Cuty ourm c r os of t Ex c hangeser v er s t or agec os t sbyupt o85% Howema lar c h v ngs ol ut onsex pand y ournat v eema lappl c at on' sc apab l t es
CONTENTS Introducton... 3 Emal Storage Management... 4 Offlne Emal Storage Management... 5 Emal Complance Support... 6 Legal Dscovery... 7 Retenton and Dsposton... 8 Exchange Mgraton... 9 Exchange Local Recovery...10 Exchange Dsaster Recovery...10 Unfed Messagng Management...11 Concluson... 12 INFORMATION IMMEDIACY, DISCOVERY & CONTINUITY Mmosa Systems Inc. 3200 Coronado Drve, Santa Clara, CA 95054 www.mmosasystems.com 408-970-9070
Introducton Emal archvng s emergng as a crtcal new IT applcaton for managng emal. For legal dscovery, storage management, and regulatory complance, emal archvng provdes mportant benefts that cannot be acheved wth natve emal applcatons. The purpose of ths Emal Archvng 101 paper s to provde a basc ntroducton to emal archvng and explan how t benefts management of the emal applcaton server. The leadng enterprse emal applcaton s Mcrosoft Exchange Server, and ths paper s geared toward ths applcaton; however, the prncples dscussed apply to all messagng applcatons. In each secton, we wll address a key ssue or problem regardng emal and how emal archvng addresses ths problem. Begnnng wth basc ssues surroundng emal storage, we wll go on to address other mportant ssues that mpact emal recovery, legal dscovery, and regulatory complance. Because emal touches every person n the organzaton and because emal contans content that s often consdered a record of busness, careful management and archvng of emal s crtcal. Emal archvng s the applcaton that extends and mproves basc emal applcaton servers for the beneft of the organzaton. Mmosa Systems, Inc. develops and markets an emal archvng soluton called Mmosa NearPont for Mcrosoft Exchange Server. Mmosa NearPont s a next-generaton emal archvng soluton that delvers archvng, edscovery, recovery, dsaster recovery, and storage management n a sngle ntegrated soluton. For managng Exchange Server, NearPont performs multple mportant functons that mprove the overall performance of Exchange. NearPont: Reduces and manages onlne and offlne emal storage. Adds powerful tools for legal dscovery and complance. Extends natve Exchange recovery capablty. Ths paper wll enable you to gan a deep understandng of the many mportant benefts of emal archvng and Mmosa NearPont for Mcrosoft Exchange Server. 3
Emal Storage Management Storage of emal on the messagng server has been a crtcal ssue ever snce emal applcatons were frst deployed. When dsk drves were 9GB and malboxes were 5MB n sze, storage was obvously very crtcal. Even wth the new large-capacty dsks avalable today, emal storage space s stll crtcal. Many users keep emal for years, and t can consume many ggabytes of malbox capacty. Emal archvng solutons reduce storage on the emal server through a process called stubbng or short-cuttng. The basc process nvolves makng a copy of the emal and the attachment n the archve, then deletng the emal and the attachment from the emal server and replacng t wth a small stub fle. The fnal step s to nsert a small bt of code n the emal clent to enable t to detect when the user clcks the stub message, so the clent can recall the emal and the attachment from the archve. In other words, the user keeps access to hs or her emal and attachments; however, they are beng stored n the archve, not the emal server. Mmosa NearPont has a standard feature called Malbox Extenson that performs stubbng for Mcrosoft Exchange. Based on polces of age and sze that are defned by the admnstrator, NearPont removes attachments from the Exchange Server. When users double-clck the message n Outlook, an Outlook Form recalls the attachment from the archve and dsplays t together wth the orgnal emal. Users enjoy havng access to all ther emals and attachments, and admnstrators enjoy beng able to cut Exchange storage by as much as 85 percent. To summarze, emal archvng solutons such as Mmosa NearPont allow admnstrators to reduce emal storage by polcy whle preservng user access. Wthout emal archvng, the only alternatves are to let storage on the emal server grow uncontrolled, delete emal, or move emal to offlne storage fles. In the next secton, we wll dscuss the challenges created when too much emal s moved to offlne storage fles. 4
