Sounds like these messages have such large dist lists that it boggs Journaling down trying to identify all the members of the list

Unless it is vital I would exclude messages from mailboxes like support and boradcast

Hi Gsusini

We have 85.000 users. You don't scare me dude ;-))

Anyway. We occasionally see this also. Nothing to get worried about, EV will catch up eventually.

You might want to consider putting in an extra EV Journal archiving server.

We have 1 per cluster (6 + 2) and cope fine.

Gertjan

I've been involved in a setup that is somewhere between yours and Gertjans in terms of size, and were are also experiencing the same behaviour.
However, during the troubleshooting I discovered that an external business was sending several thousands of mails with identical messageID's and that really killed the journaling function.

I reported this to the Symantec support and they could reproduce the issue. The workaround in our case was to increase the maximum number of items per pass (http://seer.entsupport.symantec.com/docs/273132.htm) which perhaps can help you as well if the helpdesk is using some sort of SMTP engine that is using the same messageID for all the mails?.

Good luck.

/Tobbe

I'd say you only have a problem if the back log doesn't clear.. Like others have said on this thread from time to time you might see a few hundred, or even a few thousand items in the journal mailbox at any particular time, but they should clear away quite quickly.  If they don't and your inbox in the journal mailbox just grows and grows then that needs to be investigated.

Hope that helps,

We have approx 7000 users.  Journaling sits around 200 through the day, spiking up to 2000 occasionally, but these are cleared quite quickly. 

Do you need any more info here?
Please mark a post as a solution if it fits your needs.

Cheers