EMC Kazeon-eDiscovery

Transcription

1 Title Page EMC Kazeon-eDiscovery Version IS1200 EMC SourceOne Archive Connector User and Configuration Guide EMC Corporation Corporate Headquarters: Hopkinton, MA

2 Copyright EMC Corporation. All rights reserved. Published September 2015 EMC believes the information in this publication is accurate as of its publication date. The information is subject to change without notice. THE INFORMATION IN THIS PUBLICATION IS PROVIDED "AS IS." EMC CORPORATION MAKES NO REPRESENTATIONS OR WARRANTIES OF ANY KIND WITH RESPECT TO THE INFORMATION IN THIS PUBLICATION, AND SPECIFICALLY DISCLAIMS IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Use, copying, and distribution of any EMC software described in this publication requires an applicable software license. For the most up-to-date listing of EMC product names, see EMC Corporation Trademarks on EMC.com. Adobe and Adobe PDF Library are trademarks or registered trademarks of Adobe Systems Inc. in the U.S. and other countries. All other trademarks used herein are the property of their respective owners. The IS1200 software is based in part on software licenses from the following: Outside In Content Access , Chicago, Inc. Open Source code from called the itext.asian.jar available at: Copyright Demo Source and Support. All rights reserved In part on the work of the Independent JPEG Group. Code from Inxight Software, Inc. Copyright All rights reserved. Certain icons used by the Kazeon Web applications come from the Silk Icon set ( licensed under the Creative Commons Attribution 2.5 license ( ii IS1200 EMC SourceOne Archive Connector User and Configuration Guide v4.8.0

3 Contents Figures......vii Tables......ix Preface...xi Chapter 1 Chapter 2 Introduction About the IS Extending Server Functionality... 2 SourceOne Server Background... 2 SourceOne Archive Connector Deployment Overview... 3 SourceOne Archive Connector Deployment...3 Installing and Configuring the Connector Installation Overview... 8 Minimum Requirements for Connector Deployment... 8 Configure the SourceOne Worker Server to Avoid DocumentManagement Web Service Deadlock... 9 Creating IS1200 Access Credentials for SourceOne Servers Creating IS1200 Access Credentials on the SourceOne Security Group...11 Obtaining SourceOne Server Network Addresses Installing the EMC SourceOne Archive Connector License Adding the Access Credentials to the IS1200 Identity Vault Ensuring IS1200 AD Authentication Server Works with Lookup Button Registering Metadata Repositories for SourceOne IS1200 EMC SourceOne Archive Connector User and Configuration Guide v4.8.0 iii

4 Contents Chapter 3 Chapter 4 Registering EMC SourceOne Repositories About Registration Web-Admin Registration CLI Registration Other Helpful CLI Commands Workflow Changes for EMC SourceOne Archive Connector Limitations MetaData Changes Custodian Mapping Changes in Web-Admin Security and Permissions Supported Jobs and Services Setting SourceOne Jobs and Action Scope Selecting SourceOne Mapped Folders Selecting SourceOne , Files, or Sharepoint Selecting SourceOne Scope by Time Selecting SourceOne Scope by Display Name Selecting SourceOne Scope by Date Selecting SourceOne Owners, the Lookup Button Selecting SourceOne Scope Using Keywords Appendix A Configuring EMC SourceOne Servers IS SourceOne Authentication Requirements Use SSO for ExShortcut and Default (Anonymous) for Search and SearchWS Services Use BOTH SSO and Default (Anonymous) Authentication on Separate Worker Sites Appendix B Troubleshooting Handling SourceOne Archive Indexing Errors Fixing Result Filter Timeouts Errors When Registering SourceOne Server Data Repositories Reconciling Object Counts for SourceOne Repository Collections and Classifications SourceOne Connector Message Deduplication iv IS1200 EMC SourceOne Archive Connector User and Configuration Guide v4.8.0

5 Contents Glossary...57 Index...79 IS1200 EMC SourceOne Archive Connector User and Configuration Guide v4.8.0 v

6 Contents vi IS1200 EMC SourceOne Archive Connector User and Configuration Guide v4.8.0

7 Figures Title Page 1 The Web-Admin Licenses Page Add License Dialog Box The Web-Admin Identity Vault Page Add Identity Dialog Box The Web-Admin Add Repository Tab Web-Admin Single-step Collection Tab IS1200 EMC SourceOne Archive Connector User and Configuration Guide v4.8.0 vii

8 Figures viii IS1200 EMC SourceOne Archive Connector User and Configuration Guide v4.8.0

9 Tables Title Page 1 Revision History Details... xiv 2 Metadata Mapping for EMC SourceOne Archive Repositories Stop Words IS1200 EMC SourceOne Archive Connector User and Configuration Guide v4.8.0 ix

10 Tables x IS1200 EMC SourceOne Archive Connector User and Configuration Guide v4.8.0

11 Preface As part of an effort to improve its product lines, EMC periodically releases revisions of its software and hardware. Therefore, some functions described in this document may not be supported by all versions of the software or hardware currently in use.the product release notes provide the most up-to-date information on product features. Contact your EMC technical support professional if a product does not function properly or does not function as described in this document. Note: This document was accurate at publication time. Go to EMC Online Support ( to ensure that you are using the latest version of this document. Audience Related Documentation This guide is intended for both administrators and users (legal users, litigation support, or others doing searches or reports) of the EMC Kazeon - ediscovery server (or the IS1200). The guide covers the initial deployment and setup of the IS1200 EMC SourceOne Archive Connector and the subsequent workflow changes necessary for the IS1200 to work with the connector. The connector allows the IS1200 to register, classify, and do searches and reports on EMC SourceOne servers. IS1200 Installation and Quickstart Guide - describes installing and configuring the IS1200 server software. IS1200 Web-Admin User and Configuration Guide - describes using Web-Admin to setup and manage Kazeon clusters. IS1200 EMC SourceOne Archive Connector User and Configuration Guide v4.8.0 xi

12 Preface IS1200 Web-Search User Guide - describes using Web-Search to perform basic and advanced searches. IS1200 Web-Reports User Guide - describes using Web-Reports to create and use basic and advanced reports. IS1200 ediscovery Case Manager Administrators and Supervisors Guide - for legal representatives, a primer of all the web-based Interfaces above for performing ediscovery. IS1200 Command Line Interface Reference Guide - describes the IS1200 Command Line Interface and all its commands. Follow these steps to download IS1200 document from the web: 1. Go to and click the SUPPORT BY PRODUCT option in the home page. 2. In the Find a Product field, enter Kazeon. From the product selection list, choose one of the sub-headers (such as Kazeon ECS) and click the Find button. 3. Kazeon ECS window is displayed. Click the link for Documentation. 4. In the left-navigation menu, choose a version level to display the available documents. Conventions used in this document EMC uses the following conventions for special notices: DANGER indicates a hazardous situation which, if not avoided, will result in death or serious injury. WARNING indicates a hazardous situation which, if not avoided, could result in death or serious injury. CAUTION, used with the safety alert symbol, indicates a hazardous situation which, if not avoided, could result in minor or moderate injury. xii IS1200 EMC SourceOne Archive Connector User and Configuration Guide v4.8.0

13 Preface NOTICE is used to address practices not related to personal injury. Note: A note presents information that is important, but not hazard-related. IMPORTANT An important notice contains information essential to software or hardware operation. Typographical conventions EMC uses the following type style conventions in this document. Normal Used in running (nonprocedural) text for: Names of interface elements (such as names of windows, dialog boxes, buttons, fields, and menus) Names of resources, attributes, pools, Boolean expressions, buttons, DQL statements, keywords, clauses, environment variables, functions, utilities URLs, pathnames, filenames, directory names, computer names, filenames, links, groups, service keys, file systems, notifications Bold Used in running (nonprocedural) text for: Names of commands, daemons, options, programs, processes, services, applications, utilities, kernels, notifications, system calls, man pages Used in procedures for: Names of interface elements (such as names of windows, dialog boxes, buttons, fields, and menus) What user specifically selects, clicks, presses, or types Italic Used in all text (including procedures) for: Full titles of publications referenced in text Emphasis (for example a new term) Variables Courier Used for: System output, such as an error message or script URLs, complete paths, filenames, prompts, and syntax when shown outside of running text Courier bold Used for: Specific user input (such as commands) Courier italic Used in procedures for: Variables on command line User input variables < > Angle brackets enclose parameter or variable values supplied by the user [ ] Square brackets enclose optional values Vertical bar indicates alternate selections - the bar means or IS1200 EMC SourceOne Archive Connector User and Configuration Guide v4.8.0 xiii

14 Preface { } Braces indicate content that you must specify (that is, x or y or z)... Ellipses indicate nonessential information omitted from the example Where to get help Documentation Feedback EMC support, product, and licensing information can be obtained as follows. EMC product, and licensing information can be obtained as follows. Product information For documentation, release notes, software updates, or for information about EMC products, licensing, and service, go to the EMC Online Support at: Technical Support Go to EMC Online Support and click Service Center. You will see several options for contacting EMC Technical Support. Note that to open a service request, you must have a valid support agreement. Contact your EMC sales representative for details about obtaining a valid support agreement or with questions about your account. Your suggestions help us continue to improve the accuracy, organization, and overall quality of the user publications. Please send your comments or opinions on this document to: [email protected] Revision History Table 1 Revision History Details Revision Date September 2015 October 2014 August 2014 December 2013 Description Updated the Deduplication section in Glossary. Added information about support for SourceOne 7.2 version in Kazeon 4.8. Added information about support for SourceOne 7.1 SP2 version in Kazeon 4.8. Added information about support for SourceOne 7.1 SP1 version in Kazeon 4.8. Initial Publication xiv IS1200 EMC SourceOne Archive Connector User and Configuration Guide v4.8.0

15 1 Introduction This chapter provides general background information, and an introduction, to the products and concepts the reader must understand to use this guide. The guide is provided as a companion to the IS1200 Web-Admin User and Configuration Guide which should be read first as it contains most of the basic IS1200 server setup and maintenance information on which this guide builds. Topics include: About the IS Extending Server Functionality... 2 SourceOne Server Background... 2 SourceOne Archive Connector Deployment Overview... 3 SourceOne Archive Connector Deployment... 3 Introduction 1

16 Introduction About the IS1200 The EMC Kazeon - ediscovery (IS1200) is an integrated hardware and software system that provides information management solutions enabling organizations to efficiently and cost effectively classify, manage, and retrieve data. It provides consistent information visibility and control across distributed files, integrates seamlessly with existing infrastructures, and scales to support billions of files for searching, reporting, backup search and recovery, and file migration and archiving. The search capabilities are especially designed to facilitate ediscovery situations. Extending Server Functionality The IS1200 s standard functionality can be expanded with optional add-on modules like the EMC SourceOne Archive Connector. The EMC SourceOne Archive Connector requires an additional license for the IS1200 and allows the IS1200, IS1200 federations, and the Remote Office Edition, to access and work with all the content on EMC SourceOne repositories. IS1200 Information Centers (Federations) also support EMC SourceOne Archive Connector access. SourceOne Server Background Because many companies rely on as the primary means of communications, both internally and with customers, they have massive repositories of often with large file attachments. EMC SourceOne Management is a comprehensive, policy-based system that automatically collects, organizes, indexes and retains messages and associated attachments and stores them in designated archives connected to shared storage. SourceOne message archiving can provide significant mailbox storage space reductions and reduce backup and recovery time. SourceOne works for small, medium and large corporations, as well as companies with 100,000 inboxes. SourceOne archives from Microsoft Exchange and IBM Lotus Notes/Domino in addition to SMTP and instant messages. It provides high volume discovery search and collection for 2 IS1200 EMC SourceOne Archive Connector User and Configuration Guide v4.8.0

17 Introduction archived by the SourceOne Management and helps with compliance and governance regulations. Additionally, SourceOne offers user directed archiving allowing users to classify business-important records. Through a simple drag and drop in their inboxes, users can place messages into pre-defined archives with set retention periods. EMC SourceOne also supports file archiving and SharePoint archiving. SourceOne Archive Connector Deployment Overview If the EMC SourceOne Archive Connector is ordered with the original IS1200 appliance purchase, the appropriate optional module license is automatically included in the IS1200 basic license and is routinely installed along with the server license. If the EMC SourceOne Archive Connector is purchased after the original installation, the EMC SourceOne Archive Connector license key must be added to the installation before the EMC SourceOne Archive Connector can be configured or accessed. See the Installing License Keys chapter of the IS1200 Web-Admin User and Configuration Guide for details on obtaining and installing optional modules licenses for existing installations. SourceOne Archive Connector Deployment The EMC SourceOne Archive Connector software is automatically installed with all IS1200 installations, the EMC SourceOne Archive Connector license key simply activates it. To use EMC SourceOne Archive Connector purchased with a new installation, simply follow the standard hardware and software installation and configuration instructions in the Kazeon IS1200 Installation and Quickstart Guide and then use the rest of this guide to configure the EMC SourceOne Archive Connector. If the EMC SourceOne Archive Connector license key is obtained after the original Kazeon Information Server installation, use the following general steps to implement the EMC SourceOne Archive Connector capabilities. Introduction 3

