Message Archiving Admin Guide

Message Archiving Admin Guide Spam Soap, Inc. 3193 Red Hill Avenue Costa Mesa, CA 92626 United States p.866.spam.out f.949.203.6425 e. info@spamsoap.com www.spamsoap.com

RESTRICTION ON USE, PUBLICATION, OR DISCLOSURE OF PROPRIETARY INFORMATION. Copyright 2009, Inc. This document contains information that is proprietary and confidential to. No part of this document may be reproduced, stored in a retrieval system, or transmitted, in any form or by any means (electronic, mechanical, photocopying, recording, or otherwise) without prior written permission from. All copies of this document are the sole property of and must be returned promptly upon request., Inc. USA Direct +1 Toll Free +1 Fax +1 Web site: www..com Documentation Feedback:.com March 2009 Proprietary: Not for use or disclosure outside without written permission 2

Contents 1 Overview................................................. 1 What is Message Archiving?.....................................................1 Benefits.....................................................................1 Alternative Data Storage.....................................................1 Other Useful Benefits.......................................................1 Compliance...............................................................2 Legal....................................................................2 Business Continuity.........................................................2 Features....................................................................2 Supported Platforms...........................................................3 Standalone Message Archiving...................................................4 Integrated with Other Services................................................5 Supported Browsers for Administration.............................................6 Supported Attachment Formats...................................................7 Handling Spam and Viruses.....................................................7 Message Security.............................................................7 Associating Messages with Users.................................................7 How Message Archiving Archives Messages from Your Server..........................8 How Often Messages Are Archived.............................................8 How Many Messages Are Archived Per Session..................................8 How a Quiet Period Affects Message Archiving...................................8 Additional Considerations for Your Network and Mail Server.........................9 Distributing the Message Archiving User Guide......................................9 2 Configuring Message Archiving............................. 10 Documents Necessary to Set up Message Archiving.................................10 Use Online Help.............................................................11 Word Search of Online Help.................................................11 Log into the Spam Soap Console................................................11 Configure Mail Sources........................................................12 The Overview Screen.........................................................18 Archive Historical Messages....................................................21 Archive Historical Messages in Different Formats.................................23 Monitor Historical Message Archiving..........................................24 3 Searching Archived Messages.............................. 25 March 2009 Proprietary: Not for use or disclosure outside without written permission iii

Who Can Search for What......................................................25 Begin a New Search..........................................................25 Perform Simple Searches......................................................26 How Simple Search works...................................................28 Perform Advanced Searches....................................................31 Search with the Archive ID.....................................................36 Review Search Results........................................................37 Sort the Search Results.....................................................39 View Messages from the Search Results.......................................39 Export Messages You Find..................................................42 Save a Search...............................................................46 Run a Saved Search..........................................................46 4 Troubleshooting.......................................... 48 Connectivity Errors...........................................................49 Common Error Messages......................................................51 Issues with Exchange Server Journal Mailbox......................................53 5 Upgrading or Replacing Your Server......................... 54 March 2009 Proprietary: Not for use or disclosure outside without written permission iv

What is Message Archiving? 1. Overview What is Message Archiving? Message Archiving automatically archives your email to a secure centralized location and provides search functionality to quickly locate messages using s intuitive Parallel Search interface. Message Archiving is designed to be able to meet a broad range of needs including: Storage management ediscovery readiness and execution Regulatory compliance Accelerated message recovery Benefits Alternative Data Storage Message Archiving can be a valuable supplement to existing point-in-time backups since it can be used to restore individual messages much faster than a tape backup. It is recommended that you retain your existing backups for server disaster recovery. Other Useful Benefits Reduce the Storage Burden on Your Mail Server Historical data (pre-existing messages) can be imported into Message Archiving. Once this is done, any messages that have been archived can be safely removed from the server to free up space and improve performance. Desktop PST files can also be imported, securing customer data in a central repository. Platform Independence Message Archiving is independent of your email platform, allowing you to upgrade your email server to a new version or change your backup software without affecting the data in the archive. March 2009 Proprietary: Not for use or disclosure outside without written permission 1

Features Managed service Message Archiving is a managed service, which means you do not need to purchase hardware and you have no maintenance responsibilities for the service. Compliance Governmental agencies such as the U.S. Securities and Exchange Commission (SEC) and other regulatory entities have established strict requirements for electronic document retention, accessibility, and security. To be in compliance, affected organizations must establish compliant email archiving systems capable of retaining data for a specific time period, guaranteeing that requested materials can be located in a timely manner. Legal Organizations must be able to preserve, identify, and produce messages relevant to a legal proceeding when ordered to do so by the courts or when compelled by law. One of the most important steps in any law suit is the process of locating evidence in support of one s legal claims. This process is called discovery. When discovery involves electronic information, the process is referred to as ediscovery, or electronic discovery. Message Archiving assures that evidentiary-quality records are systematically stored in a centralized tamper-proof repository. Failing to comply with an ediscovery order can result in harsh court sanctions (punishment for non-compliance imposed by a judge). Business Continuity Organizations require secure long-term storage of email communications, which have become key business assets. Research indicates that the number one threat to business continuity is hardware failure. Organizations can mitigate this threat by using Message Archiving, which is a reliable managed service. When coupled with the Message Continuity service, end users benefit from having access to both spooled messages and archived messages from their Spam Soap Console. Features Message Archiving offers the following features: Automatically stores all email messages for the retention length specified in your service agreement. Stores a pristine copy of the entire original message, including all formatting, headers, metadata, and attachments. Imports messages from up to 64 separate mail sources. Conducts multiple searches at once using s Parallel Search Interface. Supports Simple, Advanced, and Archive ID search modes. Prevents tampering with read-only storage. March 2009 Proprietary: Not for use or disclosure outside without written permission 2

Supported Platforms Reveals potential gaps in the archive by serializing entries. Stores data on high performance online systems at all times and is never rolled to offline or nearline storage mechanisms. Duplicates all messages and indexes across two geographically-dispersed data centers. Retrieves messages based on a robust set of custom search criteria including selectable Any / All logic. Searchable criteria includes: To Recipient Date range Header content Subject content Message body content Attachment content Attachment name Attachment content Message size Hosts historical email alongside journaled messages. This capability requires the historical data hosting option to be selected in your Service Agreement. Historical messages are stored indefinitely, but are restricted by the total disk storage selected in your Service Agreement. Supports transport encryption. You are responsible for purchasing, installing, and maintaining any necessary certificates to support secure connections from Message Archiving. Stores data with 256-bit encryption. Exports duplicates of stored messages directly to your computer, up to 150 MB at a time. Fully indexes message content, metadata, and the contents of over 300 common business attachment types for fast searching. Stores individual messages with a size of up to 25 MB. Supported Platforms Email Server Edition Additional Requirements Microsoft Exchange Server 2000 Microsoft Exchange Server 2003 Standard Enterprise Standard Enterprise Service Pack 3 or higher Email Journaling Advanced Configuration tool (exejcfg.exe) Service Pack 1 or higher Email Journaling Advanced Configuration tool (exejcfg.exe) March 2009 Proprietary: Not for use or disclosure outside without written permission 3

Standalone Message Archiving Microsoft Small Business Server with Exchange Server 2003 Standard Service Pack 1 or higher Email Journaling Advanced Configuration tool (exejcfg.exe) Microsoft Exchange Server 2007 Standard Enterprise Journaling agents configured on the appropriate Hub Transport servers For premium journaling, the Exchange Enterprise Client Access License (CAL). For all servers, the journal mailbox of the MS Exchange Server must be configured to support Message Archiving. See one of the following documents for detailed instructions on configuring your mail server: Message Archiving Quick Setup Guide for Microsoft Exchange Server 2000 Message Archiving Quick Setup Guide for Microsoft Exchange Server 2003 Message Archiving Quick Setup Guide for Microsoft Exchange Server 2007 Standalone Message Archiving Message Archiving is available with or without other services. All customers must use an effective anti-virus, anti-spam (AVAS) solution to prevent junk or malicious email from being archived. The recommended AVAS solution is which offers industry leading accuracy and usability. See Figure 2. March 2009 Proprietary: Not for use or disclosure outside without written permission 4

Standalone Message Archiving Figure 2: Message Archiving Solution Integrated with Other Services If you have more than one service, you will find that all your services are integrated into the. See Figure 3. March 2009 Proprietary: Not for use or disclosure outside without written permission 5

