Question about Classification feature - exclude read receipt and automatic reply (vacation)

[laguns97]

Hi !

sorry for my english, i'm french speaking !

In few weeks, we will migrate from ev11 to ev12 and we would like to know if the new classification feature can do that.

Actually we can exclude mail from alert server, from backup jobs etc..  We only have to add the email of the jobs and all work fine.

We would like also, exclude the email of read receipt and the email of automatic reply when we are not at the office (vacation etc...)  In this case, the reply come from the users but we don't want exclude this user's email.  There is a way to do that ?

I take all hint !

Thanks !

[Massimo_Vagli]

Hello laguns97,

There is a tag named 'evaction.discard' which according to the manual does the following: 

"Marks an item for deletion if the name of a retention category is assigned to the property."

An example (editable) of the tag rule would be 'Item (^subj:.*\b(Out of Office:|Automatic reply:)|^msgc:IPM.Note.Rules.OofTemplate.Microsoft)' 

The manual contains this description for the tag 'evaction.discard' --> 

By assigning the name of a retention category to this property of an item, you can mark the item for deletion. For example, one of the example classification rules uses this property to delete automated out-of-office messages.
The way in which Enterprise Vault handles such items depends on the point at which it classifies them.
■ During indexing. If an item is classified when Enterprise Vault indexes it, Enterprise Vault sets the retention category of the item to the evaction.discard property value. You can no longer search for the item, but, for a limited number of days, you may be able to recover it. This is the case even if, in the archive settings for your Enterprise Vault site, you have chosen to disable the recovery of user-deleted items.
■ During automatic expiry. If an item is classified because its retention period has expired, Enterprise Vault immediately deletes the item.
■ During user deletion. If an item is classified because a user has tried to delete it then, depending on how you have configured the archive settings for your Enterprise Vault site, the item is either immediately deleted or temporarily recoverable.

This property overrides the other classification properties, such asevtag.inclusion. So, if one classification rule marks an item for deletion then it is deleted, even if a second rule tags the item for inclusion in a Compliance Accelerator review set. Some items may not be eligible for deletion because, for example, they are on legal hold. Where this is the case, the classification feature updates the item's retention category but does not delete the item.

Possibly you can evaluate the other feature called 'custom filtering' which, according to some XML rules, could drive the archival or certain items, there is in fact an action called 'MARK_DO_NOT_ARCHIVE', I advise you to review and test the Setting_up_Exchange_Server_Archiving.pdf chapter 'configuring filtering'.

Massimo 

[ChrisLangevin]

The EV 12.0 classification using Windows FCI contains an example rule called "Auto-reply" that screens out automatic replies.

The EV 12.2 classification using Veritas Information Classifier doesn't seem to have an example rule, but you can build one based on the expression in the 12.0 example rule.

The thing to note is that both automatic replies and read receipts use a distinct message class. EV indexes each item's original message class as "msgc", so you should be able to identify both of these item types reliably in your classification rules by keying on this property.

For reference, the message classes are:

Read Receipt: REPORT.IPM.Note.IPNRN
Automatic Reply: IPM.Note.Rules.OofTemplate.Microsoft

--Chris