18 Introduction 1. On each EMC SourceOne server that will be accessed, create a set of user credentials for the IS1200 to use when accessing those servers. See Creating IS1200 Access Credentials for SourceOne Servers on page 10 for details. 2. Obtain registration information for all EMC SourceOne servers, see Obtaining SourceOne Server Network Addresses on page 16 for details. 3. Use Web-Admin to add the EMC SourceOne Archive Connector license key to the IS1200, then quit and relaunch the Web-Admin. See the Installing License Keys chapter of the IS1200 Web-Admin User and Configuration Guide for details on installing optional modules licenses for existing installations. 4. Add the SourceOne access credentials to the IS1200 Identity Vault, see Adding the Access Credentials to the IS1200 Identity Vault on page 18 for details. 5. Ensure an appropriate Active Directory authentication server is registered with the IS1200, see Ensuring IS1200 AD Authentication Server Works with Lookup Button on page 19 for details. 6. Register the SourceOne repositories you want to work with. See Registering EMC SourceOne Repositories on page 21 for details. Once registered, SourceOne repositories can be classified and collected from. 7. Create any custom classification rules needed to extract situation-specific or case-specific metadata. See the Policies: Classification Extraction and Assignment Rules chapter of the IS1200 Web-Admin User and Configuration Guide for details. 8. SourceOne repositories may be classified directly, or used as collection sources to traditional CIFS or NFS target repositories. The targets may then be processed with all standard IS1200 features. If the SourceOne is to be used as a collection source, start a targeted collection against one or more mapped folders inside the SourceOne repositories and collect to a standard CIFS or NFS target repository. The following standard SourceOne criteria may be used to limit the collection (at least one is mandatory): Select one or more options from , Files, or Sharepoint Mapped Folders 4 IS1200 EMC SourceOne Archive Connector User and Configuration Guide v4.8.0

19 Introduction Mail Received Date Range SourceOne Display Name (For Only) File Accessed, Modified, and Created Date Range (for F iles and Sharepoint only) Owners One or more Keywords Schedule a one-time, or recurring, deep classification against the target repositories of the collection above. Alternately, use in-place processing on the registered SourceOne repositories with specific filters to classify just a subset of the SourceOne repositories. The following criteria may be used to limit what is classified. At least one filter is mandatory: Select one or more options from , Files, or Sharepoint Mapped Folders Mail Received Date Range SourceOne Display Name (For Only) File Accessed, Modified, and Created Date Range (for F iles and Sharepoint only) Owners (This is Mandatory) One or more Keywords 9. Monitor classification job results to ensure all objects are successfully indexed, and review errors and exceptions. 10. Login to Web-Search to search for objects stored in the registered SourceOne repositories. View search result documents in native or non-native formats, or apply Actionable Services (such as Copy, Export, Download, Delete Metadata Only, ReClassify, or Tagging). 11. Login to Web-Reports to create reports about objects stored on registered SourceOne repositories. View report result documents in native or non-native formats, or apply Actionable Services (such as Copy, Export, Download, Delete Metadata Only, ReClassify, or Tagging). 12. Login to the ediscovery Case Manager application to create cases and organize collections, searches, and actionable services by case. Introduction 5

20 Introduction 6 IS1200 EMC SourceOne Archive Connector User and Configuration Guide v4.8.0

21 2 Installing and Configuring the Connector This chapter describes how to install the EMC SourceOne Archive Connector. Topics include: Installation Overview... 8 Minimum Requirements for Connector Deployment... 8 Configure the SourceOne Worker Server to Avoid DocumentManagement Web Service Deadlock... 9 Creating IS1200 Access Credentials for SourceOne Servers Creating IS1200 Access Credentials on the SourceOne Security Group Obtaining SourceOne Server Network Addresses Installing the EMC SourceOne Archive Connector License Adding the Access Credentials to the IS1200 Identity Vault Ensuring IS1200 AD Authentication Server Works with Lookup Button Registering Metadata Repositories for SourceOne Installing and Configuring the Connector 7

22 Installing and Configuring the Connector Installation Overview Installing and configuring the IS1200 for the EMC SourceOne Archive Connector requires the following basic steps: Ensure the EMC SourceOne server meets the minimum requirements to support the EMC SourceOne Archive Connector. Configure the EMC SourceOne worker server to avoid potential deadlock of the DocumentManagement web service. Obtain existing, or create new, access credentials to the EMC SourceOne server that allow the IS1200 to connect and work with all EMC SourceOne servers that will be registered as data repositories. An existing primary service account may be used, however, if this is not permitted, new credentials must be created. Obtain the network addressing information for each EMC SourceOne server. Install the EMC SourceOne Archive Connector license on the IS1200. Add the IS1200 EMC SourceOne access credentials to the IS1200 Identity Vault. Ensure the Active Directory authentication server registered with IS1200 is one that contains the usernames and addresses of the users whose is archived on the EMC SourceOne Management Archive Server. This allows the Lookup button (found in IS1200 dialogs) to find registered mailbox owners (custodians) when setting up jobs such as collections from EMC SourceOne Management repositories. Create and register metadata repositories for all EMC SourceOne repositories to be registered. Each basic step above is explained in detail below. Minimum Requirements for Connector Deployment Before the EMC SourceOne Archive Connector can be deployed, you must ensure that all EMC SourceOne servers to be registered meet the following minimum requirements: The EMC SourceOne Worker Server must be hosted by either a Windows 2003 or 2008 server. 8 IS1200 EMC SourceOne Archive Connector User and Configuration Guide v4.8.0

23 Installing and Configuring the Connector If the Worker Server is running IIS 7 then ensure that IIS 6 Management compatibility is also installed. All EMC SourceOne servers must be running any of the following supported versions: SP1 7.1 SP2 7.2 The IS1200 must be running version or later. All mapped folders on the EMC SourceOne servers must be fully indexed. This is required to use the keywords filters as described in Selecting SourceOne Scope Using Keywords on page 43. All EMC SourceOne servers must have sufficient bandwidth to accommodate the increased load the EMC SourceOne Archive Connector will place on it. Configure the SourceOne Worker Server to Avoid DocumentManagement Web Service Deadlock On the EMC SourceOne worker server, edit the file: c:\windows\microsoft.net\framework\v \config\mac hine.config Remove the settings: allowdefinition="machineonly" from the "ProcessModel" section, by doing the following: 1. In the file, find the section <configsections>, then change the text as shown below, the changes are in red. Installing and Configuring the Connector 9

24 Installing and Configuring the Connector From:... <sectiongroup name="system.web" type="system.web.configuration.systemwebsectiongroup, System.Web, Version= , Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a">... <section name="processmodel" type="system.web.configuration.processmodelsection, System.Web, Version= , Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" allowdefinition="machineonly" allowlocation="false" /> To:... <sectiongroup name="system.web" type="system.web.configuration.systemwebsectiongroup, System.Web, Version= , Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a">... <section name="processmodel" type="system.web.configuration.processmodelsection, System.Web, Version= , Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" allowlocation="false" /> Note: The red text allowdefinition="machineonly" is missing from the To example. Refer to: for more details about this setting. 2. Once the changes are made, restart IIS by doing the following: From the Start menu, click Run. In the Open box, type cmd, and then click OK. At the command prompt, type the following: iisreset See the following Microsoft article for more details: 3/Library/IIS/95826e7a-bac4-4e1f-bcb6-c52d49c9d7f4.mspx?mfr=true Creating IS1200 Access Credentials for SourceOne Servers To classify an EMC SourceOne repository, the IS1200 must have an account a username and password to access the EMC SourceOne server. You may need to contact your EMC SourceOne administrator to have them provide this account. 10 IS1200 EMC SourceOne Archive Connector User and Configuration Guide v4.8.0

25 Installing and Configuring the Connector The preferred account is the primary service account, or a similar account that is part of the EMC SourceOne Security group. The account must be registered on the Active Directory server that authenticates for all the EMC SourceOne servers that will be registered on the IS1200 as data repositories. This account must have access to all mapped folders on the EMC SourceOne server and be able to search for and download any of the s and non- objects in these folders. If the EMC SourceOne administrator is not allowed to provide the primary service account, then you must create an IS1200 credentials account as described in the section immediately below, Creating IS1200 Access Credentials on the SourceOne Security Group. After creating the account, it must be stored on the IS1200 as an identity, see Adding the Access Credentials to the IS1200 Identity Vault on page 18 for details. Note: Identity usernames and passwords for EMC SourceOne repositories may contain only US-ASCII characters. Creating IS1200 Access Credentials on the SourceOne Security Group This section should only be used if the primary service account cannot be used as the IS1200 identity to access the EMC SourceOne servers. In this case, you need to create a new set of credentials to store in the IS1200 identity as follows. Installing and Configuring the Connector 11

26 Installing and Configuring the Connector 1. Start by setting up a new user account on the Active Directory (AD) server used by the EMC SourceOne servers you intend to register as data repositories. For example add the account: is1200idaccount 2. Add this account to the EMC SourceOne server security group on the AD server. 3. Log in to the EMC SourceOne server where the EMC SourceOne Management console is installed and ensure this account has complete access permissions to all parts of the SourceOne data repositories the IS1200 will need to access. 12 IS1200 EMC SourceOne Archive Connector User and Configuration Guide v4.8.0

27 Installing and Configuring the Connector Generally, this means ensuring the new account is part of the SourceOne Security Group and that group has been granted all permissions for all Mapped Folders, as shown below for one folder. 4. Then open the Application Configuration menu (left pane below) and ensure the SourceOne Security Group is entered in the Security group name: field found in the Retrieval tab as shown below. 5. Enable Basic Authentication on the EMC SourceOne Worker server. If the worker server host is Windows 2003, do the following: Note: If the Worker Server is running IIS 7 then ensure that IIS 6 Management Compatibility is been installed. Installing and Configuring the Connector 13

28 Installing and Configuring the Connector a. Open Internet Information Services (IIS), select ExDocMgmtSvc in the left pane, and right-click it to open it s Properties dialog as shown below. b. In the ExDocMgmtSvc Properties dialog, select the Directory Security tab and click the Edit button in the Authentication and access control section. c. When the Authentication Methods dialog below opens, 14 IS1200 EMC SourceOne Archive Connector User and Configuration Guide v4.8.0

29 Installing and Configuring the Connector Generally ensure the dialog options are as shown above, specifically ensure the Basic Authentication checkbox is set as shown above and close the dialogs. If the worker server host is Windows 2008, do the following: a. Open Internet Information Services (IIS), select ExDocMgmtSvc in the left pane,. b. Double-click Authentication under IIS in the middle pane. c. When the Authentication pane opens, Right-click the Basic Authentication listing and choose Enable. Installing and Configuring the Connector 15

30 Installing and Configuring the Connector 6. With both 2003 and 2008, stop and re-start the ExDocMgmtSvc Application pool. 7. Verify the credentials work. Login to the EMC SourceOne server Web Search application with the new user account Select Search Type as 'Administrator' Find messages from one or more mapped folders Double click a message and verify that it can be downloaded Obtaining SourceOne Server Network Addresses To register a EMC SourceOne repository, the IS1200 requires specific network configuration information about the EMC SourceOne server. Ask a EMC SourceOne administrator to provide the following information about each EMC SourceOne server that will be registered. A repository reference name (what IS1200 users will see it referred to as in menus where the EMC SourceOne server may be selected as a source repository) The IP Address or HostName of the EMC SourceOne Search Web service The port number of the EMC SourceOne Search Web service The IP Address or HostName of the EMC SourceOne Document Management Service 16 IS1200 EMC SourceOne Archive Connector User and Configuration Guide v4.8.0