Supported Browsers for Administration Figure 3: Message Archiving and Email Defense Solutions Supported Browsers for Administration Message Archiving supports the following browsers. Internet Explorer 7.x on Vista Internet Explorer 7.x on XP Internet Explorer 6.x on XP Firefox 3.x on Vista Firefox 3.x on XP Firefox 3.x on OS X 10.5 Firefox 3.x on OS X 10.4 Firefox 2.x on Vista Firefox 2.x on XP Firefox 2.x on OS X 10.5 March 2009 Proprietary: Not for use or disclosure outside without written permission 6

Supported Attachment Formats Firefox 2.x on OS X 10.4 Supported Attachment Formats Over 300 different file attachment formats can be archived and searched based on content. Most common business file formats, such as.doc,.html,.ppt,.txt,.xls, are supported. All attachment names are searchable. Handling Spam and Viruses Message Archiving stores all email messages present in your Exchange Server journal mailbox(es). Therefore, if junk or infected email messages are able to enter the Exchange Server, those same messages will enter the archive. Warning: Although it is unlikely, exporting email messages or downloading attachments from Message Archiving could expose users to infected content. Message Security A message stored by Message Archiving can be viewed only by the following: The end-user who sent or received the message The Customer Administrator Associating Messages with Users As soon as a message is archived from the journal mailbox, Message Archiving immediately attempts to associate the message s participants to users in the Console. This association is required for end users to be able to see their own messages when they log on to their personal Spam Soap Console. Customer administrators can see all messages regardless if they are associated or unassociated with an end user. For troubleshooting purposes, a tally of unassociated messages is kept in the Message Archive Summary window on the Overview tab. Additional notes: Deleting a user account will result in the permanent disassociation of the user to his or her messages. Recreating the account will not re-associate the user to the orphaned messages. March 2009 Proprietary: Not for use or disclosure outside without written permission 7

How Message Archiving Archives Mes- At this time, there is no way to re-establish or retroactively establish user/message associations. Avoid deleting user accounts and ensure that all users are defined in the Spam Soap Console prior to activating a mail source. Any message archived before a corresponding user account is created will not be associated to the user. How Message Archiving Archives Messages from Your Server How Often Messages Are Archived Message Archiving connects periodically to your mail server s journal mailbox and archives messages in small batches. The time between archive sessions varies from every few minutes to several times an hour. Archive sessions can last seconds or in some instances, over an hour, depending on: The number of messages in the journal mailbox Average message size The rate at which messages can be archived The last item is the previous list, the rate at which messages are archived, is generally determined by your server and network performance. How Many Messages Are Archived Per Session During each archiving session, Message Archiving attempts to archive a predetermined number of messages from the journal mailbox. This number may be less than the actual number of messages ready to be archived. Therefore, it is normal for your journal mailbox to always have a few dozen or even a few hundred messages queued up for archive, depending on your mail volume. Note: Messages journaled by your server after an archive session has started are not processed until a future archive session. How a Quiet Period Affects Message Archiving For each mail source, you can configure a quiet period, which is a block of time in which Message Archiving does not archive email. A quiet period can conserve your network resources for non-archiving activity during busy times. However, use of a quiet period should be minimized so that Message Archiving has enough time to archive all available messages. To avoid large journal queues, systems with heavy email volume or mail server resource constraints should not utilize a quiet period. March 2009 Proprietary: Not for use or disclosure outside without written permission 8

Distributing the Message Archiving User Note: During a quiet period, it is normal for thousands of messages to queue up in your journal mailbox. These messages are not archived until after the quiet period ends. Depending on how many messages have queued up in your journal mailbox, it could take hours for Message Archiving to finish archiving your messages. Additional Considerations for Your Network and Mail Server For the most effective use of Message Archiving, consider the following factors in Message Archiving performance and how they might affect the configuration of your mail servers and network. Message Archiving requires the use of journaling on Exchange Servers. Journaling typically adds approximately 10-15% load to an Exchange server. The exact impact of journaling will vary based on system performance and message volume. When Message Archiving archives messages residing in your server s journal mailbox, significant amounts of upstream bandwidth are required. As a result, we recommend a minimum of 512 kbit/sec of available upstream bandwidth for Message Archiving. However, considerably more bandwidth may be required for the timely archiving of messages, depending on your message volume. Message Archiving archives messages as quickly as it can, based on the limitations of your server(s) and network. In some cases, your message volume may exceed available bandwidth on your data circuit, or there could be a bottleneck somewhere in between your network and Message Archiving. To minimize the impact of large messages on the archive process, Message Archiving may prioritize archiving smaller messages during high volume hours (for example, during work hours) and large messages over lower usage hours (for example, nighttime). Distributing the Message Archiving User Guide Chapter 3 of this document, Searching Archived Messages, describes how to search and view archived messages using the capabilities available to the Customer Administrator. For all other users and roles, the Message Archiving User Guide describes how to search and view archived messages. Send this document to your users prior to implementing Message Archiving at your company. March 2009 Proprietary: Not for use or disclosure outside without written permission 9

Documents Necessary to Set up Message 2. Configuring Message Archiving Documents Necessary to Set up Message Archiving This document is one of the documents used by Customer Administrators to set up Message Archiving. To setup Message Archiving, the Customer Administrator should use the following documents in the order listed: Document 1 Message Archiving Service Activation Guide 2 Message Archiving Account Management Purpose This document is a checklist for tasks required to set up Message Archiving, as well a source of customer-specific access and connectivity information. Access this document first to help guide you through the setup. This document describes tasks that the Customer Administrator should perform within the Account Management portion of the Spam Soap Console to support Message Archiving. Note: Because Account Management is also used to manage Email Defense Service and Web Defense Service, the tasks described in this document might be performed to support these other services as well as Message Archiving. Perform the tasks in this document before using the Message Archiving Administrator Guide. 3 One of the following: These documents describe tasks the Customer Administrator or the mail server administrator must perform so that the mail server can allow Message Archiving to access and retrieve messages for archiving. Message Archiving Quick Setup Guide for Microsoft Exchange Server 2000 Message Archiving Quick Setup Guide for Microsoft Exchange Server 2003 Message Archiving Quick Setup Guide for Microsoft Exchange Server 2007 Note: These documents assume that the mail servers have already been administered and are able to process email on behalf of the customer s users. 4 Message Archiving Administrator Guide This document describes the tasks that the Customer Administrator should perform within the Message Archiving portion of the Spam Soap Console. Tasks include completing the setup of Message Archiving and using Message Archiving to search for and view archived messages. March 2009 Proprietary: Not for use or disclosure outside without written permission 10

Use Online Help In addition, this document describes how to search and view messages using the capabilities available to a Customer Administrator. See Chapter 3., Searching Archived Messages. Warning:You must add your users on the Spam Soap Console before you set up Message Archiving and the journaling feature of the Exchange Server. If you configure and enable Message Archiving before adding users to the Spam Soap Console, all messages to your users will be searchable and viewable only by the customer administrator. See Associating Messages with Users. Use Online Help Use online help in the Spam Soap Console to find details on the Message Archiving screens, as well as Core Filtering and Web Defense Service (WDS), if enabled. Online help describes the purpose of screens, the fields on the screens, and procedures that use the screens. To open online help, click Help on the screen you are using. The Help screen opens to the topics related to the task you are performing. When the Help screen is open within the Message Archiving application only, you can use the table of contents to find other topics. Word Search of Online Help When the Help screen is open and is the active window on the screen, you can also press Ctrl + F to perform word searches within online help Log into the Spam Soap Console To administer Message Archiving, you must log into the Spam Soap Console with the following steps: 1 Open a browser on your computer and for the Spam Soap Console. March 2009 Proprietary: Not for use or disclosure outside without written permission 11

Configure Mail Sources 2 At the Spam Soap Console Login screen, enter your email address and password. The email address and password you should use are identified in the Service Activation Guide you received from your provisioner. If you don t have the password or you don t know which email address you should enter, contact your sales representative or Customer Support. 3 Click Login. Note: If you stay logged in during a long period of inactivity, your session with Message Archiving might expire. When your session expires, you simply need to log back in. Configure Mail Sources Note: To perform this procedure, you must be logged in with a Customer Administrator or higher level login. A mail source is simply a journal mailbox on your email server(s). You may have more than one journal mailbox on a single server. You must tell Message Archiving how to connect to your journal mailbox(es) by adding mail source entries to the Mail Sources screen. Note: The journal mailbox or mailboxes should already be configured on your mail server. For information on configuring Exchange Servers, see the appropriate Quick Setup Guide. March 2009 Proprietary: Not for use or disclosure outside without written permission 12

