none
Standard journal (working fine for years) fails after setup a journal rule (Premium journal) RRS feed

  • Question

  • Server: Exchange 2013 Standard fully updated

    Journal mailbox: local journal mailbox

    Journal type: Standard (journal mailbox configured as journal destination of mailbox database)

    Archiving software: on-premises application that downloads mail from journal mailbox and archives it in a repository

    This setup has been working fine for years.

    Problem: I wanted to test an external mail archiving software so I added a journal rule for all mail (inbound, outbound and internal) with destination to archive@externalservice.com (i.e. both journal standard and premium being actives at a time).

    At first, it seemed to work fine archiving the same mails in both local journal mailbox & external service. But in fact we have confirmed some emails are not being archived.

    First question: Is it possible to have both Standard & Premiun journal working at a time?

    After that, we removed the journal rule (Premium) expecting Standard journal works fine again, however it is still not archiving some emails and we think they're not being copied to journal mailbox.

    Note: it looks like the non-archived items are almost always from same senders.

    How can I debug journal operations item-level?

    FYI, we have confirmed same problem in Exchange 2016

    Wednesday, August 10, 2016 12:20 PM

Answers

  • Fixed, it was MY mistake.

    The failing account is the one used to deliver NDRs of premium journal messages, this is NOT a best practice; the best it's to create a dedicated account for the NDRs generated by premium journal. Once I did it, all inbound messages are being journaled, both Standard & Premium.

    Anyway I had to remove Premium Journal rules because it seems my CALs don't support Premium Journal rules, saddly they should be Enterprise CALs (it should be better if Exchange doesn't let me setup Premium Journal rules, IMO).

    Thanks for your help!

    • Marked as answer by EmilioROT Tuesday, August 30, 2016 10:21 AM
    Tuesday, August 30, 2016 10:21 AM

All replies

  • How are the "same senders" sending?

    Please describe the specifics of the journal rule you created.


    Ed Crowley MVP "There are seldom good technological solutions to behavioral problems."
    Celebrating 20 years of providing Exchange peer support!


    Thursday, August 11, 2016 5:50 AM
    Moderator
  • Hi,

    You said that you add a journal rule for all mail (inbound, outbound and internal). I want to confirm that you have configured journal rule like this

    Please try to re-configure journal on mailbox database and journal rule.

    And I test it in my environment, yes it's possible to have both Standard & Premiun journal working at a time. The difference is that if you have multiple mailbox databases in your mailbox server, you need to configure journal on all mailbox database to journal all messages in your organization.

    In addition, if these non-archived items are almost always from same senders, I suggest to configure journal rule to just journal messages sent from this sender. If this is a normal user mailbox?

    Best Regards.


    Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact tnmff@microsoft.com

    Lynn-Li
    TechNet Community Support

    Thursday, August 11, 2016 6:32 AM
    Moderator
  • Hi Lynn-Li,

    Thanks for your reply.

    Journal rule is exactly the same as your image.

    Yes, it's a normal user mailbox (my mailbox).

    Example: I receive every day a LinkedIn group notification, at around 11:30am. In my on-premises archiving software (it archives the Journal mailbox) I can find that last LinkedIn email was archived on August 7. On day 8, I setup the journal rule at 9.00am. After that, emails from August 8 to 18 are not archived on-premises neither are in the on-cloud software I'm testing.

    I raised Exchange logging for Journal but I find nothing strange.

    On my Ex 2013 network I deleted the journal rule, disabled per-store journal, reboot the machine and:

    - Setup only then journal rule: inbound emails for an account are not archived

    - Then enabled per-store journal: no luck, same behavior

    Is there some way to track journal step-by-step?

    Regards,


    • Edited by EmilioROT Thursday, August 18, 2016 11:59 AM
    Thursday, August 18, 2016 11:47 AM
  • Remember there're two networks, no relationship at all between both networks:

    Network 1: All machines are Windows 2012, Exchange is 2013

    Network 2: All machines are Windows 2012 R2, Exchange is 2016

    Before setup the journal rule, both Exchange had a Journal mailbox that had been enabled per-store and an on-premises software to archive, both were working fine.

    After setup a journal rule to test the on-cloud archiving, both Exchange are failing in the same way!!!

    Thursday, August 18, 2016 11:58 AM
  • I setup a journal rule for the account that is not being archived and it's not working, none inbound email is being journaled by the new rule.

    How to check step by step?

    Monday, August 22, 2016 8:26 AM
  • Fixed, it was MY mistake.

    The failing account is the one used to deliver NDRs of premium journal messages, this is NOT a best practice; the best it's to create a dedicated account for the NDRs generated by premium journal. Once I did it, all inbound messages are being journaled, both Standard & Premium.

    Anyway I had to remove Premium Journal rules because it seems my CALs don't support Premium Journal rules, saddly they should be Enterprise CALs (it should be better if Exchange doesn't let me setup Premium Journal rules, IMO).

    Thanks for your help!

    • Marked as answer by EmilioROT Tuesday, August 30, 2016 10:21 AM
    Tuesday, August 30, 2016 10:21 AM