31 Installing and Configuring the Connector The port number of the EMC SourceOne Document Management Service Installing the EMC SourceOne Archive Connector License If you purchased the EMC SourceOne Archive Connector with your original IS1200 appliance, the license key has already been installed. If you purchased the EMC SourceOne Archive Connectorlater, do the following to install the license key: 1. Locate the EMC SourceOne Archive Connector license key number and copy it to the system clipboard. It is most likely in the body of the licensing that came when the module was purchased. 2. Login to the IS1200 Web-Admin application. 3. Under the Administration heading in the left navigation pane, click Licensing, the Licenses page opens. Figure 1 The Web-Admin Licenses Page Installing and Configuring the Connector 17

32 Installing and Configuring the Connector 4. Click Add License in the toolbar, the Add License dialog box appears Figure 2 Add License Dialog Box Paste the license key from the clipboard into the empty field, and click Add. 5. Click Refresh in the Licenses page toolbar to confirm the installation. For complete details on installing and managing IS1200 license keys, see the IS1200 Web-Admin User and Configuration Guide chapter on Administration: Backups, Licenses, and Healthinfo. Adding the Access Credentials to the IS1200 Identity Vault Once you have the username and password obtained from Creating IS1200 Access Credentials on the SourceOne Security Group on page 11, do the following to add them to the IS1200 Identity Vault. They are needed to register the EMC SourceOne repositories later. 1. Login to the IS1200 Web-Search application. 2. From the Web-Search left navigation pane under Authentication, click Identity Vault, the Identity Vault page appears. Figure 3 The Web-Admin Identity Vault Page 18 IS1200 EMC SourceOne Archive Connector User and Configuration Guide v4.8.0

33 Installing and Configuring the Connector 3. Click Add in the toolbar, the Add Identity dialog opens. Figure 4 Add Identity Dialog Box 4. Enter values for the following fields: Identity Name. Enter a name to identify the EMC SourceOne credentials, maximum of 24 alphanumeric characters, NO spaces. User Name. Enter the EMC SourceOne credentials username Note: Identity usernames and passwords for EMC SourceOne repositories may contain only US-ASCII characters. Password. Enter the EMC SourceOne credentials password, and enter it again in the confirm field. Domain. Enter the domain name where the username can be authenticated. 5. Click Submit to add the identity to the identity vault. For complete details on using and managing identities, see the Identity Vault chapter of the IS1200 Web-Admin User and Configuration Guide. Ensuring IS1200 AD Authentication Server Works with Lookup Button Ensure that the Active Directory (AD) authentication server registered with the IS1200 is the AD server that contains the usernames and addresses of all the users (custodians) that have mailboxes archived on the EMC SourceOne servers that will be registered as data repositories. If this is not the case, the Lookup button described in Selecting SourceOne Owners, the Lookup Button on page 42 will not work properly. Installing and Configuring the Connector 19

34 Installing and Configuring the Connector See the Configuring External Authentication chapter of the IS1200 Web-Admin User and Configuration Guide for details on configuring AD authentication. Registering Metadata Repositories for SourceOne Create and register metadata repositories for EMC SourceOne server you intend to register as a data repository. Standard metadata repository sizing requirements apply. See the Repository Registration and Management chapter of the IS1200 Web-Admin User and Configuration Guide for complete details on creating and registering metadata repositories. 20 IS1200 EMC SourceOne Archive Connector User and Configuration Guide v4.8.0

35 3 Registering EMC SourceOne Repositories This chapter discusses how to register EMC SourceOne servers as IS1200 data repositories, allowing them to be classified, searched, and reported on. Topics include: About Registration Web-Admin Registration CLI Registration Other Helpful CLI Commands Registering EMC SourceOne Repositories 21

36 Registering EMC SourceOne Repositories About Registration After completing the installation and configuration described in the previous chapter, the EMC SourceOne servers must be registered as data repositories with the IS1200. Registration is required before a EMC SourceOne server may be classified, searched, or otherwise worked with by the IS1200. The EMC SourceOne Archive Connector requires the IS1200 to be running version 4.4 or later and the EMC servers to be running any of the supported EMC SourceOne versions 6.6, 6.7, 6.8, 7.1 SP1, or 7.1 SP2. EMC SourceOne servers may be registered as data repositories from both the GUI, and the Command Line Interface (CLI). Before using either registration method, be sure to have the EMC SourceOne server network configuration information described in Obtaining SourceOne Server Network Addresses on page 16 at hand for all the EMC SourceOne servers that will be registered. 22 IS1200 EMC SourceOne Archive Connector User and Configuration Guide v4.8.0

37 Registering EMC SourceOne Repositories Web-Admin Registration To register a EMC SourceOne server as an IS1200 data repository using Web-Admin, do the following: 1. Login to Web-Admin. 2. From the Web-Admin navigation pane under Repositories, click SourceOne Archive, the Add Repository tab appears. Figure 5 The Web-Admin Add Repository Tab 3. If it is not already selected, select SourceOne Archive from the Repository Type drop-down menu. 4. Fill in the following fields: Name: Enter a reference name for this repository. The IS1200 uses reference names, instead of the full repository filepaths, in all menus where a user must choose a repository, for example when choosing a data repository for a classification or collection. Reference names must be unique. Reference names are limited to 127 bytes (127 ASCII characters, or as few as 31 Registering EMC SourceOne Repositories 23

38 Registering EMC SourceOne Repositories four-byte UTF-8 encoded characters). Reference names may include some special characters, see Special Characters on page 73 for details. When seen in a menu, the reference name will be expandable to show all the mapped folders it contains, allowing one or more mapped folders to be selected. Metadata Repository Select a metadata repository from the drop-down menu to associate with the EMC SourceOne server, be sure to select one of the metadata repositories created specifically for your EMC SourceOne repositories, and to assign a metadata repository only once. SourceOne Options: Use this section to enter the information described in Obtaining SourceOne Server Network Addresses on page 16. Document Management Service Parameters IP Address/Server Name. Enter the IP address, or hostname, of the EMC SourceOne server s Document Management service. Port. Enter the port number of the EMC SourceOne server s Document Management Service. Search Web Service Parameters IP Address/Server Name. Enter the IP address, or hostname, of the EMC SourceOne server s Web service. Port. Enter the port number of the EMC SourceOne server s Search Web service. Connection Credentials Identity. From the drop-down menu, select the identity created to hold the access credentials needed for the IS1200 to access the EMC SourceOne server. See Creating IS1200 Access Credentials for SourceOne Servers on page 10 and Adding the Access Credentials to the IS1200 Identity Vault on page 18 for more information. Note: Identity usernames and passwords for EMC SourceOne repositories may contain only US-ASCII characters. 5. Click Submit to register the data repository. 24 IS1200 EMC SourceOne Archive Connector User and Configuration Guide v4.8.0

39 Registering EMC SourceOne Repositories CLI Registration To register a EMC SourceOne server as an IS1200 data repository from the (CLI), login to the CLI as admin and issue the following command: Note: This method is recommended only for system administrators already familiar with the CLI. add SourceOneArchive <referencename> kazfs <metadatarepname> as <identity> search-service-host <search-server_ip-host> search-service-port <search-server_port#> document-service-host <document-server_ip-host> document-service-port <document-server_port#> Where the <bracketed text> is to be supplied by the user as follows: <referencename> A unique name to assign to the server for the IS1200 to use when displaying the server as a potential source repository in job setup screens, for example in a deep classification setup. This is usually the common name that users know the server by. <metadatarepname> The name of the metadata repository for the EMC SourceOne servers (if not specified, the IS1200 chooses an available metadata repository). <identity> The name of the identity stored in the IS1200 Identity Vault containing the access credentials the IS1200 needs to access this EMC SourceOne server. See Creating IS1200 Access Credentials for SourceOne Servers on page 10 and Adding the Access Credentials to the IS1200 Identity Vault on page 18 for more information <search-server_ip-host> Host name or IP address of the SourceOne s search web service. <search-server_port#> (Optional) Port number of the SourceOne s search web service [ default 80 ] <document-server_ip-host> Host name or IP address of the SourceOne s document web service. <document-server_port#> (Optional) Port number of the SourceOne s document web service [ default 80 ] Registering EMC SourceOne Repositories 25

40 Registering EMC SourceOne Repositories Other Helpful CLI Commands Once a EMC SourceOne server is registered as a data repository, the following Command Line Interface commands are helpful in managing it. For complete descriptions of the syntax and usage of these commands, see the IS1200 Command Line Interface Reference Guide. SET FS <fsname> <state> REMOVE FS <fsname> SHOW FS parameter The set fs command may be used to toggle any repository on or off line. <fsname> The IS1200 reference name assigned to the repository to affect. <state> The desired state for the repository. The remove fs command is used to delete, or un-register, a repository. The repository must be off-line first. <fsname> The IS1200 reference name assigned to the repository to affect. Display the configuration and parameters of registered repositories. Follow show fs with any of the following parameters: detail Enter an information type to display (maps stats all metadata) type Enter a repository type to filter by (kaz data localkaz exchange ev) fs-name Enter a specific repository name. status Enter to show health statistics for registered repositories. SHOW REPOSITORY <parameter) Display the configuration and parameters of registered repositories. Follow show fs with any of the following parameters: repository name Name of the repository to show path Relative path of folder/site to be listed e.g. /Documents 26 IS1200 EMC SourceOne Archive Connector User and Configuration Guide v4.8.0

41 Registering EMC SourceOne Repositories type folder, all Type of entries to be listed. default: folder. values: Registering EMC SourceOne Repositories 27

42 Registering EMC SourceOne Repositories 28 IS1200 EMC SourceOne Archive Connector User and Configuration Guide v4.8.0

43 4 Workflow Changes for EMC SourceOne Archive Connector This chapter discusses the workflow differences, compared to standard IS1200 operation, required by repositories accessed by the IS1200 EMC SourceOne Archive Connector. Topics include: Limitations MetaData Changes Custodian Mapping Changes in Web-Admin Security and Permissions Supported Jobs and Services Setting SourceOne Jobs and Action Scope Selecting SourceOne Mapped Folders Selecting SourceOne , Files, or Sharepoint Selecting SourceOne Scope by Time Selecting SourceOne Scope by Display Name Selecting SourceOne Scope by Date Selecting SourceOne Owners, the Lookup Button Selecting SourceOne Scope Using Keywords Workflow Changes for EMC SourceOne Archive Connector 29

44 Workflow Changes for EMC SourceOne Archive Connector Once the EMC SourceOne Archive Connector is installed and configured, and all the EMC SourceOne archives are registered as data repositories, the IS1200 can begin standard operations and provide standard services for all registered EMC SourceOne Archive repositories. This chapter details the differences in features, workflow, and operations between using registered SourceOne repositories and using standard NFS or CIFS data repositories. Limitations Not all standard jobs and services are supported with registered EMC SourceOne repositories. The following exceptions exist: Only four EMC SourceOne repositories may be registered with an IS1200 cluster. EMC SourceOne repositories are source only, the IS1200 cannot write or delete message files on them. Consequently, the IS1200 cannot maintain access times during crawls, cannot enforce legal hold on them, nor perform collections, copies, legal exports, or downloads with EMC SourceOne repositories as targets. EMC SourceOne repositories may not be discovered using the Web-Admin Environment Discovery tab. EMC SourceOne repositories only allows deep classifications. The IS1200 cannot enforce legal hold or retention on the EMC SourceOne file system. It can record legal hold in the associated metadata repositories. In Web-Admin, the repository health check function has limited scope and can only report whether the EMC SourceOne servers are accessible, or not. The IS1200 can pause and resume jobs based on this status. Access Control Lists (ACLs) information and file extensions of the file system objects and Sharepoint documents cannot be found in the registered EMC SourceOne archive repositories. EMC SourceOne for file systems does not store the file systems permissions and file extensions during the file archiving activity. IS1200 searches for filepath:<originalfilename> on SourceOne server do not give any result because the file path from SourceOne archive does not have the original file name. In order to search for SourceOne file archive object's file name you may use the attribute sourceonearchivefilename:<filename>. 30 IS1200 EMC SourceOne Archive Connector User and Configuration Guide v4.8.0

