Today I’d like to explain how to configure Custom Filtering & Custom Properties on Symantec Enterprise Vault side. It might be useful for you if you need to archive specific journal reports (emails) only, but not all emails.
Actually, I was trying to configure it myself, using Symantec documentation only, but I failed. Afterwards I raised a discussion within Symantec community, but again with no success. And finally I know how to complete Custom Filtering & Custom Properties configuration and I share this info here.
As I explained earlier, the scenario may includes (but not limited) the following cases: you would like to exclude any email from archiving if 3-rd party attribute has specific value (“True”, “False”, etc), for example.
Here we need to do 2 things:
1. Create Custom Filtering: in plain language it is customized rule which determine what actually Enterprise Vault has to do (ACTION) with journal email if CONDITION(s) is met.
E.g. email in journal report has attribute with the value “decrypted: true” and this email will be moved to Deleted items in Journaling Mailbox.
Default Filter Rules.xml
<RULE_SET xmlns=”x-schema:ruleset schema.xdr”>
<RULE NAME=”MoveDeletedItemsIfSuccess” ACTION=”MOVE_DELETED_ITEMS”>
<NAMEDPROP TAG=”Header” INCLUDES=”ANY”>
<PROP VALUE=”*x-si-jrda-result: success*” />
What it says: move the item (email) to Deleted Items if in Properties the following attribute with appropriate value exist: “*x-si-jrda-result: success*“
IMPORTANT: Don’t forget to make a frame with ‘*’ around your attribute and value. It cost me 1 day.
2. Create Custom Properties: in plain language it is file. It regulates which extra attribute must be indexed (and afterwards processes within Custom Filtering, in our case).
File looks like:
<?xml version=”1.0″ encoding=”UTF-8″?>
<CUSTOMPROPERTYMETADATA xmlns:xsi=”http://www.w3.org/2001/XMLSchema-instance” xsi:noNamespaceSchemaLocation=”customproperties.xsd”>
<!– 1. DEFINITION OF CONTENT CATEGORIES AVAILABLE –>
<!– 2. DEFINITION OF CUSTOM PROPERTIES AVAILABLE –>
<PROPERTY NAME=”0x007D” TAG=”Header”/>
<!– 3. DEFINITION OF PRESENTATION PROPERTIES AVAILABLE –>
<APPLICATION NAME=”search.asp” LOCALE=”1033″>
<FIELD TAG=”Header” LABEL=”Header” CATEGORY=”HeaderData”/>
<AVAILABLECATEGORY CONTENTCATEGORY=”HeaderData” LABEL=”Header”/>
It says: take the following property type 0x007D (0x007d: Message header) and associate it with the “Header” tag. Lately we will use this tag (see above Custom Properties content)
But what I have to do in case if my attribute isn’t in the Message Header? In this case I’d recommend you to use OutlookSpy or similar product to determine the correct property type.
IMPORTANT: if you look into Outlookspy trying to find Message Header, you will find there 0x007D001E tag. You have to use in Custom Properties 0x007D instead. Otherwise your rule won’t work.
Don’t forget to restart your EV tasks all the time when you do changes in Custom Properties and Custom Filtering files.
And the latest what you need to know is how to configure Trace Log. It is well explained in Symantec EV documentation. Analyzing afterwards tracing logs you can understand which part doesn’t work.
2961 11:35:29.134  (JournalTask) <7620> EV:L [CustomRules][CRule] Evaluating item againstMoveDeletedItemsIfSuccess rule…
Comment: Great. EV recognized your rule.
2962 11:35:29.134  (JournalTask) <7620> EV:L [CustomRules][CNamedPropClause] testing against ANY of 1 NamedProps
Comment: EV starts analyzing header against my rule.
2963 11:35:29.134  (JournalTask) <7620> EV:L [CustomRules][CNamedPropClause] : success DID NOT MATCH received: from servername (ip 220.127.116.11) by servername (ip 18.104.22.168) with microsoft smtp server id 22.214.171.124; mon, 12 may 2014| 11:32:44 +0200|content-type: application/ms-tnef; name=”winmail.dat”|content-transfer-encoding: binary|from: “user1)” <email@example.com>|to: “user2″|<firstname.lastname@example.org>|subject: mapiattribute 1/3-05/12/2014 11:32:44|thread-topic: mapiattribute 1/3-05/12/2014 11:32:44|thread-index: aqhbxdo+sllibg3/gzpuir9ss9mxow==|date: mon, 12 may 2014 09:32:44 +0000|message-id: <email@example.com>|x-ms-has-attach: yes|x-ms-tnef-correlator: <firstname.lastname@example.org>|mime-version: 1.0|x-si-jrda-result: success
Comment: despite of negative result I have something positive here. EV found my target word “success” and was trying to compare it with property value. So, it means that EV also indexed value.
But why do I have “DID NOT MATCH”?
Because the target word “success” isn’t framed with wildcards from both side “*success*”. In my case is enough to frame it with one side only.
It’s time to test new configuration.
Journal mailbox looks like on a picture below.
Email with subject: “Test01…” has specific attribute and will be moved to Deleted Items during archiving. Email with subject :”Test02…” will be archived as usual.
Start EV task:
In 2 sec check Deleted Items folder:
I wish you good luck with testing.