Does EV updates or rights anything to transaction logs of Exchange 2007 during the archive windows?
EV doesn't directly no.
But Exchange will.
Each archiving operation will likely result in modifications to the items in a users mailbox -- all of that will be transactionalised by Exchange.
I have noticed that Exchange 2007 is generating logs only for 3 - 4 users in my Infrastrcture of thousands of users during the archiving window. Any thoughts?
How are you determining that?
In the Exchange Transaction logs we see this Text
Okay well as you probably know EV when starts processing a mailbox it marks a bunch of items as 'pending' archive, then when the items are secured, they'll be post processed into shortcuts (if that is what is configured in the policy).
Maybe the other users don't have any items to archive?
Maybe you have a kind of problem/looping message.
If you can narrow it down to a particular user or two, then you could try doing a run-now on that user, monitoring the transaction logs, and, doing a DTRACE of the archive task.
I did run the Dtrace and uploaded to the Symantec FTP site. If you have access I can provide you the case# to review the logs.
Sorry, I'm not a Symantec employee therefore don't have access.
Do you need anything else on this issue?