Offlne Emal Storage Management For Mcrosoft Exchange, offlne fles for emal storage are called Personal Store (PST) fles. PST fles are a very popular way for end users to store emal locally on desktops and network fle servers. PST fles help reduce the amount of emal managed on Exchange Server and are often necessary to enable Exchange Server to stay below quota lmts. Users also enjoy beng able to access emal when they are not connected to Exchange Server. Exchange supports expanded storage capacty and wll support ggabyte-sze malboxes, but users wll contnue to use PST fles for the benefts of havng local access to them. PST fles create a very dffcult management challenge for admnstrators and they create rsk to the organzaton. Because they exst as ndependent fles, they are not tracked by Exchange and can be easly lost. In cases nvolvng emal dscovery, PST fles must be manually collected and searched ndvdually a very labor-ntensve and costly exercse. The data contaned n PST fles s very crtcal for complance and corporate ntellectual property. If PST fles are lost or stolen, the organzaton can be at enormous rsk. The current best practce s to elmnate the use of PST fles. Before PST fles can be elmnated, organzatons need a way to manage exstng PST fles and store ther contents n a central repostory. Emal archvng solutons perform multple functons to help wth mproved PST management, as well as eventual PST elmnaton f ths s the desred end result. Frst, emal archvng solutons ngest data from exstng PST fles and store the PST contents n an ndexed archve. Once archved, the PST nformaton can be searched quckly for legal dscovery. The archve centrally manages and protects the PST contents and reduces the rsk of losng PST nformaton. The Mmosa NearPont emal archvng soluton manages PST fles wth ts PST Archvng Opton. Usng the NearPont PST Archvng Opton, PST fles are automatcally located across servers and laptops and are actvely mported (or ngested) nto the NearPont archve. Once PST fles are loaded nto the NearPont archve, the PST data can be searched by audtors for legal dscovery. Usng the NearPont PST Archvng Opton, admnstrators can elmnate the need for PST fles altogether. 5
Emal Complance Support Laws and regulatons exst n the Unted States and nternatonally that requre long-term retenton of emal records. Dependng on the ndustry n whch you operate, your organzaton may be requred to keep emal records n an ndexed repostory, where they can be easly searched for regulatory audt or legal nvestgaton. Emal archvng s the applcaton that meets these requrements. Support for complance s commonly msunderstood. Emal applcatons that allow users to delete emal do not meet regulatory requrements, and tape backups do not meet requrements for accessblty. To explan the shortcomngs of Mcrosoft Exchange 2007 for complance, we asked noted Exchange MVP Paul Robchaux to wrte ths bref statement: Mcrosoft Exchange 2007 does delver some very useful and mportant new features that can help mplement better archvng and complance, but they may not be suffcent to completely mplement an archvng and complance soluton. Exchange tself s not an archve. It can search, flter, retan, and expre content that s already n Exchange, but t doesn t have any tools for mportng exstng nformaton from PST fles or other sources. Exchange leaves retenton decsons up to the user. Users are free to drag messages nto managed folders, but they re equally free not to. Because Exchange sn t an archvng soluton, t doesn t nclude tools to provde tamper detecton for stored data (apart from the checksum mechansms used to ensure ntegrty of the message databases), and t doesn t natvely support non-rewrtable storage. The journalng support n Exchange can capture messages at the tme they re sent or receved, but t doesn t capture context and t places an addtonal load on the malbox servers that are responsble for the journalng operatons. The greatly mproved Exchange content ndexer can ndex only Exchange data that s currently n a malbox somewhere. It can t ndex hstorcal data or data from other sources. For Mcrosoft Exchange Server, Mmosa NearPont stores all Exchange emal and attachments n an ndexed archve that meets all laws for regulatory complance. One of the most mportant benefts of NearPont s that t extends Exchange retenton capablty and provdes enterprse-wde polcy enforcement that s managed at the server level, thus preventng user nterventon. The folder-level retenton feature n Exchange s at the user s dscreton, on the other hand, so there s no assurance that data wll be managed accordng to polcy. 1 Exchange by tself does not meet requrements for complance. 1 Folder-level retenton s a new feature of Exchange 2007. 6
