Understanding Journaling in a Mixed Exchange 2003 and Exchange 2010 Environment

Applies to: Exchange Server 2010 SP3, Exchange Server 2010 SP2

When you plan for journaling in a mixed Microsoft Exchange Server 2010 and Exchange Server 2003 environment, it's important to understand how the different environments interoperate.

To learn more about journaling, see Understanding Journaling.

Looking for management tasks related to managing journaling? See Managing Journaling.

Contents

Journaling in Exchange 2003

Journaling in Exchange 2010

How Exchange 2003 and Exchange 2010 Identify Journal Reports and Journaled Messages

Exchange 2003 and Exchange 2010 Journaling Interoperability

Journaling in Exchange 2003

The journaling feature in Exchange 2003 allows you to journal all the mailboxes on a mailbox database. If you want to journal only some mailboxes in a mailbox database, you have to do either of the following:

• Journal all the mailboxes in that mailbox database.

• Create a new mailbox database, enable journaling on that mailbox database, and then move the mailboxes to be journaled to the new database.

Exchange 2003 doesn't let you centrally manage its journaling capabilities. You have to manage journaling on a per-mailbox store and per-Mailbox server basis.

By default, when a message is journaled in Exchange 2003, only the original message is delivered to the journaling mailbox. To journal the envelope information of the original message, you must manually enable envelope journaling. Even with envelope journaling enabled, only basic subject and recipient information is captured.

Return to top

Journaling in Exchange 2010

The journaling feature in Exchange 2010 has been significantly redesigned to enable more control over what recipients and senders you journal. In Exchange 2010, you can create journal rules to target specific recipients and senders, distribution groups, or a combination of both. It doesn't matter where the recipients or senders are located.

Using journal rules, the granularity of journaling is improved so that you can selectively journal one or more recipients. You can also locate mailboxes that you want to journal on a mailbox database that may also contain mailboxes you don't want to journal. Only the messages that are sent from or to senders and recipients for which you've created journal rules are journaled.

In addition, you manage journal rules centrally on Hub Transport servers. Journal rules are stored in Active Directory. Journal rules created on a Hub Transport server are automatically replicated throughout the Active Directory forest and become available to all Hub Transport servers. This means that all Hub Transport servers in your organization use the same journaling configuration.

In Exchange 2010, you can still journal messages on a per-mailbox database basis. This configuration is equivalent to the Exchange 2003 per-mailbox database configuration where all messages sent to or from mailboxes on a journaled mailbox database are journaled.

Exchange 2010 uses envelope journaling and provides much more information in the journal envelopes to help you sift through the potentially large amount of data that can be collected when mailboxes are journaled. The journal envelopes are formatted to enable automated searching of journal report contents by third-party or custom applications.

For more information about journal reports in Exchange 2010, see Understanding Journal Reports.

Return to top

How Exchange 2003 and Exchange 2010 Identify Journal Reports and Journaled Messages

In Exchange 2003, the journaling of messages and the identification of journal reports are controlled by using the X-EXCH50 binary large object (BLOB). The X-EXCH50 BLOB contains extended information about the message that can't be stored elsewhere in the e-mail message. The information stored in the X-EXCH50 BLOB contains a variety of information, such as journaling, spam confidence level (SCL), and other MAPI properties that don't have MIME representation.

By examining the X-EXCH50 BLOB, Exchange 2003 can determine whether a message is a journal report and therefore bypasses various system limits, such as message size and mailbox recipient restrictions. Exchange 2003 also uses the X-EXCH50 BLOB to determine whether a message has already been journaled on a previous hop on another Exchange 2003 server. This prevents other Exchange 2003 servers that may handle the message from journaling it again. However, the limitation of the X-EXCH50 BLOB is that it's a proprietary Extended Simple Mail Transfer Protocol (ESMTP) verb. As such, it can't be propagated by computers that don't have Exchange installed.