45 Workflow Changes for EMC SourceOne Archive Connector In the Web-Admin Deep Crawl setup screen, the Remove Deleted Documents from Kazeon Index checkbox is not supported for SourceOnce repositories. Do a Metadata Synchronization Service instead. Objects ( s, files, Sharepoint documents, etc.) larger than 100 Mbytes can not be downloaded from EMC SourceOne repositories. EMC SourceOne does not provide the proper html tags for wiki, issues, and Sharepoint item objects in the Sharepoint archive. For these objects, IS1200 shows the Document type as Unknown. EMC SourceOne does not save owner information for files during file archiving. IS1200 captures the archived file access information to represent the custodian of the files. In some cases, EMC SourceOne does not save the access permission details. For these objects, the system shows custodian information as Unassigned. EMC SourceOne does not save owner information for Objects created with System Account in SharePoint. For these objects Custodian is shown as Unassigned. Workflow Changes for EMC SourceOne Archive Connector 31

46 Workflow Changes for EMC SourceOne Archive Connector MetaData Changes The following metadata fields are new, or changed for EMC SourceOne servers. Table 2 Metadata Mapping for EMC SourceOne Archive Repositories Kazeon Metadata Fields Description Indexed? SourceOneArchiveOwner SourceOne object Owners (Owner name is stored, not address or legacy DN) Yes SourceOneArchiveFolderName Name of mapped folder where the SourceOne object was found Yes SourceOneArchiveMetaDataModificati ontime Metadata modification time. For internal use only. No SystemMTime Set to receive time (SourceOne NPM property Id 4) Yes SystemCTime Set to receive time (SourceOne NPM property Id 4) Yes SystemCreationTime Set to receive time (SourceOne NPM property Id 4) Yes SystemATime Set to receive time (SourceOne NPM property Id 4) Yes SystemOwner Not relevant for SourceOne objects. Set to Kazeon. N/A SystemExtension Not set for sourceone object N/A SystemFilePath sourceone://<s1-repository-name>/<folder-id>/<object-id> Yes SystemFileSize Size of SourceOne object Yes OriginalsourceCustodian Multivalued field, Set to SourceOne Owner(s) by default. Yes OriginalsourceLocation sourceone://<s1-repository-name>/<folder-id>/<object-id> Yes SourceOneArchiveFileName Filename of a SourceOne archived object Yes SourceOneArchiveObjectType Type of objects in SourceOne archive Yes SourceOneArchiveOriginalFileLocation Location of file objects from where it s been archived in SourceOne No SourceoneArchiveFileVersion File version of a Sharepoint object No SourceoneArchiveOriginalOwner The intersection of owner filter with all owners from SourecOne archive.if no owner filter is specified then the value will be all owners belonging to an object in SourceOne No Indexed fields are searchable. 32 IS1200 EMC SourceOne Archive Connector User and Configuration Guide v4.8.0

47 Workflow Changes for EMC SourceOne Archive Connector Custodian Mapping Changes in Web-Admin Prior to release 4.7.0, the IS1200 extracts only a single owner (custodian) for each classified. The custodian is determined according to the custodian mapping defaults set in. Because EMC SourceOne objects can have multiple owners (for journalize messages), the EMC SourceOne Archive Connector enables the IS1200 to extract a new multi-valued metadata property that records multiple owners. IS and later introduces a way to restrict showing multiple custodians for a SourceOne object. Now, SourceOne owner filter is mandatory for every crawl. Custodian values are limited to only the values specified in the filter and never goes beyond that. For example, if an contains four owners as OwnerA, OwnerB, OwnerC, and OwnerD and you run a crawl with OwnerA and OwnerB as owner filters then, OwnerA and OwnerB are shown as Custodians for this object instead of listing all owners. "SourceOneArchiveOwner" metadata field holds the owner information which allows you to still search for all owners associated with an object. For more information, please see Table 2 on page 32. Now, the search result filter time is reduced because all the associated owners of an object are not present in the result filter.the Custodian filter is mandatory. The following LDAP parameter can be used to disable/enable the mandatory custodian. /module/config/sourceone/mandatorycustodian By default the value of this LDAP parameter is ON, so that crawls on SourceOne cannot be run with owner filter. To display the current value of this LDAP setting, use the following command: sh config param /module/config/sourceone/mandatorycustodian To change the default LDAP setting from ON to OFF do the following: 1. Login to the IS1200 leader node as an admin user. 2. Issue the Command Line Interface command: set config param /module/config/sourceone/mandatorycustodian value "off" Workflow Changes for EMC SourceOne Archive Connector 33

48 Workflow Changes for EMC SourceOne Archive Connector on EMC SourceOne repositories have the custodian field set to their owner(s) by default, however the default mapping can be overridden with exception setting. Because EMC SourceOne s may have multiple custodians, the following situations should be noted: If a search returns an that contains multiple custodians, and that is Copied, Moved, Downloaded, or Exported, the metadata created on the target will include all multiple custodians, subject to the following bullet. The default number of exportable custodians per is unlimited. However, a configuration parameter exists to limit this to a specified maximum. If this parameter is set, some s may not have all their custodians recorded on the target metadata when exported. For example, if an is sent to a distribution list with thousands of recipients (giving this thousands of custodians), and the limit is lower than the number of users in the distribution list, not all custodians will be recorded on the target. If the Lookup button is used to select custodians for a search or collection job, all the user addresses found will be searched for, however, if the results are exported the username metadata that is added to the target repository only contains the short name used in the Lookup button to search for those addresses. For example, if the Lookup button is used to search for Bob Smith, and it returns [email protected], [email protected], and [email protected], any s found and exported will only have the metadata custodian Bob Smith recorded. See Selecting SourceOne Owners, the Lookup Button on page 42 for more details on using the Lookup button. Security and Permissions The IS1200 accesses registered EMC SourceOne repositories using the identity associated with the repository when it is registered. This identity usually has administrator s privileges and generally has no limits on what it can access or open. This may raise security issues for IS1200 users that are not themselves administrators. The 34 IS1200 EMC SourceOne Archive Connector User and Configuration Guide v4.8.0

49 Workflow Changes for EMC SourceOne Archive Connector EMC SourceOne Archive Connector does not enforce user-level access checks or permission checks for user searches or user-initiated jobs and services. Supported Jobs and Services The following job types are supported: Deep classifications from Web-Admin and Processing from the ediscovery Case Manager Web-Admin and ediscovery Case Manager collections may be performed from EMC SourceOne repositories Web-Admin Metadata Classifications and Reclassifications. EMC SourceOne metadata may be deleted. The following Actionable Services (actions) are supported for Web-Search results: Tagging - adding or changing tags in the EMC SourceOne results metadata repository Copy FROM - results may be copied from EMC SourceOne repositories to registered IS1200 target repositories (CIFS, NFS, Centera, Celerra, etc).copied s are stored to the MSG format, and do not preserve any proprietary formats the EMC SourceOne repository may have used. Download - FROM only - search result files may be downloaded from EMC SourceOne repositories to registered IS1200 target repositories (CIFS, NFS, Centera, Celerra, etc) as Metadata in CSV format, or as native documents to ZIP files. Legal Export FROM only - results may be exported from EMC SourceOne repositories to load formats for other legal applications, such as Concordance, to registered IS1200 target repositories (CIFS, NFS, Centera, Celerra, etc). Reclassify - result may be reclassified for more targeted analysis with different rule sets. Delete is supported only for EMC SourceOne metadata. Workflow Changes for EMC SourceOne Archive Connector 35

50 Workflow Changes for EMC SourceOne Archive Connector Setting SourceOne Jobs and Action Scope EMC SourceOne servers may contain many terabytes of data. Consequently, when the IS1200 presents a dialog to select a EMC SourceOne repository in job setup screens like deep crawls, collections, or in-place processing a mechanism to allow the user to specify sub-sections of the EMC SourceOne repository can be very helpful. The IS1200 provides several ways to limit selection scope on a EMC SourceOne repository: Select one or more options from , Files, or Sharepoint Mapped Folders Mail Received Date Range SourceOne Display Name (For Only) File Accessed, Modified, and Created Date Range (for F iles and Sharepoint only) Owners One or more Keywords These folders and filters work the same in all the job and action setup screens listed below: Web-Admin Deep Classifications Web-Admin Single-step Collections Web-Admin In-place Processing ediscovery Case Manager Add Case: Repository Selection tabs ediscovery Case Manager Add Collections tabs The following sections describe these folders and filters. Selecting SourceOne Mapped Folders Conveniently, EMC SourceOne servers automatically provide one method of limiting selection scope through their top level content organization scheme. EMC SourceOne servers organize top-level content into mapped folders. 36 IS1200 EMC SourceOne Archive Connector User and Configuration Guide v4.8.0

51 Workflow Changes for EMC SourceOne Archive Connector When the IS1200 presents a repository selection dialog, it lists all the registered EMC SourceOne repositories as possibilities, but allows restricting the selection to one or more mapped folder in those repositories. The screen below shows a repository selection screen for EMC SourceOne repositories. Figure 6 Web-Admin Single-step Collection Tab Notice that the Show drop-down menu has EMC SourceOne selected as the repository type, and that each EMC SourceOne repository listing in the Available box is proceeded by a plus sign. When a EMC SourceOne server listing plus sign is clicked, that repository s mapped folders are expanded beneath it. Any mapped folder may be clicked, and then selected for the job or service by clicking the blue right-arrow to the right of the Available box. Selecting SourceOne , Files, or Sharepoint Another way to limit the selection scope on a EMC SourceOne repository is by selecting one or more options from , Files, or Sharepoint objects. This is done with the include options shown below: Workflow Changes for EMC SourceOne Archive Connector 37

52 Workflow Changes for EMC SourceOne Archive Connector Note: Selecting one of the options from s, Files, or Sharepoint is mandatory. If option is selected, then following type of objects are filtered from SourceOne archive: s message, contact, Meeting, Task, PostedNote, JournaleEntry, StickyNote, Appointment, DeliveryReport, ReadReport, OtherReport, FaceTime, BloomBerg, AIKONIX, IMLOGIC, MINDALIGN, NOTICE, TaskRequest, UBSChat, Other Note: Lotus Domino non- object crawls are not supported. If Files option is selected, then following type of objects are filtered from SourceOne archive: Files, Other If Sharepoint option is selected, then following type of objects are filtered from SourceOne archive: Documents, Sharepoint Item, Wiki, Picture, Issues, Other Note: By default option is selected. But one or all of the three options can be selected. Note: In Web-Search previewer can only render JPeg,BMP,PNG,GIF,TIFF1,TIFF2 picture formats crawled from SouceOne archive which has sharepoint picture library's. In the Web-Search to search for different types of SourceOne archive objects following object types can used in the filter sourceonearchiveobjeccttype: <objecttype> message: 65 Contact: 66 Meeting: 72 Task: 68 Posted Note: 69 Journal Entry: 70 Sticky Note: IS1200 EMC SourceOne Archive Connector User and Configuration Guide v4.8.0

53 Workflow Changes for EMC SourceOne Archive Connector Appointment: 67 Document: 73 Delivery Report: 74 Read Report: 75 Other Report: 76 Facetime: 77 Bloomberg: 78 Aikonix: 79 Imlogic: 80 Mindalign: 81 Notice: 82 Task Request: 83 UBS chat: 84 Other: 90 File: 3000 Sharepoint Item: 500 Wiki: 501 Picture: 502 Issues: 503 Selecting SourceOne Scope by Time Note: Received Date Filter is displayed only if option is selected as mentioned in the above section Selecting SourceOne , Files, or Sharepoint. Another way to limit the selection scope on an EMC SourceOne repository is by date/time. This is done with the options shown below. Click the calendar icons to open a dialog to choose dates Workflow Changes for EMC SourceOne Archive Connector 39

54 Workflow Changes for EMC SourceOne Archive Connector between which you want to set the scope. For example, if you set a: From Time of 1 Jan :00:00 and To Time of 1 Apr :00:00 then the filter will include messages which are sent ON or AFTER 1 Jan :00:00 and BEFORE 01 Apr :00:00 (That is, all messages sent in the months Jan, Feb, and Mar.) Alternately, enter a number (of days) in the field to limit the scope to messages sent or received between the time the job is run and that number of days ago, inclusive. Note: Using this filter requires that the IS1200 was configured with the correct time zone during it s initial setup. See the Using kaz_setup.pl section of the Configuring Server Network Connectivity chapter of the IS1200 Installation and Quickstart Guide for details. Selecting SourceOne Scope by Display Name Note: SourceOne Display Name (For only) is displayed only if option is selected in the above section Selecting SourceOne , Files, or Sharepoint on page 37. Another way to limit the selection scope on an EMC SourceOne repository is by display name. This filter allows you to filter the s by Sender or Recipient. This is done with the options shown below: Search on domain names (such as [email protected]) is not allowed. You must enter the display name, not the SMTP address. Note: SourceOne Display Name filtering requires full-text indexing enabled on all selected business folders in sourceone.if this is not the case, Display Name filter can return incomplete results. 40 IS1200 EMC SourceOne Archive Connector User and Configuration Guide v4.8.0

