Overview
• My company has Designed and Implemented an Journal Archive and Discovery Solution for a University.
The solution provides Journal Archive and Discovery for approximately 22,000 users.
Approximately 15,000 University users /students are using Sun Mail Messaging , that BCC’s every message to an Exchange 2007 Journal Mailbox.
Journal Archive Solution , will then Journal Archive the Sun Mail message from the Exchange 2007 Journal Mailbox.
Problem Description - Sun Mail Messages Journaled by Exchange 2007 are unable to be Journal Archived by Archiving Software
• Sun mail has a feature to enable Microsoft like journaling. The message looks quite similar to exchange 2003 journaling when it arrives in a Exchange mailbox ( the message gets into the exchange mailbox via SMTP).
• The internal recipients (mailboxes that have mailboxes on the Sun mail system) have the recipients email address as userid@ims-ms-daemon e.g
Sender: <jdoe@xxxxx.edu>
Message-id: <fafefa3b2d19.4b583176@xxxxx.edu>
Recipients:
<jbrown@ims-ms-daemon>
<jdoe@ims-ms-daemon>
<jshaw@ims-ms-daemon>
<jsmith@ims-ms-daemon>
<userid@xxxx.com>
• All the sender & recipient addresses were not preceded by smtp
• Archiving Software Journal Archive, requires an Exchange 2007 Journal Message Report field/header to be , Message-ID
KB Article that outlines the required Header.
http://technet.microsoft.com/en-us/library/bb331962(EXCHG.80).aspx
• Currently the Exchange 2007 Message Report Field/Header and the Sunmail message recipient address fields are incorrect and therefore cannot be archived by Archiving software.
Current Workaround
• Manually Modified the current Sun Mail message format and recipient address fields , using the following process , and then the Sun Mail messages were archived successfully:
Using Outlookspy the message was modified with the following changes, and EV was then able to process the message as an envelope Journal message and the results were exactly similar to how an exchange 2003 Envelope journal message is archived.
1. Add PR_CONTENT_IDENTIFIER_W Tag number:0x0008001F Type:PT_UNICODE Value:ExJournalReport
2. Change the Message-id: fafefa3b2d19.4b583176@umdnj.edu to Message-ID: fafefa3b2d19.4b583176@umdnj.edu
3. Replace ims-ms-daemon with xxxxx.edu (our internal mail domain)
Sender: <jdoe@xxxxx.edu>
Message-id: <fafefa3b2d19.4b583176@xxxx.edu>
Recipients:
<jbrown@xxxxx.edu >
<jdoe@xxxxx.edu >
<jshaw@xxxxx.edu >
<jsmith@xxxxx.edu >
<userid@xxxxx.com>
Original message body Modified message body
Sender: <jdoe@xxxxxj.edu>
Message-id: <fafefa3b2d19.4b583176@xxxxx.edu>
Recipients:
<jbrown@ims-ms-daemon>
<jdoe@ims-ms-daemon>
<jshaw@ims-ms-daemon>
<jsmith@ims-ms-daemon>
<userid@gmail.com>
Sender: <jdoe@xxxx.edu>
Message-Id: <fafefa3b2d19.4b583176@xxxxx.edu>
Recipients:
<jbrown@xxxx.edu >
<jdoe@xxxxx.edu >
<jshaw@xxxxx.edu >
<jsmith@xxxxx.edu >
<userid@xxxxx.com>
Actions Taken
• Conducted a meeting with Archiving Software Vendor Technical Product Management to discuss the problem , analyze root cause and determine action plan.
Response
• Journal Archive Solution is designed to archive messages that are eligible for archiving .
• The Current Exchange 2007 Journal format of Sun Mail messages is not eligible for archiving.
• Archiving Software is not designed to alter Exchange 2007 Message format.
Root Cause
• Something is happening during the routing / redirection of the Sun Mail message to Exchange 2003 and then to the Exchange 2007 Journal Mailbox that is malforming the message format and spoofing Exchange 2007 to accept the Sun mail message format.
Suggested Action Plan
• Follow the Sun Mail message flow, through the entire routing / redirection process , from Sun Mail to Exchange 2003 and then to the Exchange 2007 Journal Mailbox .
• Determine where and when the message is malformed in this process , and correct the problem .
***Important note on flow of mail, Sun uses SIEVE REDIRECT to send copy of messages to Exchange 2003 server, Exchange 2003 forwards to Exchange 2007, where archiving is than done from the journal folder.***
SIEVE REDIRECT looks like this:
#BEGINFILTER
if anyof(true){
keep;
redirect "nagios@xxxxx.edu";
stop;
}
#ENDFILTER
DO you have any idea where header malformation can be happening and how to prevent it?