In Exchange 2010, the X-EXCH50 BLOB is deprecated and replaced with SMTP headers to which the header firewall is applied. These SMTP headers can be accessed only by the Exchange 2010 transport components. They are removed from messages before delivery to mailboxes or delivery outside the Exchange 2010 organization. The following SMTP headers are used by the Exchange 2010 Journaling agent:

• X-MS-Exchange-Organization-Processed-By-Journaling This SMTP header identifies messages that have been processed by the Exchange 2010 Journaling agent. If this header is included in a message, Exchange 2010 recognizes that the message has already been processed by the Journaling agent on a previous hop by another Hub Transport server and doesn't journal the message again.

• X-MS-Exchange-Organization-Journal-Report This SMTP header identifies an Exchange 2010 journal report in the transport pipeline. If this header is included in a message, Exchange 2010 knows the message is a journal report. It allows the message to act as a system message and bypass message size and mailbox recipient restrictions.

• X-MS-Journal-Report Before delivering a journal report to the journaling mailbox or an external journaling recipient, the header firewall removes all Exchange Server Organization headers, including the X-MS-Exchange-Organization-Journal-Report header. Instead, the X-MS-Journal-Report header is added to identify it as an Exchange 2010 journal report after it has left the transport pipeline. This header isn't used by any Exchange 2010 transport components. It lets you differentiate a journal report from a regular message.

For more information about the SMTP header firewall, see Understanding Header Firewall.

Return to top

Exchange 2003 and Exchange 2010 Journaling Interoperability

This section describes how journaling functionality works in a mixed Exchange environment.

Supporting Exchange 2003 Journaling in an Exchange 2010 Organization

Exchange 2003 and Exchange 2010 identify journal reports and journaled messages differently. To support journaling in a mixed Exchange 2003 and Exchange 2010 organization, Exchange 2010 supports using the X-EXCH50 BLOB. However, Exchange 2003 doesn't support or recognize the new SMTP headers that are used by Exchange 2010.

When Exchange 2010 journals a message, it adds a property to the X-EXCH50 BLOB in addition to the X-MS-Exchange-Organization-Processed-By-Journaling SMTP header so that Exchange 2003 servers that encounter the message know that the message has already been journaled.

Exchange 2010 treats journal reports similarly. When a journal report is created in Exchange 2010, the X-EXCH50 BLOB is added to the message in addition to the X-MS-Journal-Report header. This enables the journal report to travel through the Exchange organization and to be treated as a journal report by all the Exchange servers that it encounters.

Exchange 2010 also reads the Exchange 2003 journaling configuration from Active Directory. This configuration tells the Exchange 2010 Hub Transport servers which Exchange 2003 mailbox databases have journaling enabled and also which journaling mailboxes they have sent the journal reports to. When a message is sent to a recipient on a journaled Exchange 2003 mailbox database from Exchange 2010, the Exchange 2010 Hub Transport server journals the message and sends a journal report to the journaling mailbox configured on the Exchange 2003 mailbox database.

For more information about journal reports in Exchange 2010, see Understanding Journal Reports.

Configuring Routing Group Connectors Between Exchange 2003 and Exchange 2007

When you install a Hub Transport server in an Exchange 2003 organization, Exchange 2010 automatically creates the routing group Exchange Routing Group (DWBGZMFD01QNBJR). This routing group contains all the computers in the organization that are running Exchange 2010. All Exchange 2010 servers are members of this routing group. Exchange 2010 configures a routing group connector to connect the Exchange 2010 routing group to an existing Exchange 2003 routing group.

The routing group connector created by Exchange 2010 is configured to enable the X-EXCH50 BLOB to pass between Exchange 2010 servers and Exchange 2003 servers. If you create additional routing group connectors between the Exchange 2010 routing group and other Exchange 2003 routing groups, the connectors are also configured to enable the X-EXCH50 BLOB to pass between Exchange 2010 servers and Exchange 2003 servers.