55 Workflow Changes for EMC SourceOne Archive Connector For example, if you enter Alana in the SourceOne Display Name field then the filter will include messages whose sender/recipient matches Alana like, Alana B Gaymon, Alana B Raysor, Alana, and so on. EMC SourceOne performs a contains search in this case. To filter multiple display names in the field SourceOne Display Name, a semi-colon separated list can be entered where the values are OR d. Supported wild cards are at the beginning or end of the Display Name. For example, Alana*; *Cluff. Embedded wild cards are not supported. To use SourceOne Display Name filter for terminated users (non AD users), turn off the mandatory LDAP parameter. Please see the section Custodian Mapping Changes in Web-Admin on page 33 to turn off the mandatory LDAP parameter. Selecting SourceOne Scope by Date Note: Time Filters (For Files and Sharepoint Only) is displayed only if Files or Sharepoint option is selected in the section Selecting SourceOne , Files, or Sharepoint on page 37. Another way to limit the selection scope on an EMC SourceOne repository is by date. This filter allows you to filter the Files or Sharepoint items by date. This is done with the options shown below: Click the calendar icons to open a dialog to choose dates for the following fields: Last Accessed (for Files Only): The last date when a file was accessed. This field is not applicable for Sharepoint items. Last Modified: The last date when a file or a Sharepoint item was modified. Created: The creation date of a file or a Sharepoint item. Workflow Changes for EMC SourceOne Archive Connector 41

56 Workflow Changes for EMC SourceOne Archive Connector Alternately, enter a number (of days) in the limit the scope. field to Note: Filtering using this option requires full-text indexing enabled on all selected business folders in SourceOne. Selecting SourceOne Owners, the Lookup Button Another way to limit the selection scope on a EMC SourceOne repository is by user, owner, or custodian. This is done with the Owner Filter shown below. The screen above is from a Web-Admin Single-Step Collection setup tab, but the Lookup button on it works the same everywhere it is found in Web-Admin, the ediscovery Case Manager, and in Web-Search. Click the Lookup button to open the standard Lookup dialog. Note: For the Lookup button to work correctly, the appropriate Active Directory authentication server must be registered with the IS1200. See Ensuring IS1200 AD Authentication Server Works with Lookup Button on page 19 for details. Lookup is Active Directory based, Lookup for Lotus Domino users is not supported. Note: Wild cards or partial names will not match any s in SourceOne. 42 IS1200 EMC SourceOne Archive Connector User and Configuration Guide v4.8.0

57 Workflow Changes for EMC SourceOne Archive Connector If manually entering Active Directory custodians, click the Add button to add a semi-colon separated list. When manually entering a list of Domino custodians, use a semi-colon separated list in Notes Canonical format. For example: CN=John Smith/OU=Boston/O=Company or CN=John Smith/OU=Boston/O=Company;CN=John Smith/OU=SanJose/O=Company;CN=John A. Smith/ OU=Boston/O=Company;CN=Smith/OU=SanJose/O=Company To delete the custodians from the Owner Filter list, select the custodian in the grid and click Delete button. Note: If mandatory custodian LDAP parameter is ON then the SourceOne Owner filter grid displays the custodian list for the previous crawl. In Web-Admin, these preserved custodians are shown in repository level and in ediscovery Case Manager they are shown against per case. Selecting SourceOne Scope Using Keywords Lastly, selection scope may be limited by defining keywords to filter using the section shown below. Enter a space separated list of keywords to filter by. Note: Keyword filtering will not work unless all mapped folders are fully indexed by the EMC SourceOne server. Keyword filtering is only supported for collections and in-place processing. Workflow Changes for EMC SourceOne Archive Connector 43

58 Workflow Changes for EMC SourceOne Archive Connector 44 IS1200 EMC SourceOne Archive Connector User and Configuration Guide v4.8.0

59 A Configuring EMC SourceOne Servers This appendix discusses configuring EMC SourceOne servers to allow both basic and single sign on authentication. This section explains various options for setting up EMC SourceOne server authentication to allow the IS1200 to properly communicate with the SourceOne servers. Topics include: IS SourceOne Authentication Requirements Use SSO for ExShortcut and Default (Anonymous) for Search and SearchWS Services Use BOTH SSO and Default (Anonymous) Authentication on Separate Worker Sites Configuring EMC SourceOne Servers 45

60 Configuring EMC SourceOne Servers IS SourceOne Authentication Requirements The EMC Kazeon - ediscovery (IS1200) must be able to connect to its registered SourceOne repository s Search and SearchWS sites in order to function properly with those servers. However, SourceOne servers can be configured to use either default(anonymous) or Single Sign On (SSO) authentication. EMC SourceOne servers are sometimes configured to use SSO authentication to facilitate ExShortcut, see the EMC SourceOne 6.6 Installation Guide for details about when, why, and how ExShortcut is used. For the IS1200 to function properly in this situation, the SourceOne server must be set up to use both default (anonymous) and SSO authentication, specifically, the Search and SearchWS sites should NOT be modified from their default configuration states. Neither Windows Authentication nor Basic Authentication options should be enabled for the SearchWS site. This can be accomplished in the following two ways. Use SSO for ExShortcut and Default (Anonymous) for Search and SearchWS Services The ExShortcut (Mobile) website is not dependant on the Search or SearchWS sites, and can coexist when only ExShortcut uses SSO. If SSO authentication is needed only for ExShortcut, and not needed for other SourceOne services, then simply configure the ExShortcut (Mobile) website for SSO and the Search and SearchWS sites for default(anonymous). If you are installing the EMC SourceOne Archive Connector in a situation where the SourceOne sites have all been converted to SSO, then simply back-out the SSO changes from the Search and SearchWS sites, this returns them to their default Anonymous authentication setup. Refer to the SourceOne 6.6 Installation Guide for details. 46 IS1200 EMC SourceOne Archive Connector User and Configuration Guide v4.8.0

61 Configuring EMC SourceOne Servers Please refer to the following figure of SearchWS service's authentication configuration: Use BOTH SSO and Default (Anonymous) Authentication on Separate Worker Sites If resources permit, simply create two instances of the SourceOne Web Services. Setup one to respond to SSO authentication, and the second to respond to default (anonymous) authentication. Then, configure the IS1200 to work with the default (anonymous) authentication sites. Refer to the SourceOne 6.6 Installation Guide for details. Configuring EMC SourceOne Servers 47

62 Configuring EMC SourceOne Servers 48 IS1200 EMC SourceOne Archive Connector User and Configuration Guide v4.8.0

63 B Troubleshooting This chapter details procedures useful for troubleshooting IS1200 SourceOne data repositories. Topics include: Handling SourceOne Archive Indexing Errors Fixing Result Filter Timeouts Errors When Registering SourceOne Server Data Repositories Reconciling Object Counts for SourceOne Repository Collections and Classifications SourceOne Connector Message Deduplication Troubleshooting 49

64 Troubleshooting The following issues may be encountered when SourceOne Servers are registered as IS1200 data repositories. Handling SourceOne Archive Indexing Errors While an IS1200 job or service is accessing a SourceOne Archive server using the SourceOne Connector, the SourceOne Archive may return index inconsistency errors to the connector. When this occurs, the connector forwards the error to the IS1200 and the IS1200 aborts the current job or service and records the error in the job log. When these errors occur, contact your SourceOne Archive administrator to have them fixed, and then re-run the IS1200 job or service. The following jobs or services may be aborted by these indexing errors: Deep Classification, Inplace processing, Single Step Collections, and Legal Application Collections on SourceOne archives without filters or with filters like date, owner, size etc. Inplace processing, Single Step Collections, and Legal Application Collections on SourceOne archive using a SourceOne keyword filter. When these errors abort a SourceOne Archive job or service, the IS1200 reports the problem in several places: In Web-Admin, the Job List tab displays the job as aborted as shown below. 50 IS1200 EMC SourceOne Archive Connector User and Configuration Guide v4.8.0

65 Troubleshooting Also in the Web-Admin Job List tab, clicking the Detail icon in the tool-bar produces the screen below: In the ediscovery Case Manager, in the Case Activities tab as shown below. Troubleshooting 51

66 Troubleshooting In the ediscovery Case Manager, in the CaseDetail > Activities > Collection Activities tab as shown below. For Compound Jobs If classifications include more than one URLs from one or more SourceOne Archive Servers, the following applies: 1. As soon as the classification detects an indexing error, the job is aborted. Only the URLs from the SourceOne Archives completely classified before the errors are detected are indexed. 2. The remaining URLs are not classified. 3. After the errors are fixed, the classification must be re-submitted for all SourceOne Archives that were not fully classified before the error aborted the job. Fixing Result Filter Timeouts Occasionally a search on a SourceOne repository may display only a limited number of results and when either a Results Filter tab filter is applied, or a Results Filters sub-heading s View more link is clicked, a timeout error may display resulting in no results being returned. The timeout error can be managed in two ways: Change the method the new results are displayed by Change (increase) the IS1200 search timeout value For more information, see the following sections. 52 IS1200 EMC SourceOne Archive Connector User and Configuration Guide v4.8.0

67 Troubleshooting Changing the Filter Method The IS1200 prepares search results displays two way, one called A1 and A2. A1 is the default for search results with less than 2000 listings, and for non-sourceone search results is usually the faster method, which is why it is the default. However, for SourceOne searches, A2 is usually faster, so a configuration parameter is available to force all SourceOne result displays to use A2. Be aware that A2 does not prevent timeouts, it just makes them less likely for SourceOne result displays. After switching to A2, timeouts can still occur for larger result sets. To force A2 for SourceOne, do the following on all IS1200 nodes: 1. Open configuration file /opt/openkaz/config/searchgroupings.xml 2. Find the following line. <common name="usea1" value="true" /> 3. Change true to false so the line looks as follows. <common name="usea1" value="false" /> 4. Save the file. 5. Stop and re-start the cluster. Changing the IS1200 System Timeout Value See the Changing the Search and Review Filters Timeout Values heading in the Configuration Files and Utilities appendix of the IS1200 Web-Admin User and Configuration Guide. Errors When Registering SourceOne Server Data Repositories If the SourceOne Worker host does not have ASP.NET properly installed, or if IIS was installed after Windows Communication Foundation (WCF) was installed, you may experience issues connecting to the ExDocMgmtSvc hosted IIS service. If these issues occur while registering SourceOne servers as data repositories you may see error 405 Method Not Allowed like following as an example: Mount failed with error - Troubleshooting 53

68 Troubleshooting Failed to connect to ES1Archive ' ' using identity 'ID_ES1' : Failed to execute authenticate operation on the Document Management service on host HTTP Transport error : '405' - 'Method Not Allowed' The issue is explained in more detail in the following Microsoft support link: 52(v=vs.90).aspx According to Microsoft, if the application mappings are not correct they may be remedied using the following Microsoft tools: aspnet_regiis.exe ServiceModelReg.exe The link gives the following two examples for using these tool: (Procedures will vary based on IIS and.net Framework versions) On the Worker machine, 1. Register ASP.NET and enable the aspnet_isapi web service extension for IIS: %WINDIR%\Microsoft.NET\Framework\v \aspn et_regiis i enable 2. Install and register the WCF Service Model extensions in IIS: "%WINDIR%\Microsoft.Net\Framework\v3.0\Windows Communication Foundation\ServiceModelReg.exe" i 3. Now, try to register EMC SourceOne repository from IS1200. Reconciling Object Counts for SourceOne Repository Collections and Classifications If search result counts for archives made by the SourceOne server do not match collection or classification result counts on a SourceOne data repository made by the IS1200, then check the following: If operating in the United States in an area were daylight savings time is in effect, you must also have an appropriate timezone set on the IS1200. See the Using kaz_setup.pl section of the Configuring Server Network Connectivity chapter of the IS1200 Installation and Quickstart Guide for details on setting the timezone. 54 IS1200 EMC SourceOne Archive Connector User and Configuration Guide v4.8.0

