Monitor journal mailbox

[nofreelunch]

Hello,

Does anyone know any tools or scripts or ways to monitor a Exchange 2003 journal mailbox? once the items in this mailbox reach certain limit, trigger off an alert to a pager or an warning email to admin's mailbox?

I have Enterprise Vault journal enabled, sometimes EV stuck and doesn't process archive from the journal mailbox, hundreds and thousands emails just stuck in that journal mailbox, we want to get notified before even worse thing could happen.

Any help is much appreciated.

Joey

[Matt_Schu]

I have the same issue.  If anybody has any info, please post.

[Peable]

Hi there,

you would want to look at "Enterprise Vault Reporting" based on SQL Reporting Services. With this, you can create reports e.g. "Exchange Server Journal Mailbox Archiving Health" or "Exchange Server Journal Mailbox Archiving Trends". You can send this report on a daily basis... it's not really a proactive alerting though.

There is a management pack for MOM if you monitor the servers this way.

Regards,

Jochen.

[nofreelunch]

Thanks for your response, we are using Operations Manager, however, we are looking for something more proactive.

It can be simply considered as looking for a way to monitor mailbox, not necessarily EV related, got be some tool or script can do it, but I don't know, any more help please?

[Peable]

Hi. No, I don't refer to Operations Manager, but to Enterprise Vault Reporting (see Installing_and_Configuring.pdf).

[Michael_Bilsbor]

Hi,

EV will by default log a warning in the event log when more than 150,000 items are in the Inbox. 

[nofreelunch]

Thanks, can we modify this value anywhere like registry to 5000 something?

[Michael_Bilsbor]

this from the events database.

Event ID 3229

Enterprise Vault writes a warning to the Windows Application log when there is a build up of messages in the Journal mailbox's Inbox. The default is for the warning to be logged when the Inbox contains 150,000 messages.

You can change the warning level by creating a DWORD registry value called JournalWarningMsgCount under the following registry key:

HKEY_LOCAL_MACHINE
\SOFTWARE
\KVS
\Enterprise Vault
\Agents
Set JournalWarningMsgCount to the number of messages that the Journal Inbox must contain in order to trigger the warning.

To disable the warning, set JournalWarningMsgCount to 0.

[nofreelunch]

Thank you very much, this would help my situation, I can now change the value, then use a script or other event viewer search tool to send out the alerts.