Configure Mail Sources Caution: The queue of messages in your journal mailbox can grow to be quite large, depending on various factors. In addition, messages might be archived and removed from your journal mailbox at varying times and rates of speed, also depending on various factors. For more information, see How Message Archiving Archives Messages from Your Server on page 8. To configure a mail source within Message Archiving using the following steps. 1 Click Message Archiving > Mail Sources. A blank Mail Sources screen is displayed. If any mail servers have already been added, those mail servers are displayed. Note: The Status column on the Mail Sources screen shows a colored icon to show status. The icons indicate the following: Green The mail server is connected and active. Caution: At any given moment, though the mail server might be connected and active, messages might still reside in the mail server s journal mailbox waiting to be archived. Messages may be waiting because Message Archiving archives messages based on periodic polling, not necessarily immediately after a message is journaled. Additionally, various other factors may affect the speed at which messages are archived. See How Message Archiving Archives Messages from Your Server on page 8. Blank The server has been configured but is not active. Red The server is in one of the following states: The server is active but Message Archiving cannot connect to it. The server is active and connected, but Message Archiving cannot archive messages from that server. To verify what the red status icon means, run the Test Connectivity button on the Mail Sources configuration screen. If the test is successful, Message Archiving is connected to the mail server, but Message Archiving cannot archive messages. If you receive an error, check Connectivity Errors. March 2009 Proprietary: Not for use or disclosure outside without written permission 13

Configure Mail Sources 2 Click New to access the New Mail Source screen. Note: If you want to view or change the configuration of an existing mail source, doubleclick that mail source or select the mail source and click Edit. The New Mail Source screen is displayed. March 2009 Proprietary: Not for use or disclosure outside without written permission 14

Configure Mail Sources 3 Complete the following fields: Platform Select the mail server type that you are using. In this example, select MS Exchange 2003. If you are creating an historical mail source, in most cases you select Generic as the platform. However, if you are archiving historical messages that had previously been journaled, you must select the same platform in which the messages were journaled. For example, if the messages had been journaled on an Exchange 2000, your platform must also be Exchange 2000. Caution: Do not guess on the mail server type for the Platform field. An incorrect setting will result in a failure to store and retrieve messages. Server Name Type an IP address or the fully-qualified host name of the mail server. This name should be registered within a DNS server and available from outside of the company network. In this example, you type denver.acme.com. Protocol Select the protocol, POP3 or IMAP, that your mail server supports. Message Archiving must use this protocol for the connection. In our example, select POP3. Connection Security Select the encryption option the customer s mail server supports. This encryption is applied to the communications between Message Archiving and the mail source: Security Option None Description No encryption (not recommended). All mail will be transferred in clear text and no attempt will be made to encrypt the data. March 2009 Proprietary: Not for use or disclosure outside without written permission 15

Configure Mail Sources Security Option Require SSL Require TLS Use TLS if available Description Secure Sockets Layer (SSL) encryption is used. If SSL is not enabled on the mail server, the connection fails. The default SSL TCP port for the protocol you selected is automatically applied in the Port field. Use this setting if your server supports Secure POP or Secure IMAP and if you never want mail transferred without encryption. Transport Layer Security (TLS) encryption is used. TLS security is initiated within a normal POP3 or IMAP session using the standard TCP port. If TLS is not actually enabled on the mail server, the connection fails and no email is transferred. Use this setting if your server supports TLS and if you never want mail transferred without encryption. TLS encryption is used if the customer has enabled it on the mail server. If TLS is not enabled, no encryption occurs, and email will be transferred in clear text. Use this setting if you prefer encryption but don t want a lack of encryption to prevent mail from being archived. In our example, select Use TLS if available. Port Type a TCP port number on the mail server where the selected protocol and encryption can be used for the connection to Message Archiving. The POP3 default for TLS is port 110. The POP3 default for SSL is port 995. For IMAP, the default ports are 993 for SSL and 143 for non-ssl. You can enter a different port number if a different port number has been administered on the mail server. In our example, leave the default 110. Mailbox Type the user name that Message Archiving uses to log into the journal mailbox. The journal mailbox, and its user name, are administered on the mail server. In our example, type acmejournalmailbox. Historical Select this checkbox only if the mail source you are configuring will contain only historical messages. The Historical Mail Source capability has the following limitations: This field is displayed only if your service is provisioned for historical message archiving and an historical mail source has not yet been configured. If you have multiple mail sources, you can define only one of them as an historical mail source. The Historical checkbox is not displayed on the Mail Source screen for non-historical mail sources. Your historical mail source is deactivated when you reach your historical archive storage limit. If you later have additional archive storage provisioned, you can return to your historical mail source screen and activate the mail source again. If you need to archive historical messages from different mail sources (for example, from separate historical mailboxes on an Exchange Server 2000, an Exchange Server 2003, and an Exchange Server 2007), you must create an historical mail source for one historical mailbox, archive messages from that mail mailbox, then delete the configured mail source from Message Archiving. Next, create a new historical mail source in Message Archiving for the next historical mailbox, archive the messages, and so on. March 2009 Proprietary: Not for use or disclosure outside without written permission 16

Configure Mail Sources See Archive Historical Messages for more information. Password Type the password that corresponds to the mailbox user name. This password should match the one defined for the journal mailbox on the mail server. Note: The Password field is replaced by a Change Password checkbox after you have added the mail source. Enable Quiet Period Select this option if the customer wants to prevent Message Archiving from archiving messages during a specific window of time during the day. The period of time must be at least 30 minutes and no more than 16 hours. Caution: Use of a quiet period should be minimized so that Message Archiving has enough time to archive all available messages. To avoid large journal queues, systems with heavy email volume or mail server resource constraints should not utilize a quiet period. Additional fields appear on the screen if you select Enable Quiet Period. Complete these fields as follows: i From the Server Timezone drop-down list, select the time zone of the mail server. In our example, select America/Denver. ii From the Start Time drop-down list, select the time, in military time, at which Message Archiving should stop retrieving messages each day. The start time must be earlier in the day than the stop time. iii From the Stop Time drop-down list, select the time, in military time, at which Message Archiving should resume retrieving messages each day. The stop time must be later in the day than the start time. Active Select this checkbox only when you have finished configuring the mail source on this screen and the mail source itself is configured and ready for messages to be archived. Leave the checkbox empty if you do not yet want messages to be archived from this mail server. Note: Message Archiving automatically deactivates your historical mail source when your historical storage limit is exceeded. 4 If you selected Active for this server, click Test Connectivity to ensure that Message Archiving can communicate with the mail server. If you receive an error, see Connectivity Errors. If the communication to Message Archiving is successful, a confirmation message is displayed. Note: If your network or mail server is slow and a connection can t be verified within 30 seconds, the test connectivity request will time out. If the test fails, double check the settings and try again. 5 Click Save to save your configuration. A server configuration can be saved even though it is inactive. An active server cannot be saved unless you have tested the connectivity. Note: If you configured the mail source as an historical mail source, [Historical] is displayed after the mail source name in the list of mail sources. March 2009 Proprietary: Not for use or disclosure outside without written permission 17

The Overview Screen The Overview Screen Note: Only a Customer Administrator can access the Overview screen. Once your Message Archiving service is active, access the Message Archiving Overview screen to see the following: Current communication status between your mail sources (mail servers) and Message Archiving. A summary of your key Message Archiving configurations and activity. News about message archiving. To view the Overview screen, just click Message Archiving. The first screen you see is always the Overview. Note: You can always return to the Overview screen by clicking the Overview tab. The Overview screen displays the following information: March 2009 Proprietary: Not for use or disclosure outside without written permission 18

The Overview Screen Section Mail Source Activity Description The status of Message Archiving connections to your mail servers. The section also includes: Configuration parameters for each connection, as defined in the Mail Sources screen. The time, in 24-hour clock time, of the last attempt to connect to each mail server in order to archive messages. The time, in 24-hour clock time, of the last successful connection to each mail server. If the last two items are not the same time for any mail source, there may be a problem with your network, your mail server, or the configuration of the mail server on Message Archiving. Note: The Status column on the Mail Sources screen shows a colored icon to show status. The icons indicate the following: Green The mail server is connected and active. Caution: At any given moment, though the mail server might be connected and active, messages might still reside in the mail server s journal mailbox waiting to be archived. Messages may be waiting because Message Archiving archives messages based on periodic polling, not necessarily immediately after a message is journaled. Additionally, various other factors may affect the speed at which messages are archived. See How Message Archiving Archives Messages from Your Server on page 7. Blank The server has been configured but is not active. Red The server is in one of the following states: The server is active but Message Archiving cannot connect to it. The server is active and connected, but Message Archiving cannot archive messages from that server. To verify what state the red status icon indicates, run the Test Connectivity button on the Mail Sources configuration screen. If the test is successful, the server is connected but Message Archiving cannot archive messages. If you receive an error, check Connectivity Errors. March 2009 Proprietary: Not for use or disclosure outside without written permission 19