69 Troubleshooting The following are the more frequently used zones: US/Alaska US/Central US/Eastern US/Hawaii US/Mountain US/Pacific SourceOne Connector Message Deduplication In some corner cases, duplicate messages can be archived in a SourceOne mapped folder resulting in search counts from the SourceOne server and Web-Search dis-agreeing. This can be avoided using the LDAP configuration entry: /module/config/sourceone/removeduplicates By default this LDAP parameter is configured off and the IS1200 does not de-duplicate messages in SourceOne mapped folders. If set to on, then the IS1200 does de-duplicate messages in SourceOne mapped folders, however this takes additional processing time. To set the LDAP entry on use the following command: set config param /module/config/sourceone/removeduplicates value "on" To set the LDAP entry off use the following command: set config param /module/config/sourceone/removeduplicates value "off" To display the current value, use the following command: sh config param /module/config/sourceone/removeduplicates Note: A cluster restart is not required after changing this LDAP parameter. Troubleshooting 55

70 Troubleshooting 56 IS1200 EMC SourceOne Archive Connector User and Configuration Guide v4.8.0

71 Glossary This glossary contains terms related to disk storage subsystems, networks, file management, and ediscovery. Many of these terms are used in this manual. A active case Active Directory (AD) Actions, Actionable Services Access Control List (ACL) In ediscovery situations, a company may have more than one legal issue (case) in progress at a time. Often it is advantageous to limit job or search scope to just one case. When the user interface scope is limited to a particular single case, that case is the active case. A technology created by Microsoft that provides a variety of network services, including: LDAP-like directory services, Kerberos-based authentication, and DNS-based naming and other network information. Services such as copy, move, delete, tagging, and so on, that can be applied to search and report results and allow the IS1200 to be an effective file management tool for registered repositories. A file system level data file that specifies how users or groups may access resources on a computer or network, like an application, file or printer, and the rights they have to it, for example read access, write access, and so forth. For more information on how the IS1200 may use ACLs, see the Controlling ACL Checking section of the Configuration Files and Utilities appendix of any IS1200 User Guide for details. 57

72 Glossary Advanced Search A search made from the IS1200 Advanced Search link. Allows searching for extracted metadata by tag-value pairs, and allows multiple variable and boolean searches. Agents See connectors on page 61. Assignment Rules Auditing Authorization Rule Authentication An assignment rule is a type of classification rule. It tags files with metadata and assigns files to policy groups. Assignment rules are contained in Assignment Rule Sets (ASRs). See the Policies: Classification, Extraction and Assignment Rules chapter of the any IS1200 User Guide for more details. A service that allows the IS1200 to record all system events according to who did what, when, and the event result. This data is especially useful to Legal Service Providers when providing an audit trail for responsive data produced during ediscovery. Complete details are available in the Auditing and Data Verification chapter of any IS1200 User Guide for details. A policy rule that filters search results to ensure that the assigned files can only be viewed by authorized users. IS1200 authorization policies may be used to add additional levels of security to the Access Control Lists (ACLs) for file objects found in registered data repositories. See the Policy Groups: Authorization Policies chapter of any IS1200 User Guide for more details. The process of identifying users based on user name and password to ensure that only authorized users can access the IS1200. B Basic Search A search made from the Search page using only the Search field. Searches only the content found in the fulltext field populated during classifications. C CAS Device CASID EMC s Content Addressed Storage (CAS) devices are cluster-able archival devices that host archival business file content such as , office productivity files (like word processing and spreadsheet files), images, and other file documents. A unique IS1200 ID for each classified file that the system generates during basic classification. 58

73 Glossary Centera Server Celerra Server checkpoints, checkpointing Classification Rule Classification Service The EMC Centera server is a networked storage system specifically designed to store and provide fast, easy access to fixed content (information in its final form). It is a CAS device providing long-term retention and assured integrity designed to store and manage data that require or have legally mandated retention periods, for example medical records and files relevant to legal matters. An EMC server designed to store and manage archival data. The Celerra File Level Retention (FLR) server also allows enforcing enterprise or governmental retention policies. Checkpoints and checkpointing allow IS1200 jobs and services to resume more efficiently if the job or service is paused or stopped before it completes. Basically, the IS1200 records bookmarks about what file or object was last processed. This allows the IS1200 to skip to the bookmark the checkpoint when the job or service is resumed, and avoid reprocessing all the files and objects already processed. However, checkpoints are not set for every file accessed, instead most jobs divide file processing into batches and the checkpoints indicate where batches started. Consequently, when a job restarts at a checkpoint, some objects may be reprocessed again and in cases such as a 'Copy' service with 'enable-versioning' option selected duplicate versioned files will be created on the target repository when those objects are reprocessed. Rules that the system implements during data classification to extract metadata, tag files, and assign files to policy groups. The two types of classification rules are extraction rules and assignment rules. Sometimes called a crawl. An IS1200 service that accesses job-specified registered repositories and extracts and records their metadata to later facilitate comprehensive and cross-repository searches. Classifications extract metadata according to extraction rules, compute digests for all objects, and assigns files to policy groups according to assignment rules. See Assignment Rules on page 58, Extraction Rules on page 65, Hash Values on page 66, and Policy Groups on page 70 for more details. Classifications may be full, every object in the specified repositories is parsed and its metadata repopulated in the indexes and databases, or they may be differential, see Differential Classifications on page 63 of more details. 59

74 Glossary Cluster CAS Content Addressable Storage CSV Comma Separated Values CLI Command Line Interface Concepts Search conceptfinder Ruleset A set of IS1200 appliance nodes working as a unit. A cluster can contain a maximum of four nodes. A cluster can be used to control other clusters, see Information Center Server on page 67 for details. Rather than address data objects by a file name, at a physical location, a CAS device uses a content address (hash-code identifiers) based on file contents to store file objects in a flat file system that maximizes storage efficiency. This returns a unique identifier (Content Address) used to store and retrieve data objects. A file type used to transfer data between applications such as databases and spreadsheets. The CLI is a traditional command line interface that allows direct communications with the IS1200 backend using a the set of commands defined in the IS1200 Command Line Interface Reference Guide. The standard IS1200 software supports keyword exploration. However, in the initial stages of the legal discovery process (often called ediscovery), keyword search alone may not be as concise or as time-efficient as required by standard legal timetables. Concepts augments standard keyword searching by automatically suggesting filters based on the results of a current search. By default it looks for concepts based on persons, countries, noun groups, organizations, company names, and products. Concepts Search is an optional module that requires an additional license key for each IS1200 cluster node. See the IS1200 Concepts Search User and Configuration Guide for complete details. The conceptfinder ruleset is an assignment ruleset that extracts the concepts listed in the Review/Analysis Results Grouping Concepts pane, which is only available when a valid Concepts license is installed on the IS1200. The conceptfinder ruleset must be used in deep classifications to get the best results in Review/Analysis from the Concepts heading of the Results Grouping pane. The ConceptFinder_DWF assignment ruleset combines both the conceptfinder ruleset and the DocsWithoutFullText ruleset. See DocsWithoutFullText Assignment Ruleset on page 64 for more details. 60

75 Glossary connectors Container file/object Custodian Connectors are IS1200 optional modules that allow an IS1200 to work with repository types beyond the standard CIFS and NFS repositories. See optional modules on page 70 for more details. Optional module connectors require separate licenses to be purchased and installed on all nodes of an IS1200 cluster. For a complete list of optional modules available, see the Introduction chapter of any IS1200 User Guide. Some connectors, such as the Microsoft Exchange Server Connector, require agents. Agents are additional server platforms, usually Windows servers, that provide the additional CPU cycles and network staging the IS1200 needs to work with the repository types they connect to. All connectors have their own user guides which can be accessed from the Kazeon Documentation link on the IS1200 Manager page ( A file (object) that contains other files (sub-objects), such as a ZIP, TAR, JAR, and PST or NSF files. The container file is often called the parent and the contained objects are called children. Container objects should not be confused with files that have embedded objects, such as Microsoft Word files that have embedded charts or graphics (OLE). A legal term used by Legal Service Providers (LSP) and other legal personnel to describe the owners or responsible parties for electronic documents pertinent (responsive) to a legal matter. D Data Datamap Data-Mount Data Server A file of any type and size such as a short , a word processor document, or a large spreadsheet. A report that lists the electronic storage locations of all possible sources of relevant ESI. This can include standard file servers, groupware servers, servers and their backup and archive systems as well as custodian s desktop and laptop computers. The NFS file system that is accessed by the IS1200 to parse data and extract metadata. The file server that exports an NFS or CIFS file system so that the IS1200 can classify data on the file system to create metadata. 61

76 Glossary Data-Share Data Repository Data Verification Deduplication The CIFS file system to be accessed by the IS1200 to extract metadata. A networked file system registered with the IS1200 so it can be classified, searched, and reported on. Data repositories created on the IS1200 itself (sometimes called localdatafs) are strongly discouraged! Builds on Auditing and is only available when system auditing is enabled. For job services like Actionable Services Copy or Move, Legal Hold Copy, and Single Step Collections, Data Verification generates an audit trail proving that files were not altered during these actions. This is especially valuable in ediscovery situations. Complete details are available in the Auditing and Data Verification chapter of any IS1200 User Guide A process that identifies file or object and sub-object duplicates based on their digest values (See Digest Values on page 63 for details). In the and prior versions of the IS1200 software, deduplication was only available for export actions (Actionable Services such as Download, Legal Export, and Copy). This allowed exporting only the unique files and objects from a set of search results. With IS1200 version 4.8.0, deduplication's functionality is expanded and is automatically applied during case collections and processing to allow displaying deduplicated search results. Note that when deduplication is applied to display of search results, duplicates are only suppressed from display, however duplicates are physically removed from exported file sets. Deduplication is available only in the ECS version of IS1200 and is applicable only in case context. DeDuplication view is configurable as deduplication and non-deduplication view. This allows to view whether any object has got duplicates in search results and the duplicate of the Original (in the search results). Besides the automatic deduplication of collections and processing, deduplication may also be started manually from the IS1200's case dashboard. 62

77 Glossary Deduplication reports describing how a particular job or service applied deduplication are available. The reports can be accessed from the IS1200 case dashboard as well as from web search. Reports can list all results, only unique (deduplicated) results, or percentages of unique and duplicates. Reduplication is a process that allows the duplicates of unique files to be identified so tagging processes can apply metadata tags to the unique files as well as all its copies. Legal Tags reduplication can be done after documents are added to the case. Differential Classifications Differential classifications do not re-classify all file objects in the selected repositories. Instead, they examine the metadata from previous crawls, and if there is no previous metadata (indicating the object is new since the last classification) or the metadata has changed (based on atime, or mtime changes), then the object is parsed and its metadata re-populated in the database. Note: System classification configuration settings default to using mtime to determine if files have changed for differential classifications. If atime is desired instead, see the Using atimes for Differential Crawls section of the Configuration Files and Utilities appendix of any IS1200 User Guide for details on resetting the default to atime. Additionally, atime may be applied only to selected classifications by initiating them from the Command Line Interface, see the add service deep-classification command and the crawl-atime-check-enabled option in the IS1200 Command Line Interface Reference Guide for details. Digest Values Digests are numerical values calculated based on file and content and are unique for all unique objects. Digest values allow file objects to be compared very quickly. Digests are calculated during basic and deep classifications or during collections or processing when indexing is enabled. Digests are calculated differently for standard files, s, and container objects. For standard files, a physical digest is computed for the entire file much like a hash value. For objects, just the subject, the message content (including attachments), and certain specific addresses are combined and an digest value is calculated from the combination. Container objects, like ZIP or PST files, and their sub-objects have digests calculated both as complete objects and as individual sub-objects. 63

78 Glossary Note: Calculating digests requires access to the object's fulltext and only classifications that include the fulltext rule can produce digests. s classified without the fulltext rule receive the same physical digest that other files do. Consequently, identical s on different repositories, one classified with and one without the fulltext rule, will not be identified as duplicates. Domino Sever (Lotus) Domino XML Language (DXL) DocsWithoutFullText Assignment Ruleset A Lotus server providing groupware solutions and storage. A Lotus version of extensible Markup Language (XML) used to import and export Lotus files. Some file objects, such as graphics files (examples are.jpeg,.gif, or.bmp files) contain no text, and hence will have no fulltext extracted by the FullTextRuleset, see fulltext on page 66 for more details. In legal cases, these files may still contain responsive information, but not textual information that can be located by text searches. The DocsWithoutFulltext assignment rules identifies these files and adds the metadata tag and value DocWithoutFulltext=true to all files that contain no searchable text. This allows these files to be easily searched for later, and inspected for legal responsiveness by non-search methods. The ConceptFinder_DWF assignment ruleset combines both the DocsWithoutFullText ruleset with the conceptfinder ruleset. See conceptfinder Ruleset on page 60 for more details. Note: Parent file objects that don t contain text (such as.zip,.tar, and.pst files) are not tagged with the DocWithoutFulltext tag. Documentum Sever (EMC) The EMC Documentum server manages business content including documents, photos, video, medical images, , Web pages, fixed content, XML-tagged documents, and so on. The Documentum core is a repository that stores content securely under compliance rules and appears as a unified environment, even though content may reside on multiple servers and physical storage devices within a distributed environment. E ediscovery The process of reviewing electronic files to determine their relevances and responsiveness to a legal matter or case. 64

