Enterprise Vault Journaling Warning

[erikterr]

Hi, in our enviroment we use Enterprise Vault for Exchange archiving and Brightmail for antispam services.

Every day we recieve a lot of warnings about Journal Archiving, like this: 

The problem seem to be when we configured antispam for erase some attachments from any mail into our company (like .gz ect..)

Is any solution or workaround for solve this warning? Or in the worste case, is possible to "tell" to EV to ignore this warning into event viewer?

Tnx

[JesusWept3]

I don't think you can turn it off to be honest, usually it's good if you have a large influx of email that's invalid which could point to a misconfiguration on the exchange side But by doing this are you sure you are not breaking compliance?

[erikterr]

Hi Jesus, 

tnx for your reply. In our journal messages are "trunked". We receive a lot of emails of performance logs of our customers. These logs are visible on an internet page, than we don't need to have it into mails (but we cannot disable). The we decided to mark the attachments of these mail as "spam" and brightmail trunk it (we have only the text of the email, without the attachment). By do this, we have this problem inside EV. 

[JesusWept3 · Accepted solution]

you will probably have to log an idea in the ideas forum to be honest, maybe there is a reg key that im not aware of (i know there certainly is a key to stop *all* events from being logged but thats not what you want in the slightest)

[BigPhil]

As JW said, dont mess up your compliance by removing things from messages before they are journalied. If its of no concern to your company then I would suggest using Enterprise Vault Custom Filtering (see the EV documentation for how to configure custom filtering). This way you could remove the entire message from journaling so the event may not be logged in this case.

[erikterr]

Hi Phil,

I already have custom filtering, my problem is with the "changed" journal messages; When brightmail drop the attachment of the message, I have an "invalid journal message" then, EV doesn't archive it (It put the message in "unarchiviable items") and give me the warning in the event log. I asked if it's possible to not have this warning on the log (only this..)

Tnx for your interest.

[erikterr]

I think too is a reg key to be used, i tried to find into reg guide but i didn't find anything for my problem