Enterprise Vault (EV) Journaling experiences a performance degradation when multiple different messages shares the same 'Message-Id'

Article:TECH181078  |  Created: 2012-02-09  |  Updated: 2014-08-07  |  Article URL http://www.symantec.com/docs/TECH181078
NOTE: If you are experiencing this particular known issue, we recommend that you Subscribe to receive email notification each time this article is updated. Subscribers will be the first to learn about any releases, status changes, workarounds or decisions made.
Article Type
Technical Solution



A performance impact may be seen during the Journaling Process when multiple non-unique Journal Reports sharing the same 'Message-Id' are group together.
The 'Message-Id' is normally assigned by Ms Exchange, but can be hardcoded by third-party mass mailer applications.



1. No errors are logged in the Event Logs.

2. Dtrace excerpt of a group containing 175 messages.
In this instance, only 50 message members were processed after 75 mins

	(JournalTask) <10752> EV:M CJournalPart::ProcessMessageGroup - Number of messages that share the same internet-msg-id:[175]


The problem has been reported on the following versions:

Ms Exchange 2010
MS Exchange 2007

Enterprise Vault 9.0.x
Enterprise Vault 10.0




A journal report is the message generated by the Journaling agent on a Hub Transport server and delivered to the journaling mailbox. The original message is included unaltered as an attachment to the journal report. This type of journal report is called an envelope journal report.
Depending on the situation, Exchange 2010 may generate more than one journal report for a single message. Whether a single message generates one journal report or multiple journal reports depends on several factors, such as distribution group expansion. Those journal reports will share the same 'Message-Id' and will work as expected.

Example of a Journal Report as viewed from the Journal Mailbox showing the Message-Id.

During EV Journaling, the Journal Reports are grouped based on their Message-Ids. The problem can be caused when a 3rd party mass mailer application re-uses the same Message-IDs for different messages.
As a result, when Journaling is occurring, journal reports are wrongly group together by their Message-Ids, creating large groups, and extra processing when each message is compared to all members of the groups and being discarded from the group as they are different.

1. Ideally, the problem lies within the Mass Mailer application which wrongly re-uses the same Message-Id.  This should be addressed with the source of the emails to create unique Message-Id's for each email.

2. To work around this problem, the JournalDelay registry key can be set to 0.
Because journal reports can arrive at different times for the same message there is a 5 minute grace period which is control by the JournalDelay registry Key.
Setting the JournalDelay key to 0 will effectively turns off Journal Grouping all mailboxes on the Enterprise Vault server:

HKEY_LOCAL_MACHINE\SOFTWARE\KVS\Enterprise Vault\Agents\JournalDelay (DWORD)


In Enterprise Vault 9.0.4 and 10.0.2 introduced a Policy setting to allow the JournalDelay setting to be used for a specific mailbox. 

1. Configure an Exchange Transport rule to forward the bulk emails to a new Journal Mailbox. 

2. Edit the policy to use a value of 0 only for the new Journal mailbox that handles these messages.  This will allow the non-bulk items in the original Journal mailbox to be grouped properly while the new Journal mailbox will process the bulk items only with no grouping enabled. 

Supplemental Materials


Journaling: ProcessMessageGroup takes a long time to process messages from PendingArchive.Part to .PendingArchive which are in groups containing multiple members (200+)


Bulk messages not handled well when the message ID is not unique

Article URL http://www.symantec.com/docs/TECH181078

Terms of use for this information are found in Legal Notices