79 Glossary ediscovery Case Manager Electronic Discovery Reference Model (EDRM) Enterprise Vault eth1, eth2 Extended Attributes Extraction Rules Exchange Server (Microsoft) Federation Federation Server Filer An IS1200 tab that facilitates ediscovery for Legal Service Providers. The EDRM was a Project created to provide standards and guidelines for the electronic discovery market. The model defines a common, flexible and extensible framework for the development, selection, evaluation and use of electronic discovery products and services. A Symantec networked repository for archived . Most IS1200 platforms require two ethernet connections for proper deployment. These connections are called eth1 and eth2, must each have unique IP addresses, and must be GigaBit, or 1GB/sec or faster, connections. Additionally, all network segments between eth1 and all registered metadata and data repositories must be gigabit eth1 is used to communicate between the IS1200 and its registered repositories. The IS1200 hostname should be DNS mapped to the eth1 IP address. eth2 must be connected to a private network between the IS1200 nodes and is used to coordinate and balance system wide operations. eth2 IP address should not be DNS mapped. User-defined keywords that are extracted during data classification. Extraction rules are a type of classification rule. They extract user-defined keywords (custom metadata) to add to the metadata file. Extraction rules are grouped into Extraction Rule Sets (ERSs). See the Policies: Classification, Extraction and Assignment Rules chapter of any IS1200 User Guide for more details. A Microsoft server designed to store and manage . F A defined group of member-clusters on a Federation server that can be managed, searched, and reported on as a group. Member-clusters are referred to as Federated clusters. A single-node IS1200 server, with a Federation license, that allows consolidated searching and reporting of up to eight Federated member-clusters of its defined Federation. A file server that exports its file systems using NFS or CIFS protocol. 65

80 Glossary fulltext fulltext is the content portion of a file, for example this is the textual content of word processing files and the message body of s. fulltext is an extraction rule that is used to save file textual content as metadata to the Search Index during classifications. It saves up to 10 megabytes of content by default. This default may be changed, but it is not recommended. Fulltext extraction is required by Review/Analysis for the Previewer pane to work and to generate Concepts in the Results Grouping pane. fulltext, is extracted differently for container objects and sub-objects, and for files with embedded objects. Container objects (such as ZIP or PST files) and their sub-objects are classified individually and the fulltext of the parent container file, and for each child sub-object, is extracted and added to the relevant metadata repository separately. Files with embedded objects (such as a Microsoft Word file with and embedded spreadsheet), are classified together. The fulltext of the embedded object is included in the fulltext of its parent object and not collected separately. For more details on fulltext, see Chapter 1 of the IS1200 Metadata Reference Guide. G Groupware Collaborative software designed to help people involved in common tasks achieve their goals. Incorporates services such as , calendaring, text chat, wiki, web-sharing, document control, and advanced search. H Hash Values Hash values are used to compare one file with another for duplicates. An extremely simplified description of hashing is that the numeric values of all bytes in a file are added into a grand total. The chances of two different files yielding the same result (hash value) are remotely small, so hash values can be used to identify duplicate files, or compare files with the same name to decide if they have been modified. 66

81 Glossary Computing hash on an entire file is called a full-hash, and computing hash on a portion of the file is called a partial-hash. A partial hash may also be used to increase classification speed and hashing can be turned on, or off to increase classification speed. I identity Identity Vault Information Center Server Intelligent Platform Management Interface (IPMI) A single entry in the Identity Vault database. The identity contains a single username and password that the IS1200 can retrieve when it needs to access a registered data or metadata repository or other server like and authentication service. An encrypted database of usernames and passwords the IS1200 uses to store the credentials used to access registered data repositories, send notifications, and work with authentication services. The standard IS1200 server offers clustering as a scalable solution for classifying, searching, and reporting on registered network repositories. While clustering is ideal for scaling to large numbers of files on a LAN, it is not a viable solution for WANs. Enterprises with multiple IS1200 clusters deployed, or IS1200 clusters deployed in remote offices need the ability to setup and manage unified reports and searches across all their clusters. The IS1200 Information Center server provides this solution. Each Federation server supports one federation. A Federation may have up to eight clusters (with four nodes each) included in it. Once a federation is established, it becomes a central management point allowing classifications, search, and reports to be setup or managed on all the federations members from the Information Center server. See the IS1200 Information Center User and Configuration Guide for complete details. IS1200 clusters may contain more than one node. Normally each node communicates with the others to share information and workload. The IS1200 appliance includes an Intelligent Platform Management Interface (IPMI) to shut down nodes when individual nodes or software errors would degrade the overall cluster performance. The IPMI is an autonomous micro-controller installed in all cluster nodes used by the cluster s leader node to power down nodes with errors or performance problems. The IPMI requires its own unique IP address, but communicates over the eth1 port, see eth1, eth2 on page 65 for more details. 67

82 Glossary K Kazeon EVAgent Kaz-mount Kazeon Query Language (KQL) KQL Reserved Words Kaz-server Kaz-share Kaz Schema An IS1200 service, installed on the Enterprise Vault server, that allows the IS1200 to directly open and access Enterprise Vault for classification services. The NFS file system that is the IS1200 metadata repository. on which the IS1200 stores metadata. A programming language used in classification and assignment rules to identify files that should receive specified metadata tags. The KQL language reserves the following words. Consequently, they are not allowed to be searched for, or used as tags or aliases. "ADD", "ALL", "ALTER", "AND", "ANY", "AS", "ASC", "AVG", "BETWEEN", "BY", "CASCADE", "CHECK", "COLUMN", "COUNT", "DESC", "DISTINCT", "ESCAPE", "EXISTS", "FROM", "FULL", "GRANT", "GROUP", "HAVING", "IN", "INTO", "IS", "JOIN", "KEY", "LEFT", "LIKE", "MAX", "MIN", "NOT", "NULL", "ON", "OR", "ORDER", "OUTER", "REVOKE", "RIGHT", "SELECT", "SET", "SUM", "UNION", "UNIQUE", "UPDATE", "VALUES", "VIEW", "WHERE" The file server where the metadata repository is located. The CIFS file system on which the IS1200 stores metadata. Defines the set of metadata fields used to build a Search Index for registered data repositories (file systems). L Legal Hold Legal Service Provider (LSP) Local localdatafs Files placed on legal hold are either copied to a secure secondary location where they can preserved for later use, or are locked in their original locations against further change until a legal matter is resolved. A lawyer or trained legal professional that provides legal services for a fee. Refers to the local resources (usually the metadata repository) of the Federation server. A data repository created on the IS1200 itself. This practice is not recommended. 68

83 Glossary localkazfs Logging rule A metadata repository created on the IS1200 itself. This practice is not recommended. Logging rules audit user actions on files such as file access, creation, modification, and deletion. M Manifest Reports Manifests are reports that summarize the results of an IS1200 job or service. Manifests are produced for Collections (from either Administration or the Case Mgmt) and for some Actionable Services. Collection Manifests summarize what files were, or were not collected during a collection. Actionable Service Manifests reconcile Actionable Services object-counts with the search result object-counts they are performed on because processes such as deduplication can result in the two counts not matching. The reports details the count of differences and the reasons for the differences. For more information, see Manifests in the IS1200 Web-Search User Guide. Note: Collection manifests are available ONLY for collections done from v4.6.0 or later, earlier versions did not generate collection manifests. Member-cluster Metadata Metadata Repository Any of the clusters registered to a particular Federation. Data about data. Metadata is used to search for information and to create reports. Metadata can be file system or custom metadata that the IS1200 extracts from files during classification. File system metadata includes file type, and file path extracted during basic classification. Custom metadata is generated during deep classification. A registered repository the IS1200 uses exclusively to record the metadata extracted during classification services on the registered data repository the metadata repository is mapped to. The primary metadata repository is the host of the repository registration database, the report results database, Environment Discovery job results, Auditing and Data Verification databases, and miscellaneous databases the cluster requires for routine operation. Collectively these are called the Cluster Data Base. Metadata repositories created on the IS1200 itself (sometimes called localkazfs) are strongly discouraged! 69

84 Glossary N Namespaces Network File System (NFS) Network Information System (NIS) Node Notes Storage File (NSF) IS1200 software, versions 4.0 and higher, organize metadata fields into hierarchy defined by namespaces. Namespaces group similar sets of tags, for example all the file level tags such as FileType, FileSize, atime, and ctime are grouped together in the System namespace. See the IS1200 Metadata Reference Guide for complete details. A protocol used primarily by Unix based computers for accessing computer systems and filers over the internet. A network naming, administration, and authentication system for smaller networks that was developed by Sun Microsystems and is used primarily by Unix systems. A single IS1200 appliance. A standardized storage file format used by Lotus to store , attachments, notes, calendars, and so on. O optional modules The standard IS1200 license provides a default set of features that allows the IS1200 to register, classify, and search and report on CIFS and NFS data repositories. Optional modules are additional software licenses that can add further capabilities, such as being able to work with repository types other than CIFS and NFS, or providing Concepts Search capabilities, or applying legal hold. Some optional modules require connectors, see connectors on page 61 for more details. For a complete list of available optional modules, see the Introduction chapter of any IS1200 User Guide. P PEA Files Policy Groups A Pool Entry Authorization (PEA) file is generated by the Centera server administrator. A PEA file defines what applications and users can perform read, write, delete, query, copy, or hold operations for Centera objects. Associates one or more authorization rule and logging rule with one or more files to protect information and audit user actions on files. 70

85 Glossary PST Files Personal STorage files are generally used by programs like Microsoft Outlook to store user locally. PST files are also called composite files, because they are packages meant to efficiently store a number of smaller related files. Another example of a composite file is a ZIP storage file R Retention Roles The process of enforcing corporate or legal standards for how long certain kinds of files must be preserved for access. Examples of retained files include files responsive to legal matters and medical records. All IS1200 users have a role, either admin, auditor, or end-user. If a legal license is installed, there may also be legaladmin, legalsupervisor, legalreviewer, or a custodian. Roles determines what parts of the IS1200 interface may be seen, and how much of search and report results are displayed. S Search Analytics Pre-Processing Search Analytics Pre-processing was introduced in release to minimize search results display time and improve the overall efficiency of ediscovery culling. Analytics Pre-processing is an integral, automatic, post-processing job performed after any job that modifies the Search Index. Analytics Pre-processing trades an increased post-job indexing period for significantly reduced search results display times after the affected jobs complete. A variety of jobs requires Search Index changes and therefore require Analytics Pre-processing. These include Collections, Classifications, Delete, and Tagging jobs. The time required by Analytics Pre-processing is determined primarily by the number of objects in the affected data repository, the number of distinct analytic (result filter grouping) attributes (such as custodians, mail senders, mail recipients, sender domains, recipient domains and so on.), and the read/write performance of the metadata repository associated with the data repository. Additionally, once any Analytics Pre-processing job is launched, all subsequent Analytics Pre-processing jobs (that might be required by other concurrent jobs-in-progress) wait for the current Analytic Pre-processing job to finish. However, before beginning any Analytics Pre-processing job for a particular data repository, the IS1200 checks 71

