Understanding Journaling in a Mixed Exchange 2003 and Exchange 2007 Environment
Microsoft Exchange Server 2007 will reach end of support on April 11, 2017. To stay supported, you will need to upgrade. For more information, see Resources to help you upgrade your Office 2007 servers and clients.
Applies to: Exchange Server 2007, Exchange Server 2007 SP1, Exchange Server 2007 SP2, Exchange Server 2007 SP3
This topic describes how the journaling features in Microsoft Exchange Server 2007 and Microsoft Exchange Server 2003 interoperate in a mixed Exchange environment.
For more information about journaling, see Overview of Journaling.
Journaling in Exchange 2003
The journaling feature in Exchange 2003 enables you to journal all the mailboxes on a particular mailbox database. If you want to journal only some mailboxes out of several hundred, you have to do either of the following:
Journal all the mail for all the mailboxes on that mailbox database.
Create a new mailbox store, enable journaling on that mailbox database, and then move the mailboxes to be journaled to the new database.
You have to manage journaling on a per-mailbox store, per-mailbox server basis if the following conditions are true:
You have several mailbox servers.
You want to journal messages to and from various groups of users or to and from the whole organization.
Exchange 2003 doesn't let you centrally manage its journaling capabilities.
By default, when a message is journaled in Exchange 2003, only the original message is journaled to the journaling mailbox. To journal the envelope information of the original message, you must manually enable envelope journaling. Even with envelope journaling enabled, only basic subject and recipient information is available.
Journaling in Exchange 2007
The journaling feature in Exchange 2007 has been significantly redesigned to enable more control over what recipients and senders you journal. In Exchange 2007, you can create journal rules to target specific recipients and senders, distribution groups, or a combination of both. It doesn't matter where the recipients or senders are.
Using journal rules, we've improved the specificity of journaling so that you can journal one or more recipients and senders in the mailbox database that also contains senders and recipients you don't want to journal. Only the messages that are sent from or to senders and recipients for which you have created journal rules are journaled. All other senders and recipients in the mailbox database are not journaled.
In addition, in Exchange 2007, you manage journal rules centrally on computers that have the Hub Transport server role installed. When you configure a journal rule on a single Hub Transport server, the journal rule is automatically replicated through the Active Directory directory service throughout the organization to all other Hub Transport servers. This means that all the Hub Transport servers in your organization use the same journaling configuration.
In Exchange 2007, you can still journal messages on a per-mailbox database basis. This configuration is equivalent to the Exchange 2003 per-mailbox database configuration where all messages sent to or from mailboxes on a journaled mailbox database are journaled. All the information in this topic is the same regardless of whether you use journal rules or per-mailbox database journaling in Exchange 2007.
Exchange 2007 uses envelope journaling and provides much more information in the journal envelopes to help you sift through the potentially large amount of data that can be collected when mailboxes are journaled. The journal envelopes are formatted to enable automated searching of the contents of the journal reports by using third-party or custom applications.
For more information about journal reports in Exchange 2007, see Understanding Journal Reports.
How Exchange 2003 and Exchange 2007 Identify Journal Reports and Journaled Messages
In Exchange 2003, the journaling of messages and the identification of journal reports are controlled by using the X-EXCH50 binary large object (BLOB). The X-EXCH50 BLOB contains extended information about the message that can't be stored elsewhere in the e-mail message. The information that is stored in the X-EXCH50 BLOB contains a variety of information, such as journaling, spam confidence level (SCL) and other MAPI properties that do not have MIME representation.
By examining the X-EXCH50 BLOB, Exchange 2003 can determine whether a message is a journal report and therefore bypass various system limits, such as message size and mailbox recipient restrictions. Exchange 2003 also uses the X-EXCH50 BLOB to determine whether a message has been journaled by a previous Exchange 2003 server and prevents later Exchange 2003 servers from journaling the message again. However, the limitation of the X-EXCH50 BLOB is that it is a proprietary extended simple mail transfer protocol (ESMTP) verb. As such, it cannot be propagated by computers that don't have Exchange Server installed.
In Exchange 2007, the X-EXCH50 BLOB is deprecated and replaced with Simple Mail Transfer Protocol (SMTP) headers to which header firewall is applied. These SMTP headers can be accessed only by the Exchange 2007 transport components. They are removed from messages before delivery to mailboxes or delivery outside the Exchange 2007 organization. The X-MS-Exchange-Organization-Journal-Report SMTP header identifies an Exchange 2007 journal report. The X-MS-Exchange-Organization-Processed-By-Journaling SMTP header identifies messages that have been processed by the Exchange 2007 Journaling agent.
