Excluding Exchange 2013 health messages from the journal mailbox

Description

In Exchange 2013, Microsoft introduced reliability monitoring features to ensure high availability. These features include processes that automatically generate and send mail, then verify its arrival. Unless specifically excluded, copies of the messages arrive in the journal mailboxes.

Example auto generated health messages:

Here are examples of the health messages in the journal mailbox. Three messages are generated for each mailbox database every five minutes.  

Recommendation for journaling:

Enterprise Vault archives these messages but they add little value and consume storage and CPU resources. We recommend that you exclude these items.

Example journal rule to exclude health messages:

If you have configured journaling using journal transport rules, you could declare a dynamic distribution group that defines the valid senders and recipients, then use the following Exchange journal rule:

New-DynamicDistributionGroup –Name MailboxesToJournal –Alias MailboxesToJournal
–RecipientFitler { CustomAttribute1 –eq ‘ValidForJournal’ }

New-JournalRule –Name JournalRule –JournalEmailAddress ‘JournalMailbox@yourdomain.local’
–Scope ‘global’ –Enabled $true –Recipient ‘MailboxesToJournal@yourdomain.local’

If you have configured journaling at the database level, we recommend that you apply an Enterprise Vault selective journal filter.

To do this, users must to be identified via membership to one or more distribution groups. Then you can create a journal configuration file that lists the distribution groups to which the users belong. The health mailboxes should not be included in any of these groups.

Here is an example selective journal configuration file (SelectiveJournal_Config.dat):

distlist:/o=First Organization/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Recipients/cn=e220fdc95a564edeb20ae68e29305e9d-Engineers
distlist:/o=First Organization/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Recipients/cn=e220fdc95a564edeb20ae68e29305e9d-Marketing
distlist:/o=First Organization/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Recipients/cn=e220fdc95a564edeb20ae68e29305e9d-Accounts

Items addressed to or from the recipients that are members of these distribution groups are archived. By default, the items that are not archived would be moved to the deleted items folder. Therefore, to save storage, an additional registry key is required to hard-delete the excluded items. Create a registry DWORD value called “HardDeleteItems” under the following registry key:

HKLM\Software\Wow6432Node\KVS\Enterprise Vault\Agents\SelectiveJournal

Set "HardDeleteItems" to 1.

Warning: Incorrect use of the Windows registry editor may prevent the operating system from functioning properly. Great care should be taken when making changes to a Windows registry. Registry modifications should only be carried-out by persons experienced in the use of the registry editor application. It is recommended that a complete backup of the registry and workstation be made prior to making any registry changes.

Further Information

For more information about configuring selective filtering see the section called “Configuring selective journaling” in Setting Up Exchange Server Archiving.

For more information about Exchange 2013 health monitoring, see the following page on the Microsoft website:

https://technet.microsoft.com/en-us/library/jj150551.aspx