The Overview Screen Section Message Archiving Summary Communication Feed News Item Description A summary of archiving activity. This sections includes: The last time, in 24-hour clock time, you logged into the Spam Soap Console. The last time, in 24-hour clock time, you refreshed the Overview page. The maximum number of users who can use Message Archiving, as provisioned for your service agreement. The total amount of historical message space currently used out of the total available for use. Note: This field is displayed only if your service is provisioned for historical message archiving. The retention length for archived messages, as configured on the Customer Management screen. The total number of messages archived from the mail source. The date and time when the oldest and newest messages were archived. You can use this information to determine when older messages might start dropping from the Message Archiving database. The number, out of the total, of unassociated messages. See below for more information. The number, out of the total, of associated messages. See below for more information. Associated and Unassociated Messages An associated message is a message that, at the time the message was archived, matched a user administered in the Spam Soap Console, either because the user sent the message or was a recipient of the message. Except for the Customer Administrator, a user must be associated with a message in order to find and view it. An unassociated message is a message for which, at the time it was archived, neither the sender nor the recipients of the message matched a user administered in the Spam Soap Console. A message can be unassociated if: No users in the Spam Soap Console are either the sender or a recipient of a message. The message was archived before an associated user was added to the Spam Soap Console. The user or users associated with the message have been deleted from the Spam Soap Console. This last type of unassociated message is counted as an associated message on the Overview screen, since the message was associated when it was first archived. Only a Customer Administrator can find and view unassociated messages. A news feed on the latest message archiving news. Click on a link to access the Web page containing the new headline. A preview section for the news articles listed in the Communication Feed section. March 2009 Proprietary: Not for use or disclosure outside without written permission 20

Archive Historical Messages Archive Historical Messages If you have purchased an historical data storage option, you can archive past email messages that were saved prior to activating Message Archiving. Historical messages might also come from a source that saved the messages outside of the Exchange journaling process (for example from the mail server of a company that your company acquired). Historical messages might be in.pst files or messages that still reside on the Exchange server. Historical messages, which can be up to 25 MB in size, are archived indefinitely. The total number of historical messages is limited to the storage purchased in your Service Agreement. The storage you purchase represents the disk space that the messages use prior to archiving. To archive historical messages, perform the following tasks: 1 Create a mailbox for historical email on your mail server. This mailbox cannot be a journal mailbox. This mailbox should also not be a real user s mailbox, since messages are deleted after they are archived. Caution: All historical messages you archive must have the same format. That is, messages should not be a mix of envelope-journaled and non-journaled messages. If the message formats are mixed, you may encounter archiving problems or unexpected search results within Message Archiving. 2 On the mail server, copy into the historical mailbox any messages that you want to archive either from user mailboxes or from user.pst files. Caution: Do not forward or send messages to the historical mailbox. Forwarding or sending messages changes the sender/recipient information, as well as other metadata about the messages. 3 Within the Message Archiving Spam Soap Console, use the Mail Sources screen to create an historical mail source. Note: You can have only one historical mail source configured within Message Archiving at a time. March 2009 Proprietary: Not for use or disclosure outside without written permission 21

Archive Historical Messages A In most cases, you should designate the Platform Type of the mail source as Generic. If you are archiving historical messages that had previously been journaled with envelope journaling, you must designate the Platform Type as the type corresponding to the version of Exchange that journaled the messages (for example, Exchange 2000, 2003, or 2007). B Use the Server Name field to point to the mail server on which you created the historical mailbox. C Complete the Protocol, Connection Security, and Port fields as appropriate. D Use the Mailbox field to point to the historical mailbox you created. E Designate the mail source as historical. F Activate the historical mail source. At this point, Message Archiving archives any messages you have moved into the mailbox and then deletes those messages from the mailbox. Message Archiving continues to archive, then delete, any messages you copy to the historical mailbox until the mailbox is empty or historical data storage is exhausted. Caution: To retain a copy of historical messages in addition to the archived version, you must also copy those messages to a location outside of the historical message mailbox. Note: Message Archiving automatically deactivates your historical mail source when your historical data storage limit has been reached. At this point, you must purchase more storage if you want to archive more messages. After you ve purchased storage, you can reactivate the historical mail source. March 2009 Proprietary: Not for use or disclosure outside without written permission 22

Archive Historical Messages Archive Historical Messages in Different Formats You might need to archive historical messages that are in different formats. For example, you might have generic RFC-822 messages that are mixed together with envelopejournaled messages, or you might have enveloped-journaled messages from both Exchange 2003 and Exchange 2007. In this case, do the following: 1 Create an historical mailbox for each message format. 2 Based on the message format, move messages to the corresponding historical mailboxes. 3 Create an historical mail source in Message Archiving that points to one of the historical mailboxes. Set the Platform Type that corresponds to the format. 4 Activate the mail source you created, and allow Message Archiving to archive the messages in the associated historical mailbox. 5 When the messages have been archived, delete the mail source in Message Archiving. 6 Repeat steps 3 through 5 for each message format. Example As an example for archiving historical message in different formats, let s say that your company had been using an Exchange Server 2003 mail server and had journaled 10 GB of messages with envelope journaling. Then your company upgraded to Exchange Server 2007, which then accumulated 5 GB of journaled messages and 5 GB of nonjournaled messages. After you start using Message Archiving, you could do the following to archive these messages into Message Archiving: 1 Create the following three historical mailboxes on your Exchange 2007 server: Mailbox for 2003 envelope-journaled messages (mailbox name: 2003historical) Mailbox for 2007 envelope-journaled messages (mailbox name: 2007journaled) Mailbox for 2007 non-journaled messages (mailbox name: 2007nonjournaled) 2 Copy messages in each of the three formats to their corresponding mailbox. 3 On the Mail Sources screen within Message Archiving, set up the first historical mail source, 2003historical. Key fields administered for this mailbox would be: Platform Exchange 2003 Server Name denver.acme.com Mailbox 2003historical Historical Click the box to identify the mailbox as an historical mail source Active Click the box to start archiving historical data from the mailbox When all messages have been archived from the mailbox 2003historical, the mailbox should be empty. 4 On the Mail Sources list, delete mailbox 2003historical. 5 Create a new mail source for mailbox 2007journaled. March 2009 Proprietary: Not for use or disclosure outside without written permission 23

Archive Historical Messages 6 Repeat steps 3 and 4 for 2007journaled, taking care for step 3 to specify Mailbox as 2007journaled. 7 Create a new mail source for mailbox 2007nonjournaled. 8 Repeat step 3, taking care for step 3 to specify Mailbox as 2007nonjournaled. Deleting the mail source from Message Archiving is optional since you have finished archiving all historical data for now Monitor Historical Message Archiving When Message Archiving has finished archiving your historical messages, it does not notify you that it is finished. Additionally, when your purchased storage space for historical messages is exhausted, Message Archiving does not notify you. Instead, when you have historical messages that are being archived, you should periodically check the historical mailbox on your Exchange Server to see how many messages are still remaining. You can also check the Message Archiving Overview, which contains the Historical Data Storage Usage field. This field tells you how much storage has been used out of the total purchased. Finally, check the Mail Sources list in Message Archiving. If your historical storage space is exhausted, Message Archiving deactivates the mail source and displays the mail source in the list with a deactivated status. March 2009 Proprietary: Not for use or disclosure outside without written permission 24

Who Can Search for What 3. Searching Archived Messages Who Can Search for What A user, reports manager, quarantine manager, domain administrator, or reseller administrator can search for and view only his or her own archived messages. However, a customer administrator can search for and view the archived messages for all users. Additionally, only customer administrators can use all three search methods Simple, Advanced, and Archive ID searches. All other user levels are restricted to the Simple Search methodology. Finally, only customer administrators can use the Save Search function to save search criteria for reuse later. Note: All users except customer administrators should use the Message Archiving User Guide for information on searching messages. Begin a New Search To search for archived email, you must first access the Search Criteria input section using the following steps: 1 Click Message Archiving > Archived Messages. The Search Criteria fields for a Simple Search are displayed. The fields for the other two search types, Advanced Search and Archive ID search, are minimized, as indicated by the plus sign (+). 2 Search for archived email using one of three search methods: Simple Search, the default search method. See Perform Simple Searches. Advanced Search. See Perform Advanced Searches. Archive ID Search. See Search with the Archive ID. Note: Only a Customer Administrator can perform advanced searches or search by archive ID. After you have performed a search, you can do any of the following: Sort the Search Results. View Messages from the Search Results. Save a Search. Note: Only a Customer Administrator can save searches. March 2009 Proprietary: Not for use or disclosure outside without written permission 25

