Journal Mailbox Sizes - EV Version 8.0.2.1693

[marky_mark1979]

We have jounal mailboxes configured within our organisation which seem to be working, our problem is these journal mailboxes are escalating in size rapidly.

Our EV deployment was done my a 3rd party and im sure i remember them saying the journal mailboxes should never reach any significant size.

My question is have they miss configured or forgot to configure something that prevents these mailboxes reaching such sizes.

[RahulG]

When you set up journalling, the email get archive as soon as it archvies in the journal mailbox . Check if there are any errors related to the journalling task in the event log . make sure the task is not set to run in report mode . login to the Journal mailbox see if any specific king of messages are there which are not getting archice .

[Mohawk_Marvin]

As long as EV can open and scan the mailbox it will archive from it. The bigger concern for journal mailboxes is the space left on exchange for them. 

Depending on your environment, you will tend to find that during heavy email hours (lunch times etc) that the journals fill up a bit more and they should clear down over night when it is quiet.

I have seen some journal mailboxes with 16+million items in the inbox and EV still archiving from them! 

[marky_mark1979]

I've had a quick look and our journal mailboxes are not part of the AD group we have setup for archive enabled.

Im guessing they should be ??

[marky_mark1979]

I remember the 3rd party who configured the system saying that these mailboxes shouldn't fill up at all and should effectively just act as a pass through mailbox.

Like you say depending on the environment i'd expect to see maybe a slight backlog at peak times but our journal mailboxes are getting huge in size.

Our biggest journal mailbox is nearly 10GB now, as i said before they are not members of the AD group we have set for archiving.

As it was all configured by a 3rd party my understanding on exactly how the journal should behave is a bit vague so any advise on where to look / what to check would be much appreciated.

[TonySterling]

The obvious things to check are:

1. Is the journal task running
2. Are items in the Journal Archive
3. What is the safety copy strategy for the Journal Vault Store
4. What is the message class of the item in the Journal mailbox

[Nick_White]

I'll add "Has the correct mailbox been added as a Journal target for the Journal task?" to that list :)

[GertjanA]

Hi Mark,

Journal Archiving happens 'automatically' when setup. the mailbox does not need to be enabled for archiving, this happens when you configure it.

What you can check is the following:

1 - In the Vault Console (VAC), expand the Exchange servers where the journalmailbox(es) are on, and examine if they are visible.

2 - In the VAC check to see if on the Vaultserver you have there is a Journal Archiving task.

Open the properties of that task, in tab General, verify it does not have a tick at 'report' mode. If it does, remove it, restart task

3 - On the journal archiving tab, click Targets. Are all your journalmailboxes in here?

4 - Still in the VAC, expand vault-store-group, vault store. Is in the rightpane the column 'backup mode' empty? If empty, verify also that there is no registry setting in place for read-only mode (hklm\software\kvs\enterprise vault\storage should not have keys like 'enablestorage')

5 - on the ev-server running journal-archiving, open computermanagement, open MSMQ, private queues. Verify you have queues having 'j1' to 'j6' (i believe) in it. Check if they have items in them. Click refresh a few times to see if the numbers move. What is interesting is the Storage Archive queue, see if items get in/out.

Verify MSMQ is NOT ad-integrated (rightclick MSMQ, properties, click security. If you get an error, it is NOT ad-integrated). Verify that there is no limit on the queues (MSMQ properties, General), or that it is high.

6 - in the VAC, what does your status say?

7 - Did you check the eventlogs? Symantec Enterprise Vault, Application mainly

8 - Can you verify the partition used has free space enough (expand vault store groups, vault store, partition, you will see which physical path is used in the properties of the partition.

9 - can you verify you have exclusions for the EV locations (index, storage, msmq, tempfolder) set in your antivirus application?

10 - If all this does not work or leads to a reason why the mailbox is growing, use an outlook client to logon to the mailbox. possibly it takes long loading it, but at least you might be able to see why it is failing.