Legal Dscovery One of the most crtcal (and costly) challenges facng every organzaton s emal dscovery for ltgaton support. As a result of the wdespread use of emal for busness communcaton, emal s commonly subpoenaed n court as evdence. Organzatons, when requred by the court, must produce old emal, no matter how much tme s needed for retreval. If old emal records are stored on backup tape, the cost to fnd the emal n queston can be extreme. Emal applcatons by themselves do not support legal dscovery very well. Mcrosoft Exchange, for example, s a leadng enterprse emal applcaton, but t has some crtcal shortcomngs for legal dscovery. Frst, users can delete emal on Exchange or move emal to offlne PST fles, so there s no way to ensure that a partcular emal exsts for legal dscovery. Second, the natve Exchange search tools are very basc and make t more dffcult to search emal records quckly. Emal archvng solutons provde mportant functonalty to support legal dscovery. Prmarly, they provde a relable record of all emal actvty n the archve. The archved emal s ndexed and can be searched quckly for legal dscovery. Mmosa NearPont s an emal archvng applcaton that supports legal dscovery for Mcrosoft Exchange. NearPont manages a complete copy of all current and hstorcal emal so t can be accessed quckly and easly for dscovery. Mmosa NearPont also provdes powerful search tools that audtors can use to search across multple malboxes. The NearPont search tool s a GUI that allows for easy search usng wld cards, Boolean logc, proxmty search, and specfcaton of multple emal propertes. NearPont search results can be sorted and results can be exported n PST fles for easy transport. For legal workflow, the NearPont edscovery Opton s an add-on product for Near- Pont that enables you to reconstruct complex events and understand user behavor for ltgaton support and nvestgatons. The NearPont edscovery Opton offers effcent collaboraton capabltes so you can search, share, hold, revew, and tag results for export. It also exports search results n PST fles, whch can be gven to nternal or external partes. 7
Retenton and Dsposton Retenton and dsposton management of emal s related to both complance and legal dscovery, but t s such an mportant ssue that we wll dscuss t n ts own secton. Emal applcatons are tradtonally user drven and hence do not support polcy-drven retenton and dsposton. Organzatons that are requred by regulatory laws or corporate polcy to keep emal for a certan perod of tme (e.g., years) requre the assstance of an emal archvng soluton. Emal archvng solutons provde features that keep records securely n the archve and purge records after a specfed perod of tme has expred. Retenton rules are defned by the admnstrator and are automatcally managed by the emal archvng soluton. Retenton and dsposton rules can be suspended, f needed. For example, t s a federal requrement n the Unted States to suspend any dsposton of emal when a lawsut s pendng. 2 Mcrosoft Exchange 2007 supports emal retenton at the folder level. Admnstrators can confgure retenton settngs for folders and messagng types, makng dsposton of message content automated. Exchange 2007 folder-level retenton s user drven and s not a soluton for complance. Mmosa NearPont, n combnaton wth Exchange 2007 folder-level retenton polces, however, does provde full complance for the most strngent regulatons. Mmosa NearPont manages retenton and dsposton based on enterprse-wde, server-based polces that cannot be crcumvented by users. Polces are defned at the malbox level and can be further defned by folder and message class. NearPont wll enforce the folder retenton polces and wll not allow user nterventon an mportant requrement for complance. Should ltgaton arse, NearPont provdes a Retenton Hold polcy that freezes all retenton for a gven user untl released by the admnstrator. 2 See Federal Rules of Cvl Procedure. http://www.law.cornell.edu/rules/frcp/. 8