Perform Simple Searches Perform Simple Searches With the Simple Search capability, you define search criteria for one or more of the four main elements of archived messages: Sender Recipient Date Range Message Text For more information on how to use Simple Search, see How Simple Search works. To perform a simple search, use the following steps: 1 In the Search Criteria input section, select Simple Search, if necessary. The Search fields are displayed. 2 Complete one or more of the following fields: Note: Fields are not case-sensitive. From The name of the sender or senders, the domain, or both. Message Archiving searches for any of the names you enter. You can enter up to 1000 characters, including blanks. If you enter greg and bob, Messages Archiving searches for messages in which the sender is either greg or bob. March 2009 Proprietary: Not for use or disclosure outside without written permission 26

Perform Simple Searches Message Archiving uses the text you enter to find matches with the complete sender address, the recipient name, the domain name, and the domain name without the top-level domain suffix (for example, without.com). You can enter a name in one of the following ways: For a sender with the address greg@somedomain.com, any of the following: greg@somedomain.com greg greg@somedomain somedomain.com somedomain @somedomain NOTE: The sender s name cannot contain any spaces. Message Archiving interprets a name with a space as two names. For a wildcard search, a text string with an asterisk (*) or question mark (?) within or at the end of the string. The wildcard cannot begin a text string. The asterisk searches for the text string plus one or multiple characters as a replacement for the asterisk. For example, greg* searches for messages with the sender greg, regardless of domain. The question mark searches for the text string plus a single replacement character for the question mark. For example, sm?th@domain.com might find smith@domain.com and smyth@domain.com. Use alphanumeric characters. The following other special characters are allowed and interpreted as plain text: plus sign (+), dash (-), ampersand (&), bar ( ), exclamation (!), right parenthesis ()), left parenthesis ((), left curly brace ({), right curly brace (}), left bracket ([), right bracket (]), caret (^), quotation marks ("), tilde (~), colon (:), and backslash (\) in each name text string. Recipient The name of the recipient or recipients, the recipient s domain, or both. Acceptable formats and field length are the same as those identified for the From field. If you enter greg and bob, Messages Archiving searches for messages in which the recipient is either greg or bob. Note: You can also enter a distribution list name. Message Archiving searches for that name and lists messages with the distribution list name in the To: field. To see the actual list of recipients, you can export a distribution list message and view the journal envelope information. Date Range The date range in which the message was received. Use the calendar icon to select the dates you want, or type the dates in yyyy-mm-dd format, for example 2008-07-04. Note: This is the only format you can use for the date. The dates are referenced to your preferred time zone. Message Text Text that might be included in any or all of the following parts of the message: Message header Subject line Message body Attachment name March 2009 Proprietary: Not for use or disclosure outside without written permission 27

Perform Simple Searches Attachment body Acceptable formats are the same as those identified for the From field, except you can enter only up to 250 characters, including blanks. In addition, there are 32 words that Message Archiving ignores in a text search. See 32 Words That Message Archiving Ignores. 3 If you entered text in the Message Text field, click the drop-down list associated with the field, and select one of the following: Phrase Any word Message Archiving searches for the phrase you entered. For example, if you enter phoenix memo, Message Archiving matches any message that contains the phrase phoenix memo. With Phrase, Message Archiving does not find messages where the words phoenix and memo individually appear in the message, but not as a phrase. For example, Message Archiving would not match a message that contained only a sequence like phoenix transportation memo, where phoenix and memo are separated by another word. Message Archiving searches for messages that contain any of the words or numbers you entered. For example, if you enter phoenix memo, Message Archiving matches the following: Messages with phoenix only Messages with memo only Messages with both phoenix and memo, though found messages might or might not contain the phrase phoenix memo. 4 Click Search or press Enter on your keyboard. Message Archiving searches the archived messages and displays any matches in the Search Results side of the screen. NOTE: At any time, you can click Reset to erase all fields in your search criteria and start over. How Simple Search works Searching Values in a Single Field If you enter a single value in any one of the fields on the Simple Search input section, Message Archiving searches the Archiving database for messages that contain that value. Searching Values in Multiple Fields However, if you enter a single value in two or more fields in Simple Search, Message Archiving searches the Archiving database for messages that contain all values you entered in all the fields. March 2009 Proprietary: Not for use or disclosure outside without written permission 28

Perform Simple Searches For example, say that you type the following values: From joesmith Recipient Date Range 2008-07-13 to 2008-07-14 Message Text (using Phrase) virus checking This search example has the following outcomes: Message Archiving finds every message that Joe Smith sent between July 13 and July 14, 2008, inclusive, whose body or some other part of the message contains the phrase virus checking. Message Archiving would not find the following messages: A message that Joe Smith sent containing the phrase virus checking on July 12, 2008 (outside of the date range), A message that Joe Smith sent on July 13, 2008 (within the date range) that did not contain the phrase virus checking. Searching Multiple Values in the Message Text Field When you enter data in any of the first three fields of the Simple Search input section, then you enter multiple text strings in the Message Text field and specify any word, Message Archiving searches messages in the following way: 1 Message Archiving finds all messages that match the any word search you entered in the Message Text field, as described in Step 3 of Perform Simple Searches. 2 From this initial set of messages, Message Archiving selects messages that match all of the values in the other three fields. For example, say you enter the following search values: From Recipient joesmith Date Range 2008-07-03 to 2008-07-10 Message Text phoenix memo Message Archiving finds messages with phoenix, messages with memo, and messages with both phoenix and memo. From the set of messages it finds, Message Archiving searches for messages sent to joesmith between July 3, 2008, and July 10, 2008, and displays only those that it finds. If Message Archiving finds 15 messages with either phoenix or March 2009 Proprietary: Not for use or disclosure outside without written permission 29

Perform Simple Searches memo that were also sent within the selected date range, but Message Archiving didn t find joesmith as the recipient (because those messages had been deleted), then 0 messages would be displayed. 32 Words That Message Archiving Ignores When you perform a Message Text search, some words you enter might not actually be included in the search by Message Archiving. Instead, Message Archiving replaces these words with dummy placeholders and uses the other searchable key words in the search. This process applies to both any word and Phrase searches. The words that Message Archiving does not search for are as follows: Prepositions Determiners Verbs Pronouns Adverb Conjunction as, at, by, for, in, into, of, on, to, with an, the be, are, is, was, will it, such, that, their, these, they, this no, not, then, there and, but, if, or The following table lists some examples of text searches you might enter with ignored words and what Message Archiving actually searches for. Sample Text with Ignored Words diamond in the rough Match Type Any word Phrase In and the are ignored. What Message Archiving Finds Messages with diamond only. Messages with rough only. Messages with both diamond and rough anywhere in the message Messages with the phrase diamond rough. (In and the are ignored in the search criteria.) Messages with the phrase diamond in the rough. (In and the are ignored within the archived messages, but diamond and rough are found anyway.) Messages with the phrase diamond is rough. (In and the are ignored in the search criteria. Is is ignored within the archived messages.) There is no money Any word All messages with money. (There, is, and no are ignored in the search criteria.) Phrase All messages with money. (There, is, and no are ignored in the search criteria.) March 2009 Proprietary: Not for use or disclosure outside without written permission 30

Perform Advanced Searches Perform Advanced Searches Note: Only a Customer Administrator can use this capability. The Advanced Search capability enables you to define search criteria for any of a variety of archived message elements. Advanced search allows you to be more precise in your search of message text because you can specify what part of the message text you want to search: Message header Subject line Message body Attachment body In addition, you can search metadata, or information about the messages that Message Archiving stores, for specific values. This information includes: Names of attachments Message sizes To perform an advanced search, use the following steps: 1 In the Search Criteria input section, select Advanced Search. The Advanced Search input fields are displayed. March 2009 Proprietary: Not for use or disclosure outside without written permission 31

Perform Advanced Searches 2 Complete one or more of the following fields: From See Perform Simple Searches on page 26. Recipient See Perform Simple Searches on page 26. Date Range See Perform Simple Searches on page 26. 3 Select either All or Any in the Match field. All searches for messages that contain matching values for all of the four following fields, Header, Subject, Body, or Attachment Content. Any searches for messages that contain matching values for any of the four previous fields, Header, Subject, Body, or Attachment Content. If you entered text in only one of the four following fields Header, Subject, Message Body, or Attachment Content, select Any. 4 Complete any or all of the following four fields regarding message text. NOTE: You must also select a search type from the drop-down list associated with each field. See Step 5. Header Text that might appear in the message header. The message header, which might also be called the Internet header or the full header, is metadata about the message that is bundled with a message but is not visible in the standard view of a message. For more information, see View the Header of a Message. March 2009 Proprietary: Not for use or disclosure outside without written permission 32

