Implementing Exchange 2003 Message Journaling

Why Journaling?

Message Journaling can become necessary because of political reasons or new regulations. Many organizations in the healthcare and insurance industry or financial services must record the communication between their customers and their employees.

Which Journaling?

There are three different types of journaling that you can enable in Exchange Server 2003.

Message-only journaling

Message-only journaling captures all messages from users on a specific mailbox database and sends the message copy to a specified journaling mailbox.

BCC journaling

BCC journaling is message-only journaling with a capture of BCC recipients. When BCC journaling is enabled, Exchange Server captures all recipients (TO / CC / BCC).

Note:
BCC journaling doesn’t work if the recipient list contains hidden distribution lists, query-based distribution lists, or distribution lists that have another expansion server.

Envelope journaling

Envelope journaling is different from message-only journaling and BCC journaling in that it allows you to archive P1 message headers (envelope headers). This includes information about the recipients, including BCC recipients and recipients from distribution groups.

How Exchange Envelope Journaling works

Message-only journaling sends a copy of a message to the journaling mailbox every time a user in a journal-enabled mailbox database sends or receives a message

Envelope journaling provides a much more useful service because it records data about all recipients that a message is delivered to.

Performance Impacts

Journaling will have an impact on the performance of your Exchange Servers and network infrastructure. Every e-mail delivered to your Exchange Mailbox Store will be copied and delivered to the Journaling account. This consumes much more disk space on your Exchange Servers – resulting in more CPU time and more disk input/output (I/O).

Enhanced Message Journaling also consumes more network bandwith.

Journaling Impact on User Mailbox Servers

When Message Journaling is enabled in a Mailbox Store, the server creates two messages when a user with a mailbox on that mailbox database sends a message. One message for the recipients and one for the journal recipient.

What is the performance impact?

When all other conditions of the Exchange Server remain unchanged, you can expect approximately a performance degradation from 15 to 35 percent

Installation

First we need to download the enhanced Journaling download tool here. The download size is only a few hundred KB. To use this tool, simply extract the content of EXEJCFG.EXE with a doubleclick. The package contains three files:

Eula.txt
Envelope Journaling.doc
Exejcfg.exe

Restriction

If you implement Exchange 200x’s message journaling feature, you should know that it only works on a per-mailbox store basis. Read more about how to implement Journaling on a per mailbox basis here.

What’s the difference between an Archive Sink and Journaling?

An Archive Sink allows only the capturing of e-mails that flow through a specific SMTP virtual Server. Journaling captures every e-mail that is sent or received by Exchange users in a specific mailbox store.

Standard Message only Journaling

First, create a user for Message Journaling.

Figure 1: Create the Journaling Exchange Mailbox

Now you must enable message journaling for a specific Mailbox Store. Start the Exchange System Manager, right click the specific Mailbox Store and enable message Archiving.

Figure 2: Enable Standard Message Archiving

Enhanced Message Journaling

To enable enhanced Message Journaling enter EXEJCFG –e from a command prompt.

Figure 3: Enable enhanced Message Journaling

EXEJCFG Parameters

Parameter	Description
-e	Enables envelope journaling.
-d	Disables envelope journaling
-l	Lists the envelope journaling setting — whether envelope journaling is enabled or disabled.
/?	Provides the list of options and a short help. If you run the command with no options, it defaults to this option.

Archived Messages Display

Figure 4: Content of the Journaling mailbox

Configuring Mailbox Manager to Clean the Journal Recipient Mailbox

It is recommend to clean up the Journal mailbox in regular intervals after you have moved the archived messages to another location (Third party tool or .PST file). To do this you can use the Mailbox Manager. The Mailbox Manager can permanently delete the messages in the Journal Mailbox after a specified time period.

It is recommended that you verify through testing and monitoring how long you want messages to remain in the Journal Mailbox. This depends on legal requirements and the timeframe that you want to have access to archived messages.

How to activate the Mailbox Manager

Start the Exchange System Manager and navigate to the Recipient Policies container and create a new Mailbox Manager Settings policy.

Figure 5: Create a Mailbox Manager Policy

It is important to limit the Filter rule to the Journaling account.

Figure 6: Limit the filter rule to the Journaling account

Now you can specify the action when processing a mailbox, for which folder and content age or size the cleanup process should start.

Figure 7: What to do when processing a mailbox

Conclusion

You should enable Message Journaling only if it is absolutely necessary because it can consume a lot of processor time, much more space on your hard disks and some network overhead.

Information about Exchange 2003 Journaling
http://www.microsoft.com/technet/prodtechnol/exchange/2003/library/journaling.mspx

Exchange 2003 Journaling Whitepaper Download
http://download.microsoft.com/download/0/7/3/0730fa29-1a77-43a0-87de-2f97e059fec8/Journaling%20with%20Exchange%20Server%202003.exe

Introduction to Journaling with Exchange Server 2003
http://www.microsoft.com/technet/prodtechnol/exchange/guides/E2k3Journal/0526b555-4da6-4ab0-93e5-1e6d20962c89.mspx

How to Enable the “Message Journaling” Function for an Exchange Server Mailbox Store
http://support.microsoft.com/default.aspx?scid=kb;en-us;261173&Product=exch2k

What’s the difference between Archive Sink and Journaling
http://blogs.msdn.com/exchange/archive/0001/01/01/174188.aspx

Troubleshooting message journaling in Exchange Server 2003 and in Exchange 2000 Server
http://support.microsoft.com/default.aspx?scid=kb;en-us;843105

Blind carbon-copy information does not appear in journaled messages in Exchange 2000 Server
http://support.microsoft.com/default.aspx?scid=kb;en-us;827716