What's the difference between Archive Sink and Journaling?

re: What's the difference between Archive Sink and Journaling?

David R. Hibbeln — Wed, 07 Jul 2004 11:41:00 GMT

Compliance requirements - The issue is much larger then just Sarbanes-Oxley and HIPPA.

The need of companies to be able to produce copies of e-mail when discovery happens in civil ligitgation is going to be more common place faster then most people think.

Several changes in the procedures followed in various jurisdictions have all ready happened and this trend will acclerate.

It is there responsiblity of the producing party (the one served with the discovery
motion) to supply the e-mails. This effects ANY business that has an e-mail server.

There is a need for the ablity to be able to index, search and produce all the e-mails sent with in an organization based on the terms of the discovery order issued by the judge.

This is NOT just a big company issue, it is all company with e-mail.

Hopefully the Exchange Team is having some discussion with the computer forensic's / electronic discovery community about these issues.

drh at hibbeln dot net

re: What's the difference between Archive Sink and Journaling?

Nick Wade — Mon, 12 Jul 2004 16:34:00 GMT

Great article Max, thank you. As David points out there are larger compliance considerations and we thank you for also pointing out your archiving partners who can assist in this space. Sidbar; there is an email forensics team internal to Microsoft somewhere and this group's opinion would be interesting.

Onto a question I have - ArchiveSink is particular to Exchange Servers in that it relies on Event Sink stuff from Exchange. Is there a way (and I haven't done any R&D, this just popped up at the right time) where an IIS SMTP Server can be made to drop a copy of all messages passing through to a disk queue for "archiving"? EML format would be suitable. Or perhaps another way of doing essentially what ArchiveSink does, but without Exchange involved? I'm thinking of SMTP gateway boxes where IIS alone is being used.

Cheers

re: What's the difference between Archive Sink and Journaling?

Nick Wade — Mon, 12 Jul 2004 16:43:00 GMT

Errr - okay, now I feel like a fool for posting that question, the first bit of google-fishing (bring on the new MSN Search!!) I did brought up an older blog (http://blogs.msdn.com/exchange/archive/2004/02/19/76432.aspx) from the Exchange team - which answers my question in a basic fashion at this point - but it does rely on the SMTP box being the endpoint for that email traffic. I'm also interested in mail passing through, rather than being at the end of it's travel... hence ArchiveSink-like functionality would be cool...I'm thinking the sink sample provided in the blog post I just referenced could be modded to do similar things?

Cheers

re: What's the difference between Archive Sink and Journaling?

David Barnes — Sat, 17 Jul 2004 01:04:00 GMT

This is good and very close, but I find outbound messages are not logged? have I missed something..
I find the messages 'pre SMTP format' in \Mapi-Gateway Messages, but this does not show what the server actually sent to the destination.

Personal view, but I find Exchange 5.5's protocol logging and archival better and far easier to trace and diagnose what came in/went out. Yes I know there could be inprovements, like logging the IP address and noting the message archive file in the protocol log and perhaps even having a copy of the protocol session data at the top and bottom of each message archive file.

The IIS protocol log is a mess (again personal view).. can we go back to one logfile per session. and can we have the ability to FULLY log everything INCLUDING the message in the protocol log, so things are consistent and very easy to diagnose.
Oh and while I'm asking can we see exposure of the DNS MX lookup, that was performed to find the destination server, in the protocol log.

The sinks are a very good idea and provide the ability to do lots of good stuff (like global footers etc) but for diagnostics and LEGAL purposes we do need to be able to see an exact log of what the server actually sent and recieved. with sinks you can't be certain that another sink existed after/before the archive one that modified the message..
My thoughts as a techie is that an archive journal would not stand up in court as I would not be able to prove/disprove the existance of any other sinks.
In the UK we don't worry so much about Sarbanes-Oxley and HIPPA. What we do wory about is e-mail is a legal comunication method and a copy of the message send must be just that a copy of what was sent/recieved over the wire. I've put exchange 2003 in for some firms of solicitors here and we still have to feed everything through an Exchange 5.5 server as the logging and journal is accepted PROOF, but I'm told that everyones still arguing about 2000+ [This could be totally wrong by now though].