09-13-2010 06:09 AM
I'm looking for a whitepaper / formula / quicksheet about the following;
What is the risk (Chance * Impact) of the Enterprise Vault failing (not picking up an email and storing it in archive).
Impact might be derived from mails a day, percentage of business critical, number of users?
Secondly, I would like to know if we could set up some kind of warning signal if Symantec Vault for whatever reason, misses an email.
Regards,
Kees.
09-13-2010 06:19 AM
09-13-2010 06:19 AM
09-13-2010 06:27 AM
Hello Kkoenen,
If mails are not being archived, you will notice in exchange. Mailboxes will grow in size (depending obviously on amount of mail coming in daily). EV has monitoring and auditing and reporting (all optional)
Reporting has a report called 'items archived per hour' which will show you how much is archived during the archiving window. If archiving fails, this shows 0... Additionally, EV comes with a scom-pack, which can help monitoring. If an email is not archived, you might see this in eventlog (corruption is a cause of an email not being archived)
09-13-2010 06:52 AM
I believe our implementation saves all received email in the vault. Might it be possible to compare exchange inbox items that came in today to the items stored to the vault today? We would then have a deviation report showing zero deviations when all works as designed...
09-13-2010 07:29 AM
kkoenen,
The problem with your suggestion is what if I delete 8 emails today.. they came in today, but tonight when archiving runs it'll be "less" those 8 items.
Your sort of idea would be better placed around the journaling area, which is where Exchange comes in to play more than ever.. and you'll see journaling issues by a build of mails in the journal mailbox(es) or a bunch of messages in one of the failure folders.
09-13-2010 11:37 AM
If you want to capture all email (in and out, in- and external) setup a journal mailbox, do journal archiving.
If you use journal archiving, it does not matter that users delete mail from their inbox before these are being archived.
09-13-2010 12:26 PM
GertjanA, thanks! But now.. the second step; how do I create certainty (deviation report?) showing that indeed ALL mails were archived in the journal?? ie there was no mail skipped due to whatever reason.
09-13-2010 12:32 PM
You would watch the Journal Mailbox. Only after the archiving process completes does the email get removed from the Journal Mailbox.
If for some reason EV stopped Journaling then there would be a buildup of emails in the Journal mailbox and that you can monitor via a WMI call or using something SCIM or SMS or set thresholds on the mailbox in Exchange
09-14-2010 12:33 AM
And if the question then becomes "how do I know all mail landed in the journal mailbox?" Your port of call then becomes Microsoft to find out if there is a way of affirming that all mail sent/received did in fact arrive in the journal mailbox.
09-14-2010 09:23 AM
Hi
Just to make sure that we are talking apples and not oranges:
- You are using Exchange Journaling
- You are using Enterprise Vault Journaling to manage the Exchange Journal Mailboxes
Is this correct?
09-15-2010 07:12 AM
Yes, that is indeed my understanding (technical staff working on this, i'm just the processes guy and did a quick check on possibilities within Symantec system).
The thing we need is *proof* that ALL email is being journaled and transfered to the enterprise vault ie there is NO email that is not journaled.
BTW.. I gave the tech. specialist this link ;)
Thnx!
09-15-2010 07:32 AM
Hope it helps, and if you get feedback from Microsoft on the journaling-proof it would be great to share that with everyone.