Exchange Mgraton When upgradng from one emal applcaton server to another, or whenever an emal malbox s moved from one server to another, the tme t takes to move the emal contents can be reduced f the amount of emal s reduced. Ths basc prncple allows emal archvng solutons to mprove emal mgraton. Let s look at, for example, the upgrade from Mcrosoft Exchange 2003 to Exchange 2007. Ths upgrade requres that the contents of all exstng malboxes be moved to a new malbox. The sze of the exstng malbox determnes the tme requred to make the complete mgraton. Mmosa NearPont supports Exchange mgraton by reducng malbox sze and by protectng malbox data. To reduce the total mgraton tme, malbox nformaton on the source Exchange Scan be reduced by NearPont. In a typcal Exchange 2003 envronment wth NearPont deployed, for example, all Exchange 2003 malbox nformaton exsts n the NearPont archve. The admnstrator can reduce the malbox sze on Exchange Server usng natve Exchange tools to groom malboxes to a fxed sze (such as 100MB) or a fxed tme perod (such as 12 months). Should any problem occur durng transton to the malbox nformaton, a full malbox restore can be performed usng NearPont. Usng NearPont, admnstrators can enjoy a faster mgraton wth smaller malboxes and wth no rsk of losng malbox nformaton. Exchange Server 2003 Mgraton Exchange Server 2007 Shadowng Shadowng NearPont Server Fgure 1. NearPont wth Exchange 2003 and 2007 Servers 9
Exchange Local Recovery Local recovery of emal applcaton servers s mportant to provde servce contnuty and to prevent loss of emal. Mcrosoft Exchange 2007 has recently ntroduced two new methods of local recovery, whch we wll examne. For local Exchange recovery, Exchange 2007 supports two new features: Local Contnuous Replcaton (LCR) and Standby Contnuous Replcaton (SCR). LCR copes Exchange log fles locally and provdes on-host data redundancy, reduced backup requrements, and mproved database recovery. LCR performs on-host and s restrcted to a storage group contanng a sngle database. LCR consumes local CPU and server resources and should be used wth careful plannng. SCR operates by copyng Exchange log fles to a standby host and also mproves database recovery for Exchange 2007. SCR performs off-host and, lke LCR, s restrcted to a storage group contanng a sngle database. SCR requres that an addtonal server and storage be provsoned. Both LCR and SCR are used to restore a full Exchange database quckly from dsk. They cannot perform malbox-level recovery or message/folder-level restores. LCR and SCR are managed va the new command shell n Exchange 2007. Emal archvng solutons do not customarly provde data protecton and recovery for the emal applcaton server. Unquely, Mmosa NearPont performs contnuous data protecton for Exchange based on the Exchange Transacton Log fles. NearPont mproves Exchange recovery by supportng all versons of Exchange 2000, 2003, and 2007, and t has no restrctons on storage groups or malbox stores. And very mportantly, NearPont performs entrely off-host and does not mpede Exchange Server performance. NearPont can restore a complete Exchange database, an ndvdual malbox, and ndvdual messages and folders. Exchange Dsaster Recovery Emal applcaton servers should also be protected aganst dsaster. For dsaster protecton of Mcrosoft Exchange, Exchange 2007 ntroduces a new feature called Cluster Contnuous Replcaton (CCR). CCR performs on the Exchange Server and contnuously replcates Exchange log fles to a remote Exchange Server. Both Exchange Servers are under the management of Mcrosoft Cluster Servces (MSCS). Mcrosoft Exchange CCR has mportant requrements and certan lmtatons. CCR s enabled per storage group, and a storage group s restrcted to a sngle database. Usng MSCS, the two Exchange Servers and a fle share wtness make up the mnmum dsaster falover confguraton. Strct requrements exst for the network bandwdth between the servers to manage the replcaton and heartbeat satsfactorly. 10
