Retrieving un-journaled mail due to journaling task failure

[McCu]

I have Journaling from Exchange (2003) setup on a single EV server (8.04).
The task had failed for 1 month, i think it failed due to the quota on the jorunal being exceeded.

None of the journaled emails were retained in the Exchange queues or in the Exchange journal mailbox.

Is there any way I can get these missing journasl mails into the journal archive?
Perhaps by using DA on the users archives?

Also, is there anyway to enable alerts for Tasks ?

[WiTSend · Accepted solution]

If the task failed and then the quota was exceeded then the items were never put in the Journal mailbox.  How long ago did this happen?  If it is beyond the time period for mailbox archiving you could do a search across the mailboxes, export the results and import them into the Journal mailbox.  You wouldn't get everything, but you would get the majority.  If you are inside the archive period, you can use exmerge to pull the emails out of the mailboxes and import into the Journal mailbox.

[Nick_White]

If they never made it to the mailbox then they won't be in the journal archive. They may be in user mailbox archives if they have been archived already or may be in user mailboxes, but if you have tight quotas then your users might be used to deleting messages. A DA search across all mailboxes for everything in the last month would get you the maximum amount of results, but it would still miss anything that hasn't been archived yet

[McCu]

This pretty much confirms what I thought.  I think my best option is to retrieve as much as possible by searching accross all archives.

[jajensen]

With regards to setting up alerts for the tasks, you'd have to use something like MOM or SCOM (EV has a package for MOM; not sure on the SCOM).  EV will show alerts both in the admin console and in EV Operations Manager, but neither will actively send something out via email to alert you.

[AndrewB]

there's a management pack for SCOM. in fact, with the latest version, i believe MOM is no longer supported.

[Nick_White]

MOM and SCOM are both supported, but I believe the minimum version of MOM has changed. The info should be in the certification tables

[AndrewB]

thanks for catching that. it's actually SCOM (OR) that's not supported with EV9; just SCOM R2 now.