/support/index?page=content&id=TECH75381

Its an indepth whitepaper about optimizing your environment for virtual vault and may answer a lot of questions from a system overhead perspective

[Rob_Wilcox1]

We do have several customers that use Virtual Vault this way... as a kind of filing mechanism, and in EV 9 there is threshold based triggers that you can use which will cause those items which were dragged and dropped in to Virtual Vault to be "pushed" up to the Enterprise Vault server sooner than the normal 24 hour synch period.

Some of whether you should do this depends on the size of your environment.

And there is an element of risk involved.  After you drag and drop the item from the mailbox to Virtual Vault it is now no longer in Exchange (obviously) and it's not in the Enterprise Vault archive yet either.  So if that machine crashes, or files become corrupt, those items *could* be lost.  No different than allowing users to drag and drop data to PSTs though, in my opinion, but, it's just something to be aware of.  Don't think that by dragging and dropping to Virtual Vault that the items are "magically" in the users archive.

[BigAnvil]

Rob - thanks for the reminder.  JW2 - thanks for the link. 

I don't know a thing about software architecture so I understand my naivety here:  Since we are already doing Exchange journaling with EV, why can't EV simply tag emails according to who they were from or who they were sent to as a means of linking them to a user archive instead of having to archive mailboxes separately?  EV is doing almost twice the work to provide a mailbox archive view to the user this way.

Then it would simply be a matter of switching someone's "view" on or off to provide access to items that should be in their own archive.  Wish it could be done.

[BigAnvil]

One more thing before I forget (trying to find the answer myself right now) - Is the data that is archived via virtual vault compressed in any way or is it byte for byte like a PST?  I'm just trying to figure out whether 100 MB of data moved to a persons' virtual vault is going to take up 100 MB of space on the EV server.  I'm guessing this data is SISed which will save a little space.

[Rob_Wilcox1]

From EV 8 onwards Optimised Single Instance Storage does just that.  It can be configured so that data is shared between vault stores in a vault store group.  This means if something is archived in a users mailbox in one vault store, and subsequently (days or weeks or months later) is archived by another user in a different vault store, only one copy of that item exists...  the fingerprint database keeps track of the linakges as it were.

There is still a small per user item that is stored, because a mail that you receive versus a mail that I receive is SLIGHTLY different.

What you suggest about journaling and mailbox archiving isn't quite right.

Yes, data is compressed by EV.  Much of this is described in technotes and the Admin Guide I believe.