86 Glossary all other jobs-in-progress for that repository to see if they might also require Analytics Pre-processing. If other jobs are found, the IS1200 waits for all these jobs to finish in order to launch a single Analytics Pre-processing job for all the jobs that affected the Search Index for that data repository. Therefore, there are two best practices suggested for scheduling jobs that affect the Search Index: Schedule large classifications or collections such that both they, and the Analytics Pre-Processing they require, can both fully complete before starting any other job. This allows the IS1200 to most efficiently schedule the required processing resources. Large jobs are those that affect data repositories with tens of thousands of objects or terabytes of data. Schedule small jobs (such as incremental collections, or post-search tagging operations) to run concurrently so the IS1200 can identify their common Analytics Pre-processing requirements and group them into a single job. Note: IS1200 s that are upgraded to v4.5.0 may need some additional configuration to make the most efficient use of Analytics Pre-Processing. See the Configuring the IS1200 To Use Proactive Indexing section of the Configuration Files and Utilities appendix of any IS1200 User Guide for complete details. Search Index SharePoint Sever (Microsoft) snippets An IS1200 database that stores and indexes the file content metadata (including extended attributes, and fulltext) for standard and custom user-defined metadata produced by extraction rules during classifications. A Microsoft server in the groupware category. A snippet is a sub-set of a document s actual content. Snippets are only displayed if they are enabled in Review/Analysis Preferences, and only in Paragraph View immediately under the first line of the result listing. After a keyword search completes, result snippets are created as small standard size chunks of data taken from the text surrounding a search query hit. For example, if a search is made for medicine, the snippet will contain about 300 bytes of the text surrounding the paragraph where the word medicine was found. If multiple search 72

87 Glossary hits are found, the most relevant hit is used to create the snippet. For searches made without keywords, snippets are simply the first 300 bytes of file text. Snippet size is configurable, see the Configuration Files and Utilities appendix of any IS1200 User Guide for details on setting snippet size. In all cases, snippets are taken from the result file s fulltext. SourceOne Archive Server (EMC) Special Characters The EMC SourceOne server is a comprehensive, policy-based system that automatically collects, organizes, indexes and retains messages and associated attachments and stores them in designated archives connected to shared storage. EMC SourceOne provides indexed searching that works with both EMC storage and other brands such as IBM or NetApp. The IS1200 supports alphanumeric ASCII and UTF-8 characters. Non-alphanumeric ASCII characters are defined as Special Characters and include the following: - _ \ # $ % ^ & * + = { } [ ] ( ) < > : ;,.? ~ ` Special characters are not universally supported in the IS1200 interfaces. The following limitations must be noted: Search Queries and Special Character, Special characters pose a searching challenge. Because the IS1200 tokenization removes special characters from indexed text as it is classified, special characters are never entered into the IS1200 metadata indexes. Consequently, special characters may not be directly searched for. For more details see Tokenisation and Stemming in the IS1200 Web-Search User Guide. While special characters may not be directly searched for, the text they are included in can be searched. For example, the string "-ACME-" is tokenized on the hyphens and recorded in the metadata only as "ACME". Consequently, searching for the string with the hyphens (-) will NOT work. However, you can search for?acme? (using the question mark wildcard) which gives the result and so on. See the IS1200 Web-Search User Guide for more details on wildcards. Note: The question mark character (? ) may not be searched for in filepaths, even when escaped. This exception is limited to filepath searches only. 73

88 Glossary AD login names and NIS login names support only alphanumeric ASCII and UTF-8 characters, they do NOT support following special characters: ' " - _ \ # $ % ^ & * + = { } [ ] ( ) < > : ;,.? ~ ` However, in Active Directory (AD), registered users may have both an AD login name and a display name. For example, John Smith may have the AD login name jsmith and the display name John Smith. When new legal supervisors or reviewers are created in the Case Mgmt using the AD lookup button, they take the display name, not the login name, and the display name may contain special characters as described below. Legal Supervisor Names and Legal Reviewer Names only, support: ' - # $ % ^ & * + = { } [ ] ( ) : ;,.? ~ ` do NOT support: " \ / < > Custodian Names only, support: ' " - # % ^ & * + = { } [ ] ( ) : ;,.? ~ ` do NOT support: \ / < > $ Case Names, Legal Export Profile Names, Repository Names, Rule Names, and Policy Names only, support: _ (underscore) do NOT support: " - \ # $ % ^ & * + = { } [ ] ( ) < > : ;,.? ~ ` IDs which are used in Legal Hold notification and Acknowledgements, Search filters, Collection filters and so on, support: ' - _! # $ % ^ & { } : ;,.? ~ ` do NOT support: " \ * + = [ ] ( ) < > Mail Domain Names DO NOT support any special characters. File names/ Directory names in source and destination file names only, support: ' - ^ + = { } [ ] ( ) < > ;,. ~ do NOT support: " \ / # $ % & * :? ` Tag Names only, support: _ (underscore) do NOT support: ' " - \ # $ % ^ & * + = { } [ ] ( ) < > : ;,.? ~ ` 74

89 Glossary Tag Values only, support: ' - _ \ # $ % ^ & * + = { } [ ] ( ) < > : ;,.? ~ ` do NOT support: " (double quote) Rules definitions, special characters must be escaped before they may be used in rule definitions. To escape a character use a \ before the character. Search technology uses reserved words, stop words, special characters, tokenizers, and so on. These are common to almost ALL search technologies and not just a Kazeon search engine manifestation. One major reason for such implementation is that if all the characters and the words are indexed regardless of any semantics, your search index has a potential to increase beyond any manageable size since the occurrence of said categories of tokens is so common. Besides, there is not much value in indexing stop words (as, the, or, and so on.) and tokenizers (@,. - and so on.). The omission of such characters from your search query is just a part of the optimization. For example, when you search for (1+1):2, the characters (, +, ), and : have special meaning in search - the parentheses are used to specify grouping, the plus is used to specify inclusive terms in a query, and the colon is using to separate tag from value as in "filepath:*". In order to use these in your query, you need to escape them with a backslash, as follows: \(1\+1\)\:2 However, the escaping does not mean the characters are now a part of your query. It only means that those characters are not interpreted by search with special semantics. This query is preprocessed to drop those characters from the final query which appears as follows when it is actually executed by the search engine: fulltext:"1 1 2" This means that we are searching for a 1 followed by a 1 which is again followed by a 2 such that there are no other valid indexable search tokens between the three numbers. The results may match :1: and so on. However, they will not match 75

90 Glossary 1:3:1: :2 and so on. Hence to search for (1+1):2, use the following query: \(1\+1\)\:2 stop words Stop words consist of the most commonly used words in sentences, such as a, an, the, and and. If indexed individually, they would consume excessive amount of metadata storage space, and consequently are not individually indexed. If stop words are used in a search query, they are ignored unless they are parts of quoted phrases. The table below lists all stop words: Table 3Stop Words a an and are as at be but by for if in into is it not of on or such that the their then there these they this to was will with Stemming stubs Stemming is a search technique designed to increase search efficiency and broaden relevant search hits. When stemming is used, fulltext indexing first attempts to identify each word s stem, and then indexes words by their stems. For example, the words connected, connecting, and connectable all share the same stem and are indexed under connect. Search query criteria are automatically stemmed, and so querying connected returns all instances where connect, connected, and connecting are used. Nouns like connector are not stemmed. Stemming is ON by default but may be disabled. Stubs are created by many file archiving applications, most notably archiving systems. When stubbing is used, and a file object is moved to archival storage, a stub is left behind on the original file system that points to the archived file s new location. Thereafter, if a user attempts to open the archived file from the original filer, the stub allows that filer to retrieve the archived file and return it to the user transparently (as if it were still on the original filer). 76

91 Glossary Stubs may be searched for using the metadata field mailmessageclass. For example, use the search query mailmessageclass:ipm.note.exshortcut to find message stubs. sub-objects A file found inside a container object, see Container file/object on page 61 for more details. A container file is often called the parent and the contained sub-objects are called children. Sub-objects should not be confused with embedded files such as OLE objects, for example spreadsheets or graphics embedded in a Microsoft Word file. Note however, an message may be a container object, if it contains attachments, or a simple non-container object but still have a graphic embedded in its body. T Tags Tokenization The names of metadata fields. Tags are always associated with a value. For example, the metadata tag filename for any given file is always followed by a value (a text string) containing the actual filename. Tokenization is an IS1200 classification procedure that breaks word strings into tokens for better search results. During classifications, Numbers, AlphaNums, HostNames and Addresses (in fulltext) are tokenized similar to alpha only strings. With tokenization, the stings [email protected], and 11,22,333,44 are tokenized into separate words yielding; www, kazeon, and com ; fred, kazeon, and com ; and 11, 22, 333, and 444. This allows searching for kazeon and getting all addresses that contain the domain name, while. U UTF-8 Unicode Transformation Format - 8, is an 8-bit coding scheme for digitally representing both the standard western alphabet (Aa-Zz) and its punctuation characters, and non-western word characters such as the glyhps found in the Chinese, Japanese, and Korean languages. UTF-8 encodes all its characters as 8-bit bytes (or octets). The first 128 UTF-8 characters are identical to the first 128 ASCII characters and require only one byte each. Non-western languages are coded using one to four octets each. UTF-8 can encode all of the 1,112,064 code points in the Unicode character set that covers the majority of languages in use around the world. 77

92 Glossary W Web-Admin Web-Reports Web-Search An IS1200 web application used by IT personnel to administer the server itself, and when the IS1200 is used to help administer other IT resources. Administration is the preferred interface for administering the server. An IS1200 web application that provides advanced reporting capabilities based on IS1200 metadata. An IS1200 web application that provides basic, advanced, and specialized searches against IS1200 metadata. X XML extensible Markup Language A file type that uses the XML language to define and describe data that can be transferred between applications like databases and spreadsheets. 78

93 Index A Access Control List (ACL) 57 Actionable Services 57 Actions 57 Active Directory (AD) 57 Advanced Search 58 AppxHeading2 2 Assignment Rule 58 Auditing 58 Authentication 58 Authorization Rule 58 B Basic Authentication 15 Basic Search 58 C CAS 60 CAS Device 58 Case Manager 65 CASID 58 Celerra Server 59 Centera Server 59 checkpointing 59 Classification Rules 59 Classification Service 59 CLI Command Line Interface 60 Cluster 60 conceptfinder Ruleset 60 Concepts Search 60 connectors 61 Container 61 Content Addressable Storage 60 CSV Comma Separated Values 60 Custodian 61 custodian mapping 33 D data 61 Data Repository 62 Data Server 61 Data Verification 62 Datamap 61 Data-Mount 61 Data-Share 62 Deduplication 62 Differential Classifications 63 DocsWithoutFullText 64 Documentum Sever 64 Domino Sever 64 Domino XML Language 64 DXL 64 E ediscovery 64 ediscovery Case Manager 65 Electronic Discovery Reference Model 65 EMC Celerra Server 59 Centera Server 59 Documentum Server 64 SourceOne Archive Server 73 Enterprise Vault 65 eth1 65 eth2 65 IS1200 EMC SourceOne Archive Connector User and Configuration Guide v

94 Index EVAgent 68 Exchange Server 65 Extended Attributes 65 Extraction Rule 65 F Federation 65 Federation Server 65 Filer 65 Filter Method 53 full-text 66 G groups policy 70 Groupware 66 GUIs ediscovery Case Manager 65 Web-Admin 78 Web-Reports 78 Web-Search 78 H Hash Values 66 I identity 67 Identity Vault 67 index inconsistency 50 Intelligent Platform Management Interface 67 IPMI 67 IS1200 Information Centers 2 J job types 35 K Kaz Schema 68 Kazeon EVAgent 68 Kazeon Query Language 68 Kaz-mount 68 Kaz-server 68 Kaz-share 68 L Legal Hold 68 Legal Service Provider (LSP) 68 license key 17 Local 68 localdatafs 68 localkazfs 69 Logging rule 69 Lotus Domino 64 M Manifest Reports 69 Member-cluster 69 Metadata 69 Metadata Repository 69 Microsoft Active Directory 57 Exchange Server 65 SharePoint 72 N Network File System (NFS) 70 Network Information System (NIS) 70 Node 70 non-sourceone search 53 Notes Storage File 70 NSF 70 O optional modules 70 P PEA Files 70 Policy Group 70 PST 71 R reports manifest 69 Web-Reports 78 Retention 71 Roles 71 rules 80 IS1200 EMC SourceOne Archive Connector User and Configuration Guide v4.8.0

95 Index classification 59 extraction 65 logging 69 S Search advanced 58 Basic 58 Web-Search 78 Search Index 72 selection scope 36 SharePoint Sever 72 Single Sign On 46 snippets 72 SourceOne Archive Server 73 Stemming 76 stop words 76 sub-objects 77 Symantec Enterprise Vault 65 T Tags 77 Tokenization 77 U user-level access checks 35 W Web Service Deadlock 9 Web-Admin 78 Web-Reports 78 Web-Search 78 X XML extensible Markup Language 78 IS1200 EMC SourceOne Archive Connector User and Configuration Guide v

96 Index 82 IS1200 EMC SourceOne Archive Connector User and Configuration Guide v4.8.0