Perform Advanced Searches Subject Text that might appear in the Subject line of the message. Message Body Text that might appear in the contents of the message. Attachment content Text that might appear in attachments. Attachment bodies that are searched can be pdf, rtf, Word, MIF, and many other file formats. Acceptable formats are the same as those identified for the From field. However, in each field, you can enter only up to 250 characters, including blanks. 5 If you entered text in any of the Message Text fields, click the drop-down list associated with the field, and select one of the following: Phrase Any word All words Message Archiving searches for the phrase you entered. For example, if you enter phoenix memo, Message Archiving matches any message that contains the phrase phoenix memo. In this example, Message Archiving would not match a message that contained phoenix transportation memo. Message Archiving searches messages that contain any of the words or numbers you entered. For example, if you enter phoenix memo, Message Archiving might find and display, among many other types of matches, the following: Messages with phoenix in the subject line only Messages with memo in the message body only Messages with phoenix in the attachment body only Messages with both phoenix and memo in the message header and subject line Message Archiving searches for messages that contain all of the text strings you entered, regardless of the order in which the strings appear. For example, if you enter phoenix memo, Message Archiving matches any message that contains both phoenix and memo. In this example, Message Archiving would match a message that contained phoenix of inmates memo. 6 In the Attachment Name field, enter the name of one or more attachments that had been attached to messages. You can enter only up to 250 characters, including blanks. Message Archiving can search attached messages and as many as 300 different types of files. Message Archiving can also search for nested attachments. Message Archiving searches for any of the names you enter. Acceptable formats are the same as those identified for the From field. 7 In the Message Size (KB) drop-down list, select one of the following options: Between Searches message size by range. You must enter a number of kilobytes in each of the two fields next to the drop-down list. Equal to Searches for an exact message size to the nearest single kilobyte (KB), plus or minus.5 KB (500 bytes). March 2009 Proprietary: Not for use or disclosure outside without written permission 33

Perform Advanced Searches Any message that is within.5 KB above or below the size you enter will be found. For example, if you search for a message with 451 KB, a message with 451,400 bytes would be found. Additionally, a message with 450, 831 bytes would also be found. If you search for a message with 500 KB, a message with 500,499 bytes would be found, but NOT a message with 501 KB. You must enter the number of kilobytes in first field next to the drop-down list. Less than Searches for a message size below a specified size. You must enter the maximum number of kilobytes in first field next to the drop-down list. More than Searches for a message size above a specified size. You must enter the minimum number of kilobytes in first field next to the drop-down list. The message size that Message Archiving stores includes the size of attachments. 8 Complete one or both of the Message Size (KB) fields to the right of the drop-down list. You complete both fields only if you are searching for a range of sizes. 9 Click Search or press Enter on your keyboard. Message Archiving searches the archived messages and displays any matches in the Search Results side of the screen. Note: You can click Reset in the middle of the screen to clear inputs in all fields. Examples of How Any and All Text Searches Work Example 1 with the All Match Method If you select All for the search algorithm and then enter values in two or more text fields Header, Subject, Body, or Attachment Content, Message Archiving searches the Archiving database for messages that contain matching values in all the fields. For example, say that you select All for the Match field and then type the following values: Field Name Entry Search Method Header john jane Any word Subject Body Virus checking Phrase Attachment Content For this search example, Message Archiving searches for and finds only the following: Messages that contain John in the header and virus checking in the message body. Messages that contain Jane in the header and virus checking in the message body. A message that contains Jane in the header and a phrase such as checking a virus would not be found. March 2009 Proprietary: Not for use or disclosure outside without written permission 34

Perform Advanced Searches Example 2 with the All Match Method However, say that you select All for the Match field and then type the following values: Field Name Entry Search Method Header john jane Any word Subject Body Virus checking Any word Attachment Content For this search example, Message Archiving searches for and finds the following: Messages that contain John in the header and virus or checking or both words in the message body, regardless of what order these two words appear in. Messages that contain Jane in the header and virus or checking or both words in the message body, regardless of what order these two words appear in. Messages that contain both John and Jane in the header and virus or checking or both words in the message body, regardless of what order these two words appear in. A message that contains Jane or John in the header but does not contain either word, virus or checking, in the body would not be found. Example 3 with the Any Match Method Next, say that you select Any for the Match field and then type the following values: Field Name Entry Search Method Header john jane Any word Subject Body Virus checking Phrase Attachment Content For this search example, Message Archiving searches for and finds the following: All messages that contain John in the header, regardless of whether Virus checking is in the body. All messages that contain Jane in the header, regardless of whether Virus checking is in the body. All messages that contain Virus checking in the body, regardless of whether John or Jane appear in the header. A message that contains a phrase such as checking a virus would still not be found. March 2009 Proprietary: Not for use or disclosure outside without written permission 35

Search with the Archive ID Example 4 with the Any Match Method Finally, say that you select Any for the Match field and then type the following values: Field Name Entry Search Method Header john jane Any word Subject Body Virus checking All words Attachment Content For this search example, Message Archiving searches for and finds the following: All messages that contain John in the header, regardless of whether Virus checking is in the body. All messages that contain Jane in the header, regardless of whether Virus checking is in the body. All messages that contain Virus and checking in the body, regardless where these two words appear together in a message body and regardless of whether john or jane appear in the header. A message that contains a phrase such as checking a virus will be found, as well as virus checking. Search with the Archive ID Note: Only a Customer Administrator can use this capability. Message Archiving assigns a unique archive ID to each message it stores in the Archiving database. The archive ID is a long text string consisting mostly of numbers that might look something like 1111113a2510519080. The final digits of this ID represent the chronological sequence in which the message was stored when compared to the other archived messages. As a customer administrator, you can search for a specific message with this archive ID. However, before you can search for a message with the archive ID, you must already know what the message s archive ID is. You can only determine a message s archive ID by previously viewing the message or exporting it. The archive ID is viewable in a message in the upper right of the message. The archive ID is also the default file name for each message you export. If you have a lot of messages with similar characteristics (for example scores of messages with the same Subject text), searching by archive ID can save you a lot of time when you want to see the message again. To find the Archive ID: 1 Search for and display messages with other search criteria. See View Messages from the Search Results. March 2009 Proprietary: Not for use or disclosure outside without written permission 36

Review Search Results 2 For a message you want to find again at a later time, note the Archive ID at the top of the message and write the ID down. To search for a message with the Archive ID, perform the following steps: 1 In the Search Criteria input section, select Archive ID Search. The Archive ID Search input field is displayed. 2 In the Archive ID field, enter a single archive ID. Note: You can also enter a wildcard search using the asterisk (*) to find any text string match of zero, one, or multiple characters or the question mark (?) to find any single character. The wildcard characters cannot be the initial or the only character in your search value. 3 Click Search or press Enter on your keyboard. Message Archiving searches the archived messages and displays any match in the Search Results side of the screen. Review Search Results When you search for archived messages, Message Archiving lists, in the Search Results pane, the message or messages that matched your search criteria. March 2009 Proprietary: Not for use or disclosure outside without written permission 37

Review Search Results Note the following characteristics of the list of messages: The number of messages found appears in the lower right corner of the Search Results section. The number of messages also appears next to Export All. If a message contains more than one attachment, the number of attachments is displayed in the Attachments column. If you searched for a specific recipient, but the message was sent to multiple recipients, the first recipient is listed in the To: column and determines where in alphabetic order the message is listed. If you did not search for a specific recipient and an archived message was addressed to multiple recipients in the To:, Cc:, and Bcc: fields, the message is listed only once for all recipients. The first recipient name in the To: field determines where the message appears alphabetically in the To: column. Note: If a recipient of a message you find was a Bcc recipient, that recipient is not listed in the headers. If you searched for a recipient, Message Archiving finds and displays all messages the recipient received, including Bcc messages. However, for Bcc messages, the recipient is still not listed in the headers. March 2009 Proprietary: Not for use or disclosure outside without written permission 38

