archiving query

[GTK]

We have identified an issue on our environment where Microsoft Forefront was identifying emails as " .bin " files  which appears to have impacted our EV journalling environment . The EV journal servers are reporting " The following message could not be archived as it seems to be an invalid journal report. "

The mails are not corrupt and can be opened. It's just annoying we now have to move over 100,000 mails back to the inbox to be journalled

Has anyone seen this before and explain why EV would be tagging these mails with the above error ?

Thanks

Greg

[Rob_Wilcox1 · Accepted solution]

Has Forefront done 'something' to the messages, eg, edited the P1 or the P2 message?  eg removed an attachment from the P2 message?

Whilst you might be able to open them with Outlook, that doesn't mean that they are valid journal reports.  I'd take a closer look at a regular journal report, and one of the ones that the complaint is about.

[Jeff_Shotton]

There is a policy option for journaling to return failed messages back to the inbox. However, as Rob points out, the items might actually not be valid journal reports (which is what you see when you open journaled items rather than the attachment). Setting this policy option will probably create issues though as all failed items will be tried in one lump, and if the reason for failure still exists (most likely unless you have changed EV versions, or applied a hotfix) then you are just asking for more errors in the event logs..

Do these items archive properly now, or if you take a FEW and attempt to archive them again, do you get yet more invalid item messages.

Regards,

Jeff

[GTK]

"Return failed Items to inbox" is set to OFF. It seems strange that over 250,000 emails would be flagged as invalid journal reports. Incidentally all the affected emails have attachments that open fine (well the ones i have spot checked )

what is the purpose of this folder "Invalid Journal report " ?

[Jeff_Shotton]

I'd worry less about the attachments and more about the journal report. The mail can look fine, yet fail to archive.

There are several failed item folders, which act like buckets to store items in so they are not archived again unless intervention is taken.

[GTK]

looks like fixing forefront engine has resolved issue, no more emails being classed as invalid journal report now

[Rob_Wilcox1]

Good news :)