Exclude certain sender addresses from journaling / archiving
We have been using EV 10 against Exchange 2010 for message archiving for awhile. A new requirement just came up that is throwing me for a bit of a loop.
Basically we were told to start journaling everything which is simple enough to do. The problem is that we have various automated emails from our monitoring systems, automation and the output of our ticketing systems which adds up really quickly and which we don't want to keep forever. A rough back-of-the-envelope guess at the number of these messages is about 10,000/day - multiply that by 7 years and it is like 25 million messages! Argubably we should not generate so many emails but that is another conversation unfortunatly.
So, at the very least, what I'd like to do is journal everything but those messages sent by the 10 or so email addresses which are responsible for this flood. I actually wouldn't mind excluding them from archival by Vault altogether but will settle with keeping them out of the journal as hopefully the users delete them in less than a year.
It looks like I can do this with Custom Filtering but would like a bit of guidance as to how to proceed.