Video Screencast Help
Symantec to Separate Into Two Focused, Industry-Leading Technology Companies. Learn more.

filtering for Journal Archiving

Created: 25 Nov 2012 • Updated: 03 Dec 2012 | 8 comments
Igs's picture
This issue has been solved. See solution.

Hi everyone,

I did some checking and found that our SCOM server generates so much mail that it's probably worse than any spam. Obviously it gets archived as it passes through the journaling mail box and ultimately ends up in the Journal Archive. It always comes from the same address scom.admin@mycompany.com.

I wish I could filter this sender out from archiveing completely. And probably same goes for the reciepient. Has anyone emplemented anything similar? I will appriciate any help.

I'm running EV 901 and Exchange 2007

Igs

Discussion Filed Under:

Comments 8 CommentsJump to latest comment

TonySterling's picture

Your filter will look something like this:

 <RULE NAME="SCOM Mail" ACTION="HARD_DELETE">
   <AUTHOR INCLUDES="ANY" ALLOWOTHERS="Y">
      <EA>scom.admin@mycompany.com</EA>
   </AUTHOR>
 </RULE>

Also, here is the link to Robs article, the above link didn't seem to work:

https://www-secure.symantec.com/connect/articles/custom-filtering-enterprise-vault

Since his article is for Mailbox you will need to tweak it for Journaling.  Also check out these TN's:

Example ruleset file for custom filtering

Article:HOWTO58121  |  Created: 2011-08-01  |  Updated: 2012-09-23  |  Article URL http://www.symantec.com/docs/HOWTO58121

Exchange Server and journal filtering

Article:HOWTO56325  |  Created: 2011-08-01  |  Updated: 2012-09-23  |  Article URL http://www.symantec.com/docs/HOWTO56325
SOLUTION
Igs's picture

Tony. Thank you. Excatly what I needed. Adopting it for Journaling is no problem.

Igs's picture

After I create the reg entries and the Filter Rules.xml, the task appears to start. However, I did not create the Custom Properties.xml file, as I really can't figure out what it's for. As this file is missing EV gives off a warning:

The custom properties definition file could not be found - custom property indexing and categorisation functionality has been disabled.

I'm not sure if EV journaling functionality is impacted by this.

Rob.Wilcox's picture

No it'll be fine without it.

Remember one of the other reasons for doing custom filtering is to add additional index attributes and categorisation to messages - that's what the custom property file is for.  As you're not doing that, you don't need it.

Igs's picture

Rob, thank you very much. Appriciate your help

Rob.Wilcox's picture

Glad to help. Did you get chance to try it out?

Igs's picture

Just put it in. All started OK (with that warning message). Running dtrace to test. and will search the journal mail box