Video Screencast Help

Journaling: Archived Items stuck in the journal mailbox

Created: 04 Feb 2014 • Updated: 16 Apr 2014 | 6 comments
This issue has been solved. See solution.

After journal items archived, some stay in the mailbox forever while other items moved to the Enterprise Vault.  Right now I have about ~100 archived items stuck in the mailbox dating back for couple of weeks.

If I open any of the “stuck” items, I will get the following error along with attachment file “Quarantined Attachment.txt”:

“The custom form cannot be opened. Outlook will use an Outlook from instead. The form required to view this message cannot be displayed. Contact your administrator.”

The message from “Quarantined attachment.txt” would be “Symantec Mail Security replaced <mail subject> with this text message. The original file contained a filtering violation and was quarantined.”

Our Environment:

  • Exchange 2010
  • Enterprise Vault 10.0.4 with Hotfix 1

How can I fix this?

Operating Systems:

Comments 6 CommentsJump to latest comment

JesusWept3's picture

Sounds like you see the issue is that the items are being quarantined by SMS.
Probably best bet is to see if theres a way to configure it to move the items to a different folder or delete them altogether so they're not in the inbox anymore

GertjanA's picture

A crude but effective workaround would be to Exclude the Journal Mailbox from AV-scanning.

Thank you, Gertjan, MCSE, MCITP,MCTS, SCS, STS

jdewing's picture

I don't know if I want to excluded the Journal Mailbox from SMSME (Symantec Mail Security for MS Exchange".  "Virus" attached to email could still go to Journal Mailbox and then it will get archived.

I'm trying to figure out if I can exclude with attachement "Quarantined Attachment.txt" to delete it

Darryl_R's picture

I would assume you have tried requeing these files? Have these files been moved to a folder in the Journal mailbox? Do these emails have attachments that were stripped by the AV solution?

Darryl Richardson
Sr. Symantec Systems Engineer

jdewing's picture

No, the files are still sitting in the inbox. I thought after few retries, it should move to a "Failed to copy" or other EV folder. I do get the Event ID 2270 "A queued operation exceeded the retry count and has been discarded". I don't know if it related.

Yes, the attachment files were replaced or added by the AV solution.

JesusWept3's picture

really it should be moved to invalid journal report, but i guess it depends on how the SMS handles it.
I think really you need to talk to SMS support and see if there is something you can do to have it move the items or delete them, at least just from the journal, or talk to EV support to see if its a bug as to why it won't move the item to a failed folder instead of just leaving it there