11 - any idea on what goes into the journalmailbox (large mails? Large attachments? )

11a look on the forum for NSPI (might be an issue), and the number of concurrent connections, and which Outlook on the EV-server

12 - reboot ;)

13 - call a consultant back in.

Good luck!

[Liam_Finn1]

grab some screen shots of the journal task config, journal policy and so on so we can see your setup because flying bline is not going to help you find a solution

[marky_mark1979]

[marky_mark1979]

Have checked all the things in the list and we have the following error in the event log. It would seem that this error is recorded for every message that hits the journal.

[marky_mark1979]

The obvious things to check are:

1. Is the journal task running -Yes
2. Are items in the Journal Archive - Yes
3. What is the safety copy strategy for the Journal Vault Store - After backup (immediate for journaling)
4. What is the message class of the item in the Journal mailbox - Not sure exactly what u mean here, just seems to be a list of every message sent within our organisation ?

Tony Sterling

[marky_mark1979]

I'll add "Has the correct mailbox been added as a Journal target for the Journal task?" to that list :) - Yes i have checked these and they all seem correct

[SHI-CRO]

you don't want to use the journaling mailbox as the system mailbox for the journaling task.  I don't think EV will archive mailboxes that are used as system mailboxes on archiving tasks.

*Edit: NM this.  Looks like that's not a journaling mailbox after all.

[kr2011]

Marky Mark- we have the same situation here, even configured by a 3rd party (maybe the same one). We're looking at the EV Sql server where the logs and transactions are getting backed up. I think EV is configured properly but its not getting backed up and it needs to get backed up first before the transaction logs can be truncated. I'll be watching your post for direction. thanks to all who are replying.

[GertjanA]

Hi Mark,

I suspect that the Vault Service Account does not have the proper rights on the Exchange servers, and you are not using the Vault System Mailbox. And why do you have a UNC path to the indexes?

I suggest you do the following:

Run deployment-scanner, logged in as Vault Service Account. Target only the exchangeserver where you have the journal-mailboxes on. Verify the right for the VSA are correct.

Create a NEW Enterprise Vault System Mailbox on the server where the journal-mailbox resides.

Stop the task that archive DHIS.

Create a NEW task, only targeting this DHIS mailbox, use the EV-system mailbox.

Start the task.

Check MSMQ to see if items get in/out.

GJ

[Nick_White · Accepted solution]

The MAPI mutex error normally points to a problem with creating Outlook profiles on the EV server. Can you check the number of profiles you have on the server right now. You should see 5 per archiving agent by default, plus a few others. If you have many more than that number I would recommend stopping the archiving tasks, deleting the profiles that look something like "VaultxxxAgent-ExchangeServer-xxxx-xxxxxxxxxxxxxx" and then restarting the agents to see if that resolves the issue. If it does then you may wish to check that you have the latest supported service packs and fixes for Outlook installed on the EV server

[GertjanA]

Hi Mark,

I'm really curious te learn if you got it working?

Thanks for an update

[marky_mark1979]

GJ

We will be looking into your latest suggestion today, we have however run the deployment scanner and that returned ok.

Will keep you posted, our 3rd party yesterday suggested it may be a sharing violation but we have not explored that option at all yet.

Regards

Mark

[marky_mark1979]

The MAPI mutex error normally points to a problem with creating Outlook profiles on the EV server. Can you check the number of profiles you have on the server right now. You should see 5 per archiving agent by default, plus a few others. If you have many more than that number I would recommend stopping the archiving tasks, deleting the profiles that look something like "VaultxxxAgent-ExchangeServer-xxxx-xxxxxxxxxxxxxx" and then restarting the agents to see if that resolves the issue. If it does then you may wish to check that you have the latest supported service packs and fixes for Outlook installed on the EV server

Removing and recreating all the profiles seemed to fix the problem, Outlook also needed a service pack on the EV server. To date all but one of the journal mailboxes has now reduced down to less than 200mb (one days worth of messages)

The one that hasn't reduced in size is targeting a different exchange server so were currently comparing the configs for any differences.