none
Journaling not working on all emails sent/received

    Question

  • I am in the process of completing a migration from Ex2007 to Ex2013. I have created a journaling recipient on a single database (db4). I then setup the standard journal recipient on each of the databases (DB1 to DB4).

    I am capturing most email but I know it is not capturing all email. Just by checking some arriving to me via other users internally and a specific external test (from mxguarddog, our spam filter service). As far as I know, all external email other than the test are being captured. When I send an email from my gmail account it is captured fine. When the old 2007 system was doing the journaling it did capture this same test, which is basically to send an email to port 25 of the ip address of the server from mxguarddog.

    The received headers look something like this:

    Received: from SVRNAME.mailserver.com (2002:c400:f::c400:f) by

     SVRNAME.mailserver.com (2002:c400:f::c400:f) with Microsoft SMTP Server

     (TLS) id 15.0.1367.3 via Mailbox Transport; Fri, 22 Jun 2018 08:17:11 -0500

    Received: from SVRNAME.mailserver.com (2002:c400:e::c400:e) by

     Svrname.mailserver.com (2002:c400:e::c400:e) with Microsoft SMTP Server

     (TLS) id 15.0.1367.3; Fri, 22 Jun 2018 08:17:11 -0500

    Received: from s480g.ik2.com (64.38.239.85) by SVRNAME.mailserver.com

     (196.0.0.14) with Microsoft SMTP Server id 15.0.1367.3 via Frontend

     Transport; Fri, 22 Jun 2018 08:17:10 -0500

    Date: Fri, 22 Jun 2018 08:17:10 -0500

    To: <lpooler@mailserver.com>

    From: <postmaster@mxguarddog.com>

    Reply-To: <postmaster@mxguarddog.com>

    Subject: MXGuarddog Email Delivery Test - lpooler@mailserver.com

    Message-ID: <587f24aac921623bde38f37c4107cc47@s480g.ik2.com>

    MIME-Version: 1.0

    Content-Type: multipart/alternative;

                    boundary="b1_587f24aac921623bde38f37c4107cc47"

    Content-Transfer-Encoding: 8bit

    Return-Path: bh-2-89933-94915505-999-1529673430@b.mxguarddog.com

    X-MS-Exchange-Organization-AuthSource: Svrname.mailserver.com

    X-MS-Exchange-Organization-AuthAs: Internal

    X-MS-Exchange-Organization-AuthMechanism: 10

    X-MS-Exchange-Organization-Network-Message-Id: 879f8fea-a020-4a7e-4c92-08d5d842769a

    X-MS-Exchange-Organization-AVStamp-Enterprise: 1.0

    Friday, June 22, 2018 1:28 PM

All replies

  • Hi Ipooler,

    Did you compare the journal rule in Exchange 2013 with the rule in Exchange 2007? Is there any difference?

    As far as I know, there isn’t much difference between journaling functionality in Exchange 2013 and Exchange 2007. If journaling is working in Exchange 2007, but not working in Exchange 2013, that may be due to the different detailed settings on journaling, please check.

    Details about journaling please refer to: Journaling


    Best Regards,
    Niko Cheng


    Please remember to mark the replies as answers if they helped. If you have feedback for TechNet Subscriber Support, contact tnsf@microsoft.com.


    Click here to learn more. Visit the dedicated forum to share, explore and talk to experts about Microsoft Teams.


    Monday, June 25, 2018 9:47 AM
    Moderator
  • The Journaling in 2007 was that I create a mailbox and attach it under the hub transport, journaling tab. In 2013 I have tried both the standard (where I go and attach a mailbox to the database, which is very simple) and advanced (create a rule). Both "work" in that I am getting journal emails but I am not getting all emails.

    Thanks for your help.

    Tuesday, June 26, 2018 1:47 PM