locked
Preimum journaling / Journal rule not journaling email sent to an empty Distribution group RRS feed

  • Question

  • We noticed that while a journaling rule is supposed to journal on OnSubmittedMessage and OnRoutedMessage, this doesn’t seem to be the case with empty Distribution groups (unless I’m misinterpreting which events are which).

    As an explanation my company is moving from an onsite compliance archiving product to another cloud hosted compliance archiving product. Originally we used standard journaling on each mailbox database and set a separate journaling mailbox per mailbox server that our onsite compliance software would pull from. We also had a separate database containing journal mailbox for crafted email messages pulled from a pickup directory. These mailboxes contained things like IM’s, Tweets, etc. that we converted to EML files and dropped in the pickup directory so they could be archived and searched in our compliance/archiving product.

    We recently switched to a cloud hosted compliance/archiving product and setup a Premium Journaling / Journaling Rule to send all messages to an external contact associated with our cloud hosted solution. This allowed us to remove the majority of our journaling mailboxes since messages in a Journal queue don’t expire like normal messages when they can’t reach their destination. As for the mailboxes for all messages submitted to the pickup directory we were hoping to setup empty distribution groups for each type of message so that they wouldn’t need to be delivered to a journal mailbox any more. By default Exchange allows empty distribution groups and doesn’t generate NDR’s for them since Exchange successfully delivers the email to the number of recipients specified, zero.

    What we are noticing is that messages sent to empty distribution groups don’t get processed by Journal Rules unless they are set for a specific Expansion server that is different than the one the messages was received by.

    Example

    Email sent to an empty distribution group that doesn’t hit the Journaling Rule

    EventId  Source   Sender                            Recipients                        MessageSubject

    -------  ------   ------                            ----------                        --------------

    RECEIVE  STORE... Me@test.com                                     BlankDL@test.com                       NonExpansion-Test

    EXPAND   ROUTING  Me@test.com                                     {}                                NonExpansion-Test

    Email sent to the same distribution group but with an expansion server in another site

    EventId  Source   Sender                            Recipients                        MessageSubject

    -------  ------   ------                            ----------                        --------------

    RECEIVE  STORE... Me@test.com                                     BlankDL@test.com                       1qaz2wsx-Test

    RECEIVE  AGENT    MicrosoftExchange329e71ec88ae4... {Cloud@compliance.net}         1qaz2wsx-Test

    TRANSFER ROUTING  Me@test.com                                     BlankDL@test.com                       1qaz2wsx-Test

    TRANSFER ROUTING  MicrosoftExchange329e71ec88ae4... {Cloud@compliance.net}         1qaz2wsx-Test

    SEND     SMTP     Me@test.com                                     BlankDL@test.com                       1qaz2wsx-Test

    SEND     SMTP     MicrosoftExchange329e71ec88ae4... {Cloud@compliance.net}         1qaz2wsx-Test

    RECEIVE  SMTP     Me@test.com                                     BlankDL@test.com                       1qaz2wsx-Test

    EXPAND   ROUTING  Me@test.com                                     {}                                1qaz2wsx-Test

    So what I’m guessing is that in certain scenarios that the Journal Rule doesn’t actually evaluate a message on certain OnSubmittedMessage and OnRoutedMessage events. Or I’m confusing the actual stages.  Either way I was curious if there was a way to pull this off without having to continue to use a journaling mailbox for these messages originating from a pickup directory.

    As a side note, we have tried setting the “To” address for the messages dropped in this pickup directory to the external compliance/Archiving address but that resulted in duplicates showing up in our hosted system. One as regular message and one with the journal envelope information.

    Thursday, May 22, 2014 3:06 PM

Answers

  • Hi,

    I have research the issue and i found this should be a known issue that is shown in our exchange
    internal database. when the JournalEmailAddress is set to an empty DG address, Journal report vanishes
    in categorizer because there are no expanded recipients. This known issue is still under supervision by production team and currently no fix release plan is available to public world.

    However, as a workaround, we suggest you can leave an inactive user account to any empty distribution group to avoid the issue.


    Best regards, Frank Zhang

    • Marked as answer by Iczersigma Wednesday, June 4, 2014 1:44 AM
    Tuesday, June 3, 2014 3:01 AM

All replies

  • Hi Iczersigma,

    Thank you for your question.

    I am trying to involve someone familiar with this topic to further look at this issue.

    Thanks,

    Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com


    Simon Wu
    TechNet Community Support

    Monday, May 26, 2014 2:42 AM
    Moderator
  • Hi, 

    Please check if the below information are your concern:

    In an Exchange organization, all e-mail traffic is routed by the Hub Transport server. All messages traverse at least one Hub Transport server in their lifetime. The Journaling agent is a compliance-focused transport agent that processes messages on Hub Transport servers. It fires on the OnSubmittedMessage andOnRoutedMessage transport events.

    <http://technet.microsoft.com/en-us/library/aa998649(v=exchg.140).aspx>

    Meanwhile, what is your exchaneg servers' version?


    Best regards, Frank Zhang

    Wednesday, May 28, 2014 7:21 PM
  • Our Exchange version is 2010 SP2 RU4. I've referenced that info in my initial post and my question is that it appears that Exchange doesn't actually execute the journaling Agent on those events for empty groups. I assume that the OnSubmittedMessage event is any message that is sent to a Hub Transport. If that's the case then a message to submitted to an empty group is ignored by the journaling agent. The same goes for the OnRoutedMessage event.
    Thursday, May 29, 2014 1:52 PM
  • Hi,

    I have research the issue and i found this should be a known issue that is shown in our exchange
    internal database. when the JournalEmailAddress is set to an empty DG address, Journal report vanishes
    in categorizer because there are no expanded recipients. This known issue is still under supervision by production team and currently no fix release plan is available to public world.

    However, as a workaround, we suggest you can leave an inactive user account to any empty distribution group to avoid the issue.


    Best regards, Frank Zhang

    • Marked as answer by Iczersigma Wednesday, June 4, 2014 1:44 AM
    Tuesday, June 3, 2014 3:01 AM