Selective Journaling

[ChrisATS]

My environment:  Windows Server 2008 R2, Enterprise Vault 10.0.3, Journaling enabled.

I don't have a problem getting it working.  The problem is that is appears to work too good.  I'd like to filter out message the sender denied failure emails.  The messages appear to be coming from MAILER-DAEMON@mycompany.com  I enter the required registry entries and restart the journaling task and immediately start seeing messages flow to the deleted items folder as they should.  The problem is that many of those messages aren't coming from MAILER-DEAMON and it legit email.  

I enter the option below in SelectiveJournal_config.dat

exact:MAILER-DAEMON@mycompany.com

I've also tried:

cont:MAILER-DAEMON  

This appears to do the same thing and start filtering legit email.  

Does anyone have any experience with this?  I only want to filter these failure messages

[TonySterling · Accepted solution]

Ok, instead of Selective Journal you should set up Custom Filtering.  This is from the doc's

To select messages, you set up filtering rules to match the To, CC, and From fields. If a message matches any of these rules it is archived, otherwise it is deleted.

So it would seem that what you have set up would only archive messages from that address.

Your Default Filter Rules.xml would look like this:

<RULE NAME="Newsletters" ACTION="MOVE_DELETED_ITEMS">
  <AUTHOR INCLUDES="ANY">
    <EA>MAILER-DAEMON@mycompany.com </EA>
  </AUTHOR>
</RULE>

OR

<RULE NAME="Junk Mail" ACTION="HARD_DELETE">
  <AUTHOR INCLUDES="ANY" ALLOWOTHERS="Y">
       <EA>MAILER-DAEMON@mycompany.com </EA>
  </AUTHOR>

</RULE>

More info can be found in the Setting up Exchange Server Archiving doc in the documentation folder.

[ChrisATS]

Thanks for your help now I'm having trouble getting customer filtering running.

I've setup the 'Default Filter Rules.xml' file according to the example and added the registry settings for HKEY_LOCAL_MACHINE/Software/Wow6432Node/KVS/Enterprise Vault/External Filtering/Journaling 

I entered a string with name of '1' and named it 'EnterpriseVault.CustomFilter.'   I also created a DWORD called 'MoveOnFilterFailure' and set value to '1'.  Close regedit as directed by instuctions.

When I restart the Journaling Task for the mailbox servers they fail.  What am I missing here?  The selective journaling worked fine when I followed similar steps.  

[TonySterling]

Rob did a pretty detailed Article, have you seen this?  You can skip the custom properties section.

https://www-secure.symantec.com/connect/articles/custom-filtering-enterprise-vault

Read through it and make sure you did all the steps.  Also, did you remove the Selective Journal settings?

[AndrewB]

Chris, have a look at this thread where the process has been detailed out with screenshots and tested to show how it works too.

https://www-secure.symantec.com/connect/forums/custom-filter-custom-propertiesxml

[Rob_Wilcox1]

I fully endorse this product/service ;)

[ChrisATS]

Yes, I removed the registry entry for Selective Journaling and cleared the 'SelectiveJournal_config.dat' file.  I read Rob's post and that I found my mistake. I hadn't saved the xml file as unicode.  I changed that and again no joy.  Again the journal task failed.  I read Rob's excellent article as well as the other and it appears I'm doing things correctly.

<?xml version="1.0"?> 

<RULE_SET xmlns="x-schema:ruleset schema.xdr">

<!--Example Rule 3: This rule will move email to the wastebasket 

    if it comes from any of the sources listed, and is about any of the subjects listed.-->

<RULE NAME="Postmaster" ACTION="MOVE_DELETED_ITEMS">

<AUTHOR INCLUDES="ANY">

<EA>MAILER-DAEMON@mycompany.com</EA>

<EA>MAILER-DAEMON@yahoo.com</EA>

<EA>postmaster@mycompany.com</EA>

</AUTHOR>

<SUBJECTS INCLUDES="ANY">

<SUBJ MATCH="STARTS">Automatic Reply</SUBJ>

<SUBJ MATCH="EXACT">HOST reset</SUBJ>

</SUBJECTS>

</RULE>

<Delete MP3 attachments before archiving - NB this feature is not currently supported for 

the Lotus Domino Custom Filter-->

<RULE NAME="DeleteMP3s" ATTACHMENT_ACTION="REMOVE">

<FILES>

<FILE FILENAME="*.MP3"/>

</FILES>

</RULE>

[TonySterling]

Can you post the actual errors that are generated?

[ChrisATS]

The event viewer shows Warning:

Event 45324: The custom properties definition file could not be found - custom property indexing and categorisation functionality has been disabled.

Also shows a critical Error:

Event 45315: An error has occurred when adding custom rule set.  This error may be caused by incorrect XML syntax.   Internal References: End tag 'RULE_SET' does not match the start tag 'RULE'.   

Details: Source C:\Program Files (x86)\Enterprise Vault\Custom Filter Rules\Default Filter Rules.xml   Line: 13  Position 3

I shortened the XML script to the following in order to easier troubleshoot syntax errors.

<?xml version="1.0"?> 

<RULE_SET xmlns="x-schema:ruleset schema.xdr">

<!--Example Rule 3: This rule will move email to the wastebasket 

    if it comes from any of the sources listed, and is about any of the subjects listed.-->

<RULE NAME="Postmaster" ACTION="MOVE_DELETED_ITEMS">

<AUTHOR INCLUDES="ANY">

<EA>MAILER-DAEMON@mycompany.com</EA>

<EA>MAILER-DAEMON@yahoo.com</EA>

<EA>postmaster@mycompany.com</EA>

</AUTHOR>

</RULE_SET>

[ChrisATS]

Just noticed the syntax error...missing a closed rule   </RULE>

[TonySterling]

there you go!  Hopefully that sorts it.  Let us know.

[ChrisATS]

Tony and Rob,

Your help was appreciated on this!  Customer filtering is working great now!  I plan on continuing to modify in order to best filter out unwanted email from journaling.

[Rob_Wilcox1]

Excellent news.