If the X-MS-Exchange-Organization-Journal-Report SMTP header is included on a message, Exchange 2007 knows the message is a journal report and allows the message to act a system message and bypass message size and mailbox recipient restrictions. If the X-MS-Exchange-Organization-Processed-By-Journaling SMTP header is included on a message, Exchange 2007 recognizes that the message has already been processed by the Journaling agent on a previous Hub Transport server and does not re-journal the message.
Note
Because the X-MS-Exchange-Organization-Journal-Report SMTP header is removed by the header firewall when the journal report is delivered to a journal mailbox, the X-MS-Journal-Report SMTP header is added to the journal report. The X-MS-Journal-Report SMTP header lets you differentiate a journal report from a regular message but is not used by any Exchange 2007 transport components.
For more information about the SMTP header firewall, see Understanding Header Firewall.
Exchange 2003 and Exchange 2007 Journaling Interoperability
This section describes how journaling functionality works in a mixed Exchange environment.
Supporting Exchange 2003 Journaling in an Exchange 2007 Organization
As described earlier in this topic, Exchange 2003 and Exchange 2007 identify journal reports and journaled messages differently. To support journaling in a mixed Exchange 2003 and Exchange 2007 organization, Exchange 2007 uses the X-EXCH50 BLOB. However, Exchange 2003 does not support or recognize the new SMTP headers that are used by Exchange 2007.
When Exchange 2007 journals a message, it adds a property to the X-EXCH50 BLOB in addition to the X-MS-Exchange-Organization-Processed-By-Journaling SMTP header so that Exchange 2003 servers that encounter the message know that the message has already been journaled.
Exchange 2007 treats journal reports similarly. When a journal report is created in Exchange 2007, the X-EXCH50 BLOB is added to the message in addition to the X-MS-Journal-Report header. This enables the journal report to travel through the Exchange organization and to be treated as a journal report by all the Exchange servers that it encounters. We recommend that the target journal mailbox (where the journal reports are sent) is an Exchange 2003 mailbox when operating in mixed mode. In mixed mode, database-based journaling must be targeted to an Exchange 2003 mailbox. If the target journal mailbox is an Exchange 2007 mailbox, incomplete journal reports may result.
Exchange 2007 also reads the Exchange 2003 journaling configuration from Active Directory. This configuration tells the Exchange 2007 Hub Transport servers which Exchange 2003 mailbox databases have journaling enabled and also which journaling mailboxes they have sent the journal reports to. When a message is sent to a recipient on a journaled Exchange 2003 mailbox database from Exchange 2007, the Exchange 2007 Hub Transport server journals the message and sends a journal report to the journaling mailbox that is configured on the Exchange 2003 mailbox database. After the organization is completely migrated to Exchange 2007, the target journal mailbox can be an Exchange 2007 mailbox.
For more information about journal reports in Exchange 2007, see Understanding Journal Reports.
Configuring Routing Group Connectors Between Exchange 2003 and Exchange 2007
When you install a Hub Transport server into an Exchange 2003 organization, Exchange 2007 automatically creates a routing group that is named Exchange Routing Group (DWBGZMFD01QNBJR). This routing group contains all the computers in the organization that are running Exchange 2007. All Exchange 2007 servers are members of this routing group. Then, Exchange 2007 configures a routing group connector to connect the Exchange 2007 routing group to an existing Exchange 2003 routing group.
The routing group connector that is created by Exchange 2007 is configured to enable the X-EXCH50 BLOB to pass between Exchange 2007 servers and Exchange 2003 servers. If you create additional routing group connectors between the Exchange 2007 routing group and other Exchange 2003 routing groups, the routing group connectors are also configured to enable the X-EXCH50 BLOB to pass between Exchange 2007 servers and Exchange 2003 servers.
Important
You must use the New-RoutingGroupConnector cmdlet to create new routing group connectors between Exchange 2007 servers and Exchange 2003 servers. The New-RoutingGroupConnector cmdlet configures the required permissions and defaults to enable communication between Exchange 2007 and Exchange 2003. For more information, see New-RoutingGroupConnector.
