Journaling

[mjkqb]

Exchange 2007

EV 10

My goal is to eliminate Read Receitps and other message classes from being archived.

I am using journaling on the Exchange server to a mailbox. That mailbox is the target of Exchange Journaling on EV server.

I do not have report.Report.IPM.Note.IPRN added a a message class on the EV  server. Yet, Read Recipts get archived. I also do not have IPM.Octel.Voice added but all the voice mail messages get archived also. It seems that anything that goes into the journal mailbox gets archived.

Question: Everything going into the journal mailbox is basically a report with the actual message included as an attachment. The journal  report has a message class of IPM.Note. Do you think that is why everything is being archived, maybe it doesn't look at the attached message, only the report? Also, what happens to the report? I don't see it in the archive, only the messages that were contained within the report.

I'm curious if others are doing the journaling the same way I am or some other approach.

I have had success removing some of these messages using custom filters, but I would prefer to use the message class approach instead.

Thanks in advance.

[AndrewB]

since you're doing envelope journaling, the original message gets wrapped with an envelope which is a valid message class per the archiving rules you configured. as far as i know, the way you're doing it with filtering is the right approach. as for what happens to the envelope when it gets archived, the data is indeed stored but it is split up into different parts of EV and indexed so that it can be searched on.

[mjkqb]

Thanks Andrew. Is there any other method of journaling that would not include the report, just the message itself?

[JesusWept3 · Accepted solution]

i think you have it pretty much done with the custom filters.
what is the reason for not wanting to use them if it resolves the issue?

[mjkqb]

LESS OVERHEAD!!!

[mjkqb]

So, I'm assuming that the enveloping doesn't affect the way the attched message gets processed. SIS would still be working for duplicate attached messages.

Also, I need to get the absolute most out SIS since we have very limited disk space.

I was reading the following thread:

http://www.symantec.com/connect/forums/single-instancing

You commented:

by default its 5 threads per task, whether its the journal task, archive task or what not.
You could have 3 journal mailboxes looked after by the same task, and since you can only have one thread per mailbox, you would theoretically have three mailboxes processing at the same time with two threads spare as opposed to serially processing them.

So if you have one task, three journal mailboxes, the same item hitting all three mailboxes at the same time, you could see this situation quite often

Is this an issue I would need to be concerned about? Is there a way to avoid it. Should a separate journaling task be created for each journaled mailbox?

[John_Chisari]

Well by the sounds of things you only have one journal mailbox you are archiving - so it shouldn't affect you too much - unless of course someone sends separate emails with the same attachment at the same time and they are both archived at the same time - what are the chances of that happening?

[mjkqb]

For every message that is filtered, there is an error in the Enterprise Vault event log:

Event ID 3435

"Failed to process a message. This message will not be archived and could not be changed back from the Archive Pending state. This problem can occur when a message has large numbers of recipients or attachments."

 Is this normal?

Can it be turned off?

Thanks