Implementing Exchange 2003 Message Journaling

by [Published on 14 April 2005 / Last Updated on 14 April 2005]

Exchange 2003 provides a native Journaling feature which allows you to archive all incoming and outgoing e-mails for a specific mailbox store. Beginning with Exchange 2003 SP1 you can download EXEJCFG.EXE from the Exchange 2003 download site. EXEJCFG enhances the current Exchange archiving features to capture recipients on distribution lists, BCC recipients and other message details. In this article I will show you how to implement Exchange 2003 Journaling for e-mails.

Why Journaling?

Message Journaling can become necessary because of political reasons or new regulations. Many organizations in the healthcare and insurance industry or financial services must record the communication between their customers and their employees.

Which Journaling?

There are three different types of journaling that you can enable in Exchange Server 2003.

  • Message-only journaling

Message-only journaling captures all messages from users on a specific mailbox database and sends the message copy to a specified journaling mailbox.

  • BCC journaling

BCC journaling is message-only journaling with a capture of BCC recipients. When BCC journaling is enabled, Exchange Server captures all recipients (TO / CC / BCC).

Note:
BCC journaling doesn’t work if the recipient list contains hidden distribution lists, query-based distribution lists, or distribution lists that have another expansion server.

  • Envelope journaling

Envelope journaling is different from message-only journaling and BCC journaling in that it allows you to archive P1 message headers (envelope headers). This includes information about the recipients, including BCC recipients and recipients from distribution groups.

How Exchange Envelope Journaling works

Message-only journaling sends a copy of a message to the journaling mailbox every time a user in a journal-enabled mailbox database sends or receives a message

Envelope journaling provides a much more useful service because it records data about all recipients that a message is delivered to.

Performance Impacts

Journaling will have an impact on the performance of your Exchange Servers and network infrastructure. Every e-mail delivered to your Exchange Mailbox Store will be copied and delivered to the Journaling account. This consumes much more disk space on your Exchange Servers – resulting in more CPU time and more disk input/output (I/O).

Enhanced Message Journaling also consumes more network bandwith.

Journaling Impact on User Mailbox Servers

When Message Journaling is enabled in a Mailbox Store, the server creates two messages when a user with a mailbox on that mailbox database sends a message. One message for the recipients and one for the journal recipient.

What is the performance impact?

When all other conditions of the Exchange Server remain unchanged, you can expect approximately a performance degradation from 15 to 35 percent

Installation

First we need to download the enhanced Journaling download tool here. The download size is only a few hundred KB. To use this tool, simply extract the content of EXEJCFG.EXE with a doubleclick. The package contains three files:

  • Eula.txt
  • Envelope Journaling.doc
  • Exejcfg.exe

Restriction

If you implement Exchange 200x's message journaling feature, you should know that it only works on a per-mailbox store basis. Read more about how to implement Journaling on a per mailbox basis here.

What's the difference between an Archive Sink and Journaling?

An Archive Sink allows only the capturing of e-mails that flow through a specific SMTP virtual Server. Journaling captures every e-mail that is sent or received by Exchange users in a specific mailbox store.

Standard Message only Journaling

First, create a user for Message Journaling.


Figure 1: Create the Journaling Exchange Mailbox

Now you must enable message journaling for a specific Mailbox Store. Start the Exchange System Manager, right click the specific Mailbox Store and enable message Archiving.


Figure 2: Enable Standard Message Archiving

Enhanced Message Journaling

To enable enhanced Message Journaling enter EXEJCFG –e from a command prompt.


Figure 3: Enable enhanced Message Journaling

EXEJCFG Parameters

Parameter

Description

-e

Enables envelope journaling.

-d

Disables envelope journaling

-l

Lists the envelope journaling setting — whether envelope journaling is enabled or disabled.

/?

Provides the list of options and a short help. If you run the command with no options, it defaults to this option.

Archived Messages Display


Figure 4: Content of the Journaling mailbox

Configuring Mailbox Manager to Clean the Journal Recipient Mailbox

It is recommend to clean up the Journal mailbox in regular intervals after you have moved the archived messages to another location (Third party tool or .PST file). To do this you can use the Mailbox Manager. The Mailbox Manager can permanently delete the messages in the Journal Mailbox after a specified time period.

It is recommended that you verify through testing and monitoring how long you want messages to remain in the Journal Mailbox. This depends on legal requirements and the timeframe that you want to have access to archived messages.

How to activate the Mailbox Manager

Start the Exchange System Manager and navigate to the Recipient Policies container and create a new Mailbox Manager Settings policy.


Figure 5: Create a Mailbox Manager Policy

It is important to limit the Filter rule to the Journaling account.


Figure 6: Limit the filter rule to the Journaling account

Now you can specify the action when processing a mailbox, for which folder and content age or size the cleanup process should start.


Figure 7: What to do when processing a mailbox

Conclusion

You should enable Message Journaling only if it is absolutely necessary because it can consume a lot of processor time, much more space on your hard disks and some network overhead.

Related Links

Exchange 2003 Journaling Download tool
http://www.microsoft.com/downloads/details.aspx?familyid=e7f73f10-7933-40f3-b07e-ebf38df3400d&displaylang=en

Information about Exchange 2003 Journaling
http://www.microsoft.com/technet/prodtechnol/exchange/2003/library/journaling.mspx

Exchange 2003 Journaling Whitepaper Download
http://download.microsoft.com/download/0/7/3/0730fa29-1a77-43a0-87de-2f97e059fec8/Journaling%20with%20Exchange%20Server%202003.exe

Introduction to Journaling with Exchange Server 2003
http://www.microsoft.com/technet/prodtechnol/exchange/guides/E2k3Journal/0526b555-4da6-4ab0-93e5-1e6d20962c89.mspx

How to Enable the "Message Journaling" Function for an Exchange Server Mailbox Store
http://support.microsoft.com/default.aspx?scid=kb;en-us;261173&Product=exch2k

What's the difference between Archive Sink and Journaling
http://blogs.msdn.com/exchange/archive/0001/01/01/174188.aspx

Troubleshooting message journaling in Exchange Server 2003 and in Exchange 2000 Server
http://support.microsoft.com/default.aspx?scid=kb;en-us;843105

Blind carbon-copy information does not appear in journaled messages in Exchange 2000 Server
http://support.microsoft.com/default.aspx?scid=kb;en-us;827716

The Author — Marc Grote

Marc Grote avatar

Marc Grote is an MCSA/MCSE Messaging & Security, MCSE Private Cloud and Server Virtualization, an MCTS/MCITP and a Microsoft Certified Trainer and MCLC. He is a freelance Consultant and IT Trainer in the north of Germany near Hanover. He specializes in TMG/UAG Server, Exchange, System Center, Security for Windows Server 2012 and Windows Server 2012 designs, migrations and implementations. His efforts have earned him recognition as a Microsoft MVP for ISA Server since 2004.

Latest Contributions

Featured Links