Review Search Results Sort the Search Results You can sort the search results according to any of the columns in the Search Results section. 1 Click on the heading of the column you want to sort. You have the choice of sorting the messages in ascending or descending order of the values in the column. 2 Click Sort Ascending or Sort Descending. 3 To hide columns in the results, move your cursor over the Columns menu item and click the checkboxes to select or deselect the columns you want to display in your sorted list. 4 To move columns around so they are displayed in a different left-to-right sequence, perform the following steps: A Place your cursor on the column you want to move. B Click and hold the mouse button. C Drag the column to a different location. View Messages from the Search Results To view a message in your search results, simply doubleclick the message you want to view. A secondary window displays the selected message. See the following illustration. March 2009 Proprietary: Not for use or disclosure outside without written permission 39

Review Search Results NOTE: In most cases, the message is displayed in HTML format. However, if the original message was in plain text, the archived message might also be displayed in plain text. The Preview Pane You can also view a message in the Preview Pane at the bottom of the Search Results section (see 1 in the following figure). To do this, click the message in the list just once. If the Preview Pane is not open, click the Preview Pane toggle button (see 2 in the following figure). How Cc or Bcc Recipients Are Displayed If a recipient receives a messages because the recipient was addressed in the Cc list, the archived message lists the recipient as a Cc recipient. If a recipient is addressed in the Bcc list of the original message, the recipient is not displayed in the archived message. Even if you are searching for a message in which you were a Bcc recipient, you will not be shown as a recipient. As a customer administrator where your mail server is an Exchange Server 2007 that uses Premium Journaling, you can see a Bcc recipient only by exporting the message and then viewing the journal report portion of the message. The journal report contains data similar to full header information and comes from the journal mailbox of your Exchange Server. Journal report data is attached to all archived messages and is viewable by customer administrators in exported messages. See View Exported Messages. March 2009 Proprietary: Not for use or disclosure outside without written permission 40

Review Search Results Attachments and Links To open an attachment or a link, just click on it as with any email message. You may need a specific application on your computer in order to open an attachment. Clicking an html link within a message opens another window in your browser so you can view the linked Web page. The Archive ID The Archive ID in the upper right of a message is the unique identifier of the message within the Archiving database. If you want to perform an exact search on a message again later, you can enter the message s Archive ID in the Archive ID search field and run a search. If you have a lot of messages with similar characteristics (for example scores of messages with the same Subject text), searching by Archive ID can save you a lot of time. View the Header of a Message The header of a message gives you the following information: All of the servers in the transmission path of the message, from the sender s server to your own. The time each server passed the message to the next server in the path. Additional information about the message, including the transmission protocol, X- Mailer type, and priority. Note: For more information on message headers, see RFC822. To view the message header, click Show Headers at the top of the message window. To close the message header, click Hide Headers. Message Archiving displays the header information. March 2009 Proprietary: Not for use or disclosure outside without written permission 41

Review Search Results Export Messages You Find You can save one or more messages to your computer s hard drive. To save your messages, use the Export capability of Message Archiving. After saving messages, you can view them using your preferred email client, such as Outlook or Outlook Express. Note: The Export function of Message Archiving creates a zip file that contains your messages. Therefore, to actually complete the export of messages, your computer must have a zip file utility installed. Message Archiving automatically opens your zip file utility so you can finish exporting the messages to your computer. You can save messages in one of the following ways: Export All the Messages in the Search Results Export Only Selected Messages from a Page of Search Results Export All the Messages in the Search Results You can export, at one time, up to 150 MB of data found by your search, which for most searches, will be all of your messages. Thus, if a search finds 1000 messages and the total amount of data is equal to or less than 150 MB, you can export all of the messages with a single button click. The number of messages found is listed beside the Export All link at the top of the Search Results section. To export all messages from your search results, up to 150 MB of data, perform the following steps: March 2009 Proprietary: Not for use or disclosure outside without written permission 42

Review Search Results 1 Create a folder on your computer into which you can export archived messages. 2 After you run a search, click the Export All link at the top of the Search Results side of the screen. Message Archiving reruns the search and returns the messages. A window appears to ask if you want to open or save the zip file. Note: If your search returns more than 150 MB messages, refine your search to reduce the number of messages or follow the procedure in Export Only Selected Messages from a Page of Search Results. Note: The number of messages returned in the zip file might be different from the number listed next to the Export All link. This difference might occur because the number of messages in storage increased between the first search and the running of the export function. 3 Save the zip file to a directory on your computer or open the zip file to see the messages immediately. Messages are saved as.eml files. Each message is saved with a file name that matches the unique Archive ID that Message Archiving assigned to the message upon storage. Note: If more than 150 MB of messages were found, Message Archiving does not create a zip file and displays an error. 4 Extract the messages from the zip file and save them to the folder you created. Export Only Selected Messages from a Page of Search Results To save selected messages from a page of search results, perform the following steps: 1 After you run a search, click the checkbox next each message you want to export, or click the checkbox at the top of the column to select all messages on the page currently displayed. An Export Selected link is displayed at the top of the Search Results side of the screen. March 2009 Proprietary: Not for use or disclosure outside without written permission 43

Review Search Results 2 Click the Export Selected link. Message Archiving returns the messages. A window appears to ask if you want to open or save the zip file. 3 Save the zip file to a directory on your computer or open the zip file to see the messages immediately. Messages are saved as.eml files. Each message is saved with a file name that matches the unique Archive ID that Message Archiving assigned to the message upon storage. Depending on your computer s setup, you can search and open the files automatically through Windows Explorer or use your mail client to open them. 4 Extract the messages from the zip file and save them to the folder you created. You can view messages directly from the folder if you have associated the.eml file type with your email client program. Otherwise, you can move them to your email client and then view them. See Move Exported Messages into Your Email Client. March 2009 Proprietary: Not for use or disclosure outside without written permission 44

Review Search Results Move Exported Messages into Your Email Client In most cases, you can move exported messages into your email client. The way in which you do this depends on your computer and your email client. If your computer runs Microsoft Windows and either Outlook or Outlook Express, you can move your archived messages into your client with the following steps: 1 Create a folder in your email client to store the messages. 2 In Windows Explorer, open the folder where you saved the messages. 3 Select the messages you want to copy. 4 From the toolbar in Window Explorer, select Edit > Copy. 5 Open the folder in your email client where you want to move the messages. 6 From the toolbar in your email client, select Edit > Paste. View Exported Messages After you have exported a message, you can view it in one of two ways: If your email client is associated with the.eml file type, open the folder in which the message is stored, then doubleclick the message from the folder. If you moved the message to your email client, doubleclick the message in your email client. The format of the exported messages varies by the user role. Users receive the original message. Customer Administrators receive the journal envelope along with the original message. The Journal Envelope As a customer administrator, each message you export is contained within a journal envelope, which was created by your mail server when the message was initially stored in the journal mailbox of your mail server. The journal envelope contains information about the message that is similar to the original message header information but is actually more accurate and precise. When you open the message, your mail client, if configured to do so, renders the journal envelope within an email window. The body of the journal envelope contains sender and recipient information (see item 1 in the following figure). All recipients of the message are listed. However, in most cases, depending on your mail server, recipients are not differentiated by how they were addressed, that is, by To:, Cc:, or Bcc: recipients. In these cases, by comparing the recipient list in the journal envelope with the recipient list in the original message, you can determine if anyone was addressed as a Bcc recipient. If your mail server is an Exchange Server 2007 with Premium Journaling, Cc and Bcc recipients are identified in the journal envelope. The original email message is stored inside of the journal envelope as an attachment (see item 2 in the following figure). March 2009 Proprietary: Not for use or disclosure outside without written permission 45

Save a Search Note: All other users, including Domain Administrators, Spam Quarantine Managers, and Reports Managers, do not see the journal envelope in an exported message. These users only see the original message. The Original Message The original message is stored inside of the journal envelope as an attachment. To see the original message, doubleclick the attachment. Save a Search Note: Only a Customer Administrator can use this capability. After you have run a search, you can save the criteria you entered to reuse later. To save your search, perform the following steps: 1 Under Message Archiving, click Archived Messages and run a new search. 2 Under Search Criteria, click Save. 3 When the Save Search dialog box is displayed, type the name you want for the search and click Save or press Enter on your keyboard. Message Archiving creates a new tab for your saved search. Note: You can also save a new search from an existing search. In this case, open a saved search, make your changes, and click Save as. Run a Saved Search Note: Only a Customer Administrator can use this capability. March 2009 Proprietary: Not for use or disclosure outside without written permission 46

Run a Saved Search The Saved Searches screen lists any searches that were saved previously from the Search Criteria screen. To run a search you have saved, perform the following steps: 1 Under Message Archiving, click Archived Messages > Saved Searches. 2 In the Saved Searches list, doubleclick the name of your search, or select the name of your search and click Edit. 3 Change any criteria in your search, as needed. 4 Click Search or press Enter on your keyboard. Message Archiving returns a list of messages that matched your search criteria. Message Archiving also saves your search again, including any changes to the search criteria. March 2009 Proprietary: Not for use or disclosure outside without written permission 47

