cancel
Showing results for 
Search instead for 
Did you mean: 

Help with Custom Filtering

MikeK-GT
Level 4

Hello All,

Need help with setting up Custom Filtering in EV12.

I've created REG keys;

CF reg.PNG

Created "Default Filter Rules.xml" as Unicode;

<?xml version="1.0"?>
<RULE_SET xmlns="x-schema:ruleset schema.xdr">

<RULE NAME="FLRNotify" ACTION="MOVE_DELETED_ITEMS">
<AUTHOR>
<DISPN>user@gtlaw.com</DISPN>
</AUTHOR>
</RULE>

</RULE_SET>

Restarted Journaling task, I do not get Event 45329. Journaling is acting like the filter does not exsist. 

Any ideas, what am I missing?

 

4 REPLIES 4

TonySterling
Moderator
Moderator
Partner    VIP    Accredited Certified

Your registry entry is backwords, the Name should be 1 with a value of EnterpriseVault.CustomFilter.

I would recommend to also set the Override and MoveOnFilterFailure keys.

  1. Create a new string value for the new custom filtering setting. The name of this setting must fit into the existing number sequence. If no other journaling filters exist, set the name to 1. Give it the value EnterpriseVault.CustomFilter.
  2. Optionally, you can create a DWORD entry with the name Override, if it does not exist. Set its value to 0 (zero). This entry controls whether the Exchange Journaling task reexamines any messages that are marked as MARK_DO_NOT_ARCHIVE each time it processes the journal mailbox. If the value is 0, or the Override entry does not exist, then the Exchange Journaling task does not reexamine the messages.

    If you later change the rule action, you can temporarily set the value to 1. Setting this value forces the Exchange Journaling task to reprocess any messages in the journal mailbox.

  3. If it does not exist, create a DWORD value called MoveOnFilterFailure and set its value to 1.

    This entry controls whether the Exchange Journaling task moves messages to the folder Failed External Filter when an unhandled error occurs in the external filter. This folder is automatically created when required in the journal mailbox.

    If the MoveOnFilterFailure registry entry does not exist then, when an unhandled error occurs in the external filter, the Exchange Journaling task moves the associated messages to the Enterprise Vault Journaling Service\Invalid Journal Report folder in the journal mailbox.

Haha, good catch. Thank you Tony.

Everything looks good, but I'm still seeing messages Journaled. What did I miss?

<?xml version="1.0"?>
<RULE_SET xmlns="x-schema:ruleset schema.xdr">

<RULE NAME="Exclude" ACTION="HARD_DELETE">
<AUTHOR>
<EA>user@gtlaw.com</EA>
<EA>user1@gtlaw.com</EA>
</AUTHOR>
</RULE>

</RULE_SET>

TonySterling
Moderator
Moderator
Partner    VIP    Accredited Certified

Looks like you might be missing a bit:

<?xml version="1.0"?>
<RULE_SET xmlns="x-schema:ruleset schema.xdr">

<RULE NAME="Exclude" ACTION="HARD_DELETE">
<AUTHOR INCLUDES="ANY'>
<EA>user@gtlaw.com</EA>
<EA>user1@gtlaw.com</EA>
</AUTHOR>
</RULE>

</RULE_SET>