Storage Expiry Odd results and unable to expire

[ImAlwaysSmiling]

Continuing from https://www-secure.symantec.com/connect/forums/journal-vault-unlimited-retention-now-needs-be-limited

We ran the SQL queries and got some odd results.  We actually migrated from Groupwise to Exchange 2007 in 2009.  So we got results from the two queries and decided to start a expiry based on Archive date of 34 months which removed 21 items.  I was expecting quite a bit more.  However it is a start.  Now we are going with 32 months and the expiry did not find any items to delete.  Is there something that needs to be done to make the expiry find the items?  Do I need to resychronize or something since I actually created a new retention category and assigned it to the journal?  Any assitance is most appreciated.

ITEM DATE

2038,27
2030,1
2012,2073270
2011,11384947
2010,10553570
2009,6115977
2008,256
2007,10
2006,11
2005,3
2004,4
2003,2
2002,7
1970,3

Here is what we got for Archive date which is more realistic.

2012,2073382
2011,11384730
2010,10553923
2009,6115943 

[TonySterling]

Did you schedule expiry to run or do a run now?

Do you happen to have items on Legal Hold?

[JesusWept3]

The SQL query is not exact, there are some caveats

1. Expiry runs to the very second, the query you run now, will yield less results that will run when you expire in several hours.

2. You can set expiry based on modified vs archived date in the retention category
3. If you set prevent deletion on the retention category, nothing will get expired
4. If you set Do Not Expire Items in users archive properties, the items will not expire
5. If you have a Discovery Accelerator and you put items or archvies on hold, those items will not expire
6. It depends on how long you run the expiry for, it might not have enough time to expire items, you can usually tell this by the time the report is generated in the event viewer, if its at the end of the schedule then you need to have more time, if its before the end of the schedule, then it just ran out of things to expire
7. It also depends on the type of storage you have, if you have a Centera in Compliance or a NetApp with snaplock, then you cannot expire items before the archived retention has expired. so if you have a retention of 10 years, and you archive it on a compliance device then you decrease the retention to 6 years, items will not expire until they are at least ten years old.

You can also not expire by Modified date (The sent/received date)

Also if you delete any archives, or users delete archived items AFTER the SQL query is run but BEFORE expiry runs, then that will also change the numbers etc

[ImAlwaysSmiling]

Thank you.  We are only trying to trim the journal mailbox archive.  We created a new retention category for this purpose only.  Basically changing the timeframe on the category after each expiry. It ran the one time and removed 21 items...  we can't get it to do it again?  Do we need to synchronize or something that changes the category on all items in the journal to the new category?

[ImAlwaysSmiling]

We have no Legal Holds from 3 years ago.  When we got 21 results, it was a Run Now and we get no results with the schedule expiry.  We have since used the run now and have gotten no results.

[JesusWept3]

Well it all really depends on how far in to 2009 you really started journaling
Today - 34 months is May 9th 2009, is it possible that all those items were archived during the later half of 2009?

[TonySterling]

Can you run this one for us:

select "ArchiveDate" = left (convert (varchar, ArchivedDate,20),7),
"Count" = count (*)
from saveset
where ArchivedDate between '2009-01-01' and '2009-12-31'
group by left (convert (varchar, ArchivedDate,20),7)
order by "ArchiveDate" Desc

[ImAlwaysSmiling]

We started the migration in April 2009 and completed the migration in August 2009.  So we should have seen data expire.

2009-12,924974
2009-11,690815
2009-10,844275
2009-09,804413
2009-08,681740
2009-07,560324
2009-06,1555820
2009-05,26628
2009-04,75

[TonySterling]

What do you mean when you say you created a new retention category?  The new retention category will only apply to newly archived items.  You need to adjust the retention category assigned to the archived items.

[ImAlwaysSmiling]

Well, when we had the Evault consultant setup our system, he created an unlimited category which applied to the journal and also applied the same category to our Management Staff.  So if we just modify the existing, it will expire all of their email as well.  This is not an option.  I wish we would have known the problems that would cause.  Do you see a way around this?

[TonySterling]

You can mark the management staff archive to not expire.  On the Advanced tab of the Archive Property page uncheck Delete expired items from the archive automatically.

[Liam_Finn1]

Do you have all the email in the one journal archive or are the mail archives from the management staff seperate?

If they are in the one journal then there is no way to sepeate the Management emails from everyone else.

However. If they are in seperate archives you can change the properties of the management archives to not delete expired content. This will allow you to adjust the one policy you have and expire data from the journal archive by running expiry and not affect the other archives.

Remember that if you do this the other archives will never expire data unless you update the setting again to allow expired items to be deleted.

Also you need to watch for chnaging your default policy, if you set the policy from keep forever to 1 year then run expiry, afterward you enable the management mailboxes to expire data before updating the policy back to keep forever you run a very high risk of deleting the content of the management staff archives to 1 year

Depending on the number of archives you have this may take a little work.

You will need some planning on this before you kick it into action

Retention policies are not retroactive so applying a new policy today only works on items archived today onward using this new policy. Currently there is no way to apply a policy retroactivly without exporting and reimporting all the content in a vault

[ImAlwaysSmiling]

Thank you Scanner and Tony.  We are going to plan for this carefully.  However, since we used EVPM to create a My Archive folder with the same Unlimited retention category as the Journal vault and the managers vaults, we are going to create another MY ARCHIVE 2 folder with a new unlimited category specifically for that folder using EVPM.  Rather than have users move the mail that they dragged over to the first My Archive folder, is there a way using EVPM for me to move the mail from the Original My Archive folder to the new My Archive folder 2?  I really did not want to impact the users with this task.  Any thoughts?

[TonySterling · Accepted solution]

No, you will not be able to use EVPM to move the items, the users will have to move the items themselves and then EV will update the retention category.  Depending on the amount of items this could be resource intensive.

It would be simplier for you to uncheck their archives from automatic expiry.

[ImAlwaysSmiling]

Thanks again EVERYONE!!!  We have to do that too...  I really appreciate all your answers and time you have given to me with my issue.  I am going to be testing and I anticipate more questions as this is a bit of a nightmare.  Thanks.

[ImAlwaysSmiling]

Now that we created a new MyArchive (different name than the first) folder and had users move their items, I'd like to remove the old MyArchive folder.  Is there a way to use EVPM to remove the old folder?  I know that I can use EVPM to change it to deleteable, but can I run something to remove it for them?

[TonySterling]

Sorry but no, EVPM cannot remove a folder.  Look into a powershell script:

http://social.technet.microsoft.com/Forums/en-US/winserverpowershell/thread/bc07df23-64f1-4732-a399-76fd39b1595e