Video Screencast Help
Symantec to Separate Into Two Focused, Industry-Leading Technology Companies. Learn more.

How to verify that EV is processing the EV Journal task against my Journal mailbox ?

Created: 11 Dec 2013 • Updated: 20 Aug 2014 | 15 comments
This issue has been solved. See solution.

Hi People,

How can I make sure that the EV Journaling task is archiving the Journal maillbox ?

Can I assume from opening the Journal mailbox using Outlook that if the email is still available in the EV Journal mailbox, it is not available to be search by EV ?

Operating Systems:

Comments 15 CommentsJump to latest comment

Rob.Wilcox's picture

You can also use EVOM.. but yep, opening the journal mailbox will give you an indication if things are being processed.

Remember by default that items won't necessarily be processed immediately that they arrive in the journal mailbox .. items will get turned into a pending item (of sorts) until the Journal Delay has expired.

SOLUTION
John Santana's picture

What component is that EVOM ? where can i use that ?

I can see that there are more than 200.000 items in my EV journal mailbox and still growing, is that normal ?

Kind regards,

John Santana
IT Professional

--------------------------------------------------

Please be nice to me as I'm newbie in this forum.

GabeV's picture

Hi John,

Opening the journal mailbox will tell you if the journal archiving is working. Group the emails per IPM class and you will see when the items are processed from IPM.Note to PendingArchive and then finally Pending before the email is send to the archive.

“Success is not final, failure is not fatal: it is the courage to continue that counts.”–Winston Churchill

John Santana's picture

Rob, so what is the optimal value in the EV Journal mailbox ? should that be lesser than certain number of emails or no set threshold as recommended ?

Kind regards,

John Santana
IT Professional

--------------------------------------------------

Please be nice to me as I'm newbie in this forum.

WiTSend's picture

In my environment it takes 5-10 minutes for an email to be process in the Journal Archive mailbox from the time it arrives until it removed.  1st it goes to pending, then it is removed.  As described by Rob above you should be able to see the numbers moving up and down showing the journaling and archiving processing.  One of the things I look at to monitor my system is the oldest email in the journal mailbox, this gives me an indication of how long it's taking to process or if some items are "stuck" and need to be reprocessed.

John Santana's picture

WitSend,

It seems that my Journal mailbox in Exchange still contains email dated back 6 days ago, this is when the backup starts. SO it can be concluded that the EV Journal archive cannot be processed during the Open VaultStore partition backup.

Kind regards,

John Santana
IT Professional

--------------------------------------------------

Please be nice to me as I'm newbie in this forum.

Trafford's picture

See my post https://www-secure.symantec.com/connect/blogs/how-...

on setting up Outlook to monitor the Journal Mailbox

John Gowing - Symantec EV Exchange STS

DFA Solutions

Cape Town

wilsond3010's picture

We went at it from the sql side.  We have a store procedure setup and configured to monitor and sends out emails and pages once a threshold is hit.

select count (*) from EnterpriseVaultMonitoring.dbo.MailboxMonitoring where MailboxParameterID = 1 and ActualValue > 1000

John Santana's picture

Wilson,

Thanks for the reply, I have executed the SQL Script that you suggested against the EnterpriseVaultMonitoring DB, but somehow the result is just 1 ? 

SQL.JPG

is that because of my current VaultStore is under backup mode ?

Kind regards,

John Santana
IT Professional

--------------------------------------------------

Please be nice to me as I'm newbie in this forum.

GertjanA's picture

Hello John.

How many mails are there in the Journal Mailbox you are targeting?

EV needs to trawl through the mailbox before you will see things happening. What I usually advise is to create a NEW journal mailbox, and a new Journal Mailbox Archiving task, and use that as of now. Have the original task target the existing Journal Mailbox, and let EV work itself through the (possibly) huge amount of items. This way, you have a 'static' Journal Mailbox (the existing one) and a new one. The 'static' one should be emptied after a while. this depends on the number of items in it.

I've been in an environment where by the end of the day there were more than 30000 items in each Journal Mailbox we had. In the morning, they were all 0 (or close to). Due to the huge amount of journaled mails, this was 'expected'.... I did not run queries on the monitoring database, but had a powershell running returning the number of items in the Journal Mailbox. That ran twice a day, and send an email to myself.

If a Vault Store is in backup mode, no additiones are being written. This might be the case on your side. If the backup software indicates it is ready backing up the Journal Stores, it might be necessary to clear backup mode manually? you need to check that.

Regards

Thank you, Gertjan, MCSE, MCITP,MCTS, SCS, STS
Company: www.t2.nl

www.quadrotech-it.com

www.symantec.com/vision

John Santana's picture

Gertjan, in my EVJournal mailbox from the Outlook, I can see that there are more than 250.000 emails and counting up (increasing), is that normal ?

Kind regards,

John Santana
IT Professional

--------------------------------------------------

Please be nice to me as I'm newbie in this forum.

GertjanA's picture

Hello John,

That would explain yes. It looks like you have a backlog in your Journal Mailbox.

Unless we go into a deep-dive into your Exchange Journal setup, is it possible for you to:

1 - create a new Journal Mailbox in Exchange.

2 - Define a new Journal Archive, in the same Journal Store as the existing one

2 - Define the Journal mailbox in Enterprise Vault, point to the new archive

3 - Create a Journal Archiving task for this new Journal Mailbox, preferably on an EV-server that is not busy.

4 - Start the task, verify it runs correct. Send a testmail directly to the journal mailbox, and monitor in Outlook to see if it gets archived.

5 - If 4 is succesfull, change Exchange to use the NEW journal mailbox.

When ok, monitor the OLD journal mailbox to see if EVENTUALLY items are being converted into 'pending archving', and then are removed from the mailbox. I've seen Journal Mailboxes having 300K items, which takes about 3 days to empty out. When the old mailbox is being processed, do NOT restart the archivnig task, or storage service etc. Just keep it running for a few days. Make sure that  your stores and indexes come out of backup mode correctly. As soon as the old Journal Mailbox is back on a normal level, you can use it again for journaling, or (even better) split the journaling load in exchange to use the 2 journal mailboxes. But, that depends on your config in Exchange ofcourse.

Thank you, Gertjan, MCSE, MCITP,MCTS, SCS, STS
Company: www.t2.nl

www.quadrotech-it.com

www.symantec.com/vision

wilsond3010's picture

John,

it returns a value of 1 if the threshold is over the actualvalue

select count (*) from EnterpriseVaultMonitoring.dbo.MailboxMonitoring where MailboxParameterID = 1 and ActualValue > 1000

Stop journal archiving for 10-20 minutes and then do

select * from EnterpriseVaultMonitoring.dbo.MailboxMonitoring

Then you can see what the monitorning parameters are and what the current value is