4. Troubleshooting This section lists information you can use for troubleshooting. This information includes: Connectivity Errors Common Error Messages Issues with Exchange Server Journal Mailbox March 2009 Proprietary: Not for use or disclosure outside without written permission 48

Connectivity Errors Message Archiving Administrator Guide Connectivity Errors The following errors may occur when establishing a connection to the mail server. Error Message Cause Solution Message Archiving could not open a socket to retrieve mail on the target mail source. This may be because the specified host cannot be located. Message Archiving could not complete the authentication when connecting to the mail source server. The most likely causes of this are an incorrect mailbox logon name or password. An error was encountered when attempting to connect to the mail server. The error might occur because of one of the following reasons: The server name specified in the mail source configuration may be incorrect. The mail server might not have an open port for the IMAP or POP3 communication. The IMAP or POP3 port on the mail server might be different than that entered on the Mail Sources screen. A firewall might be blocking the Message Archiving from connecting to the mail server's IMAP or POP3 port. POP3 or IMAP services might not be running on the mail server. The user authentication step failed, probably because of an incorrect mailbox logon ID or password. 1 If a server name has been entered, check that the name has been entered correctly and has been administered on the customer s DNS server. 2 If an IP address has been entered in the Server Name field, check that the address is correct for the mail server. 3 If the server name or IP address has been entered correctly, check that the IMAP or POP3 port is enabled and open in the customer mail server. 4 If one or more firewalls are in place, ensure that the IMAP or POP3 port is open for Message Archiving (refer to your Activation Guide for the IP address range of Message Archiving servers). 5 Check to see if the protocol and port combination specified on the Mail Sources screen matches what is running on the target server. Note: The default port number for both POP3 and IMAP is different when SSL is selected for the connection. 6 Check to make sure the proper protocol, IMAP or POP3, is running on the mail server. 7 Contact Customer Support if the server name or IP address has been correctly identified and the IMAP or POP3 ports are correctly administered on the firewall, mail server, and Mail Sources screen. Check the mail server to verify the mailbox logon name and password are correct. 49 Proprietary: Not for use or disclosure outside without written permission. March 2009

Connectivity Errors Error Message Cause Solution Message Archiving detected a protocol error. The mail server reported an error condition or failed to respond in a timely manner. Message Archiving received a 'lock busy' response from the mail server when attempting to authenticate. Message Archiving encountered an error during an initial DNS lookup and could not connect. The mail server is busy. Start Time/Stop Time: Invalid Time (A red box appears in the window which states the Incorrect time and "Invalid Start Time" value is not a valid ip address or domain name, element: server_host, value=[] Internal error code 5. Internal error code 6. Internal error code 8. Internal error code 10. Message Archiving detected a protocol error, such as an unexpected use of POP3 or IMAP. The mail server reported an error condition or failed to respond in a timely manner (which is typically around 60 seconds). Message Archiving received a 'lock busy' response from the mail server when attempting to authenticate. There might be a problem with your mail server. Message Archiving encountered an error during an initial DNS lookup and could not connect. The mail server returned a busy indication. One or more of the times in the Quiet period do not form a proper time range or the times are not in proper military time. The IP address or the Server Name is incorrect. 1 Confirm that the mail server supports the protocol identified on the Mail Sources screen for the specific port on the Mail Sources screen. 2 If the protocol is properly supported by the mail server for the designated port, contact Customer Support. Check an error log, for example the event log, on the mail server to see if an error occurred. 1 Try connecting again in a few minutes. 2 If you get an error again, confirm that your server is operating correctly. You might need to contact your vendor s technical support. 1 Check that the server host name is valid 2 If the server host name is valid, contact Customer Support 1 Try again in a few minutes. 2 If you get an error again, confirm that your mail server is operating correctly. You might need to contact your vendor s technical support. Make sure the Start time is earlier than the Stop time. 1 Check that the address is correct for the mail server. 2 Contact Customer Support if the server name or IP address has been correctly identified. Contact Customer Support. Contact Customer Support. Contact Customer Support. Contact Customer Support. March 2009 Proprietary: Not for use or disclosure outside without written permission 50

Common Error Messages Message Archiving Administrator Guide Error Message Cause Solution Internal error code 12. Contact Customer Support. Common Error Messages The following errors may occur when using Message Archiving. Error Message Cause Solution This field is required. (All the required fields encased with a red border indicating that these are required fields) Unable to search mail. Connection to Message Archive server failed. If the problem persists, please contact your archiving administrator. Unable to search mail. Message size upper range value must be numeric. Invalid request (must have an id, scope and message_id) Connection to Message Archive server failed. If the problem persists, please contact your archiving administrator One or more required fields are lacking an entry. The Message Archiving could not retrieve data from the Message Archive Server for one of the following reasons: The connection was down. A Message Archive Server process encountered an error. The request for data was corrupted. During a message size search, the Between" option was chosen but only the lower value in the range was given. When opening a message, the login session timed out. The connection to the Message Archive Server failed to retrieve the message data for viewing. Check that you have entries in the fields outlined in red. 1 Try the request again in a few minutes. 2 Contact Customer Support Enter both the lower and upper values to define the search range. 1 Log in again and retrieve the message again. 2 Contact Customer Support 1 Try the request again in a few minutes. 2 Contact Customer Support 51 Proprietary: Not for use or disclosure outside without written permission. March 2009

Common Error Messages Error Message Cause Solution Your session has expired, please login again. Unable to export mail. Connection to Message Archive server failed. If the problem persists, please contact your archiving administrator. Unable to export mail. Attempting to export [] Mb. Max export size is 150 Mb. Your browser s connection has time out for one of a variety of potential reasons: Your network connection dropped because of inactivity. Your computer timed out because of inactivity. Your browser timed out because of inactivity. The Message Archiving could not retrieve data from the Message Archive Server for one of the following reasons: The connection was down. A Message Archive Server process encountered an error. The request for data was corrupted. The total size of all the messages included when you tried to export messages exceeded 150 MB. Log into the Spam Soap Console again. 1 Try the request again in a few minutes. 2 Contact Customer Support. 1 Change your search so that fewer messages are listed before you export messages. 2 Use the Export Selected option instead of Export All so you can export fewer messages at a time. March 2009 Proprietary: Not for use or disclosure outside without written permission 52

Issues with Exchange Server Journal Mailbox Message Archiving Administrator Guide Issues with Exchange Server Journal Mailbox The following issues are related to activity related to the journal mailbox on your company s Exchange Server. Issue The journal mailbox in never empty Description There are several reasons why your journal mailbox may never completely empty: 1 Messages arriving in the journal mailbox during an archive session will not be processed until a future archive session. 2 Messages larger than 25mb are left in the journal mailbox indefinitely because the maximum message size is 25mb. 3 Messages that are improperly formatted cannot be archived, and are subsequently left in the journal mailbox. Improperly formatted messages can occur for various reasons, including: Journaling is not configured properly Messages are sent directly to the journal mailbox (bypassing the journal function) Messages are copied directly to the journal mailbox 4 The number of journaled messages is greater than the maximum number of messages that can be imported during a single archive session. 5 Large messages may be imported at night because the necessary network and server resources are typically more available at night. 53 Proprietary: Not for use or disclosure outside without written permission. March 2009

5. Upgrading or Replacing Your Server Follow these steps to ensure all mail is properly archived before and after your upgrade: 1 Remove all ability to send mail to or from your server 2 Monitor the journal mailbox until all mail has been picked up and removed by Message Archiving. 3 In the Spam Soap Console, uncheck the Active setting in the mail source(s) pointing to the server you will be upgrading. This will prevent Message Archiving from attempting to import email from your journal mailbox(es) during your upgrade. 4 Perform your upgrade and make sure no email can be delivered to or from your server until journaling has been enabled. 5 Once your upgrade is complete and journaling is enabled, allow email to flow to your server. 6 In the Spam Soap Console, edit the Mail Source(s) corresponding to your upgraded server and adjust the platform setting to match your new server software (if needed) 7 Make any other necessary adjustments to settings so that Message Archiving can properly connect to your journal mailbox(es). 8 Check (enable) the Active setting 9 Perform a Test connectivity to verify that Message Archiving can connect to your mail source 10 Save the mail source configuration 11 Monitor your journal mailbox(es) to ensure that mail is being imported properly. Note: Expect your mail source to be polled for new messages within approximately 15 minutes after it has been activated. March 2009 Proprietary: Not for use or disclosure outside without written permission 54