For more information about routing group connectors, see the following topics:
Reducing Multiple Journal Reports
In a native Exchange 2007 organization, when a message passes through Hub Transport servers, the message is evaluated by the Journaling agent. Unless the recipient list changes on that message before delivery, the Journaling agents on later Hub Transport servers do not reevaluate the message. Because the message is evaluated for journaling only on one Hub Transport server, only one journal report is typically created and sent to the journaling mailbox.
When messages are journaled in a mixed Exchange 2003 and Exchange 2007 organization, the possibility of creating multiple journal reports for a single message increases. This is because both an Exchange 2007 Hub Transport server and the Exchange 2003 server that receive or send the message from or to a Hub Transport server evaluate the message for journaling.
Exchange 2007 reduces multiple journal reports that are generated for a single message by supporting the X-EXCH50 BLOB as discussed earlier in this topic. The Exchange 2007 Hub Transport server stamps the X-EXCH50 BLOB on the original message with the address of the journaling mailbox where the journal report was sent. When an Exchange 2003 server receives the message from the Exchange 2007 Hub Transport server, the Exchange 2003 server examines the X-EXCH50 BLOB to see whether the message has been journaled. If it has been journaled, and if the journal report was sent to the same journaling mailbox that is configured on the mailbox store where the mailbox resides, Exchange 2003 doesn't generate another journal report.
Note
Although Exchange 2007 supports the X-EXCH50 BLOB, the Journaling agent does not read it when it evaluates a message that was received from an Exchange 2003 server. If a message matches an Exchange 2007 journal rule, a journal report is created, even if Exchange 2003 already journaled the message and sent a journal report to the same journaling mailbox.
Journaling Mailbox Location
If you want to journal mailboxes that reside on an Exchange 2003 mailbox database, the journaling mailbox must be located in an Exchange 2003 mailbox database that does not have journaling enabled. Configuring a mailbox database to journal messages to a mailbox that is located on a non–Exchange 2003 mailbox database is not supported. If you locate a journaling mailbox in an Exchange 2003 mailbox database that is being journaled, excessive disk utilization can occur.
If you use per-mailbox database journaling in a mixed environment, the journaling mailbox should be located on an Exchange 2003 mailbox database.
You can configure Exchange 2007 journal rules to deliver journal reports to either Exchange 2003 or Exchange 2007 mailboxes.
Distribution Group Expansion
Both Exchange 2003 and Exchange 2007 provide distribution groups. Distribution groups are mail-enabled groups that can contain any number of e-mail recipients. When a sender sends a message to a distribution group, the server takes the original message, accesses the distribution group membership, and sends the message to each recipient in the membership list. This process is known as distribution group expansion.
In both Exchange 2003 and Exchange 2007, you can specify which servers perform distribution group expansion. By default, Exchange 2007 distribution groups are configured to use any Hub Transport server as a distribution group expansion server. By default, in Exchange 2003, any server can act as a distribution group expansion server.
However, you can configure distribution groups individually to use specific servers as distribution group expansion servers. This is typically done to optimize server and network traffic load.
When you install Exchange 2007 into an existing Exchange 2003 organization where an expansion server is used by distribution groups, and journaling is performed, configure all distribution groups to use Exchange 2007 Hub Transport servers as distribution group expansion servers. Messages are not journaled, even if the recipients are configured for journaling, if the following conditions are true:
Exchange 2007 recipients are configured for journaling.
Exchange 2007 recipients are included in a distribution group.
The distribution group is configured to use an Exchange 2003 distribution list expansion server.
For example, assume that the Sales distribution group includes Exchange 2007 recipients and that it is configured to use an Exchange 2003 distribution list expansion server. In this case, when an Exchange 2007 sender sends a message to the Sales distribution group, the following events occur:
The message is sent to a Hub Transport server.
Because the Sales distribution group is not configured to use a Hub Transport server as the distribution group expansion server, the journal rules in the Exchange 2007 organization cannot access the distribution group recipients. Therefore, no journal rules can be applied to the recipients in the distribution group.
The message is routed to the Exchange 2003 server for expansion.
The Exchange 2003 server expands the distribution group. Because the Exchange 2003 server cannot access the Exchange 2007 journal rule configuration, no messages are journaled.
The Exchange 2003 server routes the expanded messages back to the Exchange 2007 Hub Transport server for delivery to the Exchange 2007 recipients.
The Hub Transport receives the message. Because this is not the first server to route these messages, the Hub Transport server assumes the messages have already been evaluated for journaling and the journal rules are not applied.
For More Information
For more information, see the following topics: