• Facebook
  • RSS Feed
  • Instagram
  • LinkedIn
  • Twitter
May 092011


Message journaling is a crucial aspect of Enterprise Vault.  It builds on top of Microsoft Exchange’s journaling features and effectively means that all items to/from your organisation end up in a journal archive for retention, and discovery.


There is a but! 

In Microsoft Exchange it’s journal everything, or journal nothing.  What do you do if you only want to journal messages between specific people, or only VIP’s?  Well in Exchange 2003 you didn’t have much of a choice from Microsoft, in Exchange 2007 and Exchange 2010 you can use Transport Rules.  However a simple and flexible approach from the Enterprise Vault side of things is called Selective Journaling.

Overview of Requirements

There are five simple steps to follow in order to configure Selective Journaling :

1. Setup journal archiving

2. Create a filtering rules file

3. Add the selective journaling registry keys for the journaling task

4. Restart the journaling task

5. Test

In more detail here is what we need to do :

1. Setup journal archiving

Setting up journal archiving is described in detail in the Enterprise Vault documentation, at a high level you will need to :-

a/ Configure an account/mailbox to be your journal “user”

b/ Configure the mailbox databases in Exchange so that journaling is enabled to your journal “user”.

c/ Create an Outlook profile on your Enterprise Vault server, so that you can open the journal “user” mailbox.  Open it, and check it’s empty.  Send a simple test message between two users, and check that a journal copy lands in the journal “user” mailbox.

d/ Create a new journal archive.  You can do this in an existing, or new vault store.

e/ Check the journaling policy, and consider whether any changes are needed (I didn’t make any during this test)

f/ Create a journal task, don’t start it at the end of the wizard.

g/ Add a journal target, pointing it to the journal archive you created just now.

At this point you’re all set from a NORMAL journaling point of view.  You’d just need to start the journaling task, and items would get hoovered up out of the journal mailbox in to the journal archive.

To facilitate further testing you may, at this point, want to give one of your test users (or Vault Service Account) permissions on the journal archive.  This way we’ll be able to properly test things at the end.

2. Create a filtering rules file

This exists on the EV Server, and, since it’s one file, and later one set of registry keys this filtering will happen to all of the journal tasks on this EV server.  The file needs to be :-

  • named SelectiveJournal_config.dat
  • Placed in the Enterprise Vault program folder
  • Be saved as a Unicode file

There are all sorts of parameters and options that you can put in the file, I’ll describe a few of them in the sections below.

3. Add the selective journaling registry keys for the journaling task

The key is as follows :

Enterprise Vault
External Filtering

Create a new STRING value with the name “1” (without the quotes) and set the value to be :


4. Restart the journaling task

At this point you should check that the task doesn’t go in to a failed state in the VAC (wait a few minutes).  You can also check the Enterprise Vault event log, for the following :

Event Type:    Information
Event Source:    Enterprise Vault
Event Category:    Journal Task
Event ID:    45329
Date:        5/9/2011
Time:        6:58:51 AM
User:        N/A
Computer:    EVAULT1
External Filter ‘SelectiveJournal.SJFilter’ initialising…

5. Test

Testing this configuration is best achieved by building up the tests from simple to more complex. 

I set a very simple selective journaling rule which is :-


This means that only mails to/from SMTP addresses alberto* will get touched by the filter.  My test user is alberto@ev.local, and he’s sending and receiving mails to vaultadmin@ev.local.

So first of all, we do as above, and check that the task doesn’t go in to a failed state.

Next I’d suggest testing that the item NOT matching your selective journaling rule doesn’t get archived.  What happens at this point is that the item should go “pending” in the journal mailbox, and then it should be moved (by default) to the deleted items folder in the journal mailbox.

You can override this, and hard delete the items, by having the following registry key in place :

Enterprise Vault

Adding a DWORD called HardDeleteItems and setting it to 1 (and then restarting the journal task if need be).

For now though, if I send an email from vaultadmin@ev.local to vaultadmin@ev.local, the mail will get to the journal mailbox, and when the journal task picks it up, it’ll be moved to the deleted items folder. 

Last test is to check that the rule works.  So, you can send a mail from alberto@ev.local, to vaultadmin@ev.local, or vice versa.  The item shouldn’t end up in the deleted items folder of the journal mailbox.  You should also be able to search the journal archive using browser search to locate the item.

Rules ?

There are quite a few options available when it comes to building rules.  These are described in the “Setting Up Exchange Archiving Guide”, but to give you an idea :



Selective Journaling can be quite powerful, and be used to control what ends up in your journal archive.  I can see several uses for this, such as only journal archiving specific people, or for journaling only mail into and out-of the organisation (not all the internal stuff)

If you enjoyed this post, please consider leaving a comment or subscribing to the RSS feed to have future articles delivered to your feed reader.

 Leave a Reply

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <s> <strike> <strong>