For more information about routing group connectors, see the following topics:

• Understanding Message Routing

• Create Additional Routing Group Connectors from Exchange 2010 to Exchange 2003

Reducing Multiple Journal Reports

In a native Exchange 2010 organization, when a message passes through Hub Transport servers, the message is evaluated by the Journaling agent. Unless the recipient list changes on that message before delivery, the Journaling agents on later Hub Transport servers don't reevaluate the message. Because the message is evaluated for journaling only on one Hub Transport server, only one journal report is typically created and sent to the journaling mailbox.

When messages are journaled in a mixed Exchange 2003 and Exchange 2010 organization, the possibility of creating multiple journal reports for a single message increases. This is because both an Exchange 2010 Hub Transport server and the Exchange 2003 server that receive or send the message from or to a Hub Transport server evaluate the message for journaling.

Exchange 2010 reduces multiple journal reports that are generated for a single message by supporting the X-EXCH50 BLOB. The Exchange 2010 Hub Transport server stamps the X-EXCH50 BLOB on the original message with the address of the journaling mailbox where the journal report was sent. When an Exchange 2003 server receives the message from the Exchange 2010 Hub Transport server, the Exchange 2003 server examines the X-EXCH50 BLOB to see whether the message has been journaled. If it has been journaled, and if the journal report was sent to the same journaling mailbox configured on the mailbox store where the mailbox resides, Exchange 2003 doesn't generate another journal report.

Journaling Mailbox Location

If you want to journal mailboxes that reside on an Exchange 2003 mailbox database, the journaling mailbox must be located in an Exchange 2003 mailbox database that doesn't have journaling enabled. Configuring a mailbox database to journal messages to a mailbox located on a non–Exchange 2003 mailbox database isn't supported. If you locate a journaling mailbox in an Exchange 2003 mailbox database being journaled, excessive disk utilization can occur.

You can configure Exchange 2010 journal rules to deliver journal reports to either Exchange 2003 or Exchange 2010 mailboxes.

Distribution Group Expansion

Both Exchange 2003 and Exchange 2010 provide distribution groups. Distribution groups are mail-enabled groups that can contain any number of e-mail recipients. When a sender sends a message to a distribution group, the server takes the original message, accesses the distribution group membership, and sends the message to each recipient in the membership list. This process is known as distribution group expansion.

In both Exchange 2003 and Exchange 2010, you can specify which servers perform distribution group expansion. This is typically done to optimize server and network traffic load. By default, Exchange 2010 distribution groups are configured to use any Hub Transport server as a distribution group expansion server. Any Exchange server can act as a distribution group expansion server in Exchange 2003.

When you install Exchange 2010 into an existing Exchange 2003 organization and perform journaling in this mixed organization, we recommend that you configure all distribution groups to use Exchange 2010 Hub Transport servers as distribution group expansion servers. This is recommended because messages wouldn't be journaled, even if the recipients are configured for journaling, if the following conditions are true:

• Exchange 2010 recipients are configured for journaling.

• Exchange 2010 recipients are included in the distribution group Sales, for example.

• The Sales distribution group is configured to use an Exchange 2003 distribution list expansion server.

In this scenario, the following chain of events occurs if an Exchange 2010 sender sends a message to the Sales distribution group:

1. The message is sent to a Hub Transport server.

2. Because the Sales distribution group isn't configured to use a Hub Transport server as the distribution group expansion server, the journal rules in the Exchange 2010 organization can't access the distribution group recipients. Therefore, no journal rules can be applied to the recipients in the distribution group.

3. The message is routed to the Exchange 2003 server for expansion.

4. The Exchange 2003 server expands the distribution group. Because the Exchange 2003 server can't access the Exchange 2010 journal rule configuration, no messages are journaled.

5. The Exchange 2003 server routes the expanded messages back to the Exchange 2010 Hub Transport server for delivery to the Exchange 2010 recipients.

6. The Hub Transport server receives the message. Because this isn't the first server to route these messages, the Hub Transport server assumes the messages have already been evaluated for journaling and the journal rules aren't applied.

Return to top

 © 2010 Microsoft Corporation. All rights reserved.