Agan, t s not customary for emal archvng solutons to offer dsaster protecton for emal. Unquely, Mmosa NearPont protects Mcrosoft Exchange data aganst dsasters and offers a less complex and less costly alternatve to Exchange 2007 CCR wth the NearPont Dsaster Recovery (DR) Opton. The NearPont DR Opton replcates the Exchange database fles managed on the NearPont server to a standby Exchange Server wthout requrng complex (and expensve) clusterng support. The NearPont DR Opton provdes a bult-n soluton for protectng Exchange data n a cost-effectve and easy-to-manage soluton. Unfed Messagng Management Unfed messagng refers to the applcaton that ntegrates dgtal vocemal wth the emal applcaton server. If enabled, users receve a vocemal n ther nbox as an emal plus an attachment. The attachment s an audo fle (e.g.,.wav or.wma) that can be opened and lstened to n the same manner as usng the telephone. The beneft of unfed messagng s ncreased user productvty. Unfed messagng creates two major rsks to emal management. Frst, t ncreases emal storage volume, and ts growth and storage consumpton must be managed carefully. Second, the vocemal may become evdence for legal dscovery, unless specfc emal polces are defned. Mcrosoft Exchange s one example of an emal applcaton server that ntegrates wth unfed messagng. Mcrosoft Exchange 2007 ntroduces a new unfed messagng server role that ntegrates vocemal audo fles wth Exchange as emal attachments. Users can access all voce, fax, and emal data from one nbox. Admnstrators need to carefully plan for the mpact that unfed messagng data wll have on Exchange malbox capacty. Admnstrators also need to carefully plan how unfed messagng mght mpact the archve. To help manage unfed messagng data n the emal archve, Mmosa NearPont provdes multple features. For organzatons that want to exclude vocemal data from the NearPont archve, NearPont provdes data excluson polces that manage emal data by excludng a partcular message class or folder type, or by excludng entre malboxes. For organzatons that want to retan vocemal data n the archve and stll control the archve s storage utlzaton, NearPont Malbox Extenson can be confgured to automatcally manage storage lmts by age and sze. Usng a combnaton of NearPont features, admnstrators can control and manage archve storage levels and experence no mpact from new data types such as unfed messagng. 11
Concluson Emal archvng s a new IT applcaton that provdes multple mportant benefts for managng your emal applcaton server. In ths paper, our focus was on the popular Mcrosoft Exchange Server, but the prncples we dscussed apply to all emal applcatons. We explaned how emal archvng not only helps manage onlne and offlne emal storage, t also manages a secure record of all emal n an ndexed repostory. The repostory can be searched easly for legal dscovery, and t manages emal for complance. Mmosa NearPont s a next-generaton emal archvng soluton that delvers all of the emal archvng benefts we dscussed for Mcrosoft Exchange. Mmosa NearPont works wth Mcrosoft Exchange Server to meet laws and regulatons for complance. Usng the powerful search tools n NearPont, legal dscovery of hstorcal emal can be performed for a fracton of the cost of searchng backup tapes. And NearPont provdes mportant features to reduce total Exchange storage and perform Exchange recovery at all levels (.e., at the database, malbox, and ndvdual message levels). Mmosa NearPont s the essental tool to help you optmze Mcrosoft Exchange Server. Fnd Out More For more nformaton about Mmosa Systems and how NearPont can help solve your archvng, edscovery, recovery, and storage management ssues, contact Mmosa at 408.970.9070 or vst our web ste at www.mmosasystems.com. About Mmosa Systems Mmosa Systems, Inc. delvers next-generaton nformaton management solutons for nformaton mmedacy, dscovery, and contnuty. Mmosa NearPont for Mcrosoft Exchange Server s the ndustry s most comprehensve nformaton management software soluton for Mcrosoft Exchange, unfyng emal archvng, recovery, and storage management. Wth optons for edscovery and dsaster recovery, NearPont ensures ltgaton readness and emal contnuty, whle leveragng cost-effectve dsk technologes to optmze emal storage growth. Mmosa s a Mcrosoft Gold Certfed Partner, recognzed for ts competences n Networkng Infrastructure Solutons, ISV/Software Solutons, and Advanced Infrastructure Solutons. Mmosa s a prvately held company whose nvestors nclude August Captal, Clearstone Venture Partners, Dot Edu Ventures, JAFCO Ventures, and Mayfeld Fund. Mmosa was founded n 2003 and s based n Santa Clara, Calforna, wth offces n Munch, Germany, and Pune, Inda. For more nformaton, see www.mmosasystems.com. 2007 Mmosa Systems, Inc. All rghts reserved worldwde. Mmosa, Mmosa Systems, and NearPont are trademarks of Mmosa Systems Inc. n the Unted States and other countres. Other product names mentoned heren may be trademarks or regstered trademarks of ther respectve owners 12