Search <book_title>...

Enterprise Vault™ Setting up Exchange Server Archiving

Last Published: 2020-11-13

Product(s): Enterprise Vault (14.0)

Attachment attribute filters for custom filtering

To enable you to delete certain attachments before archiving messages, a rule can contain attachment attribute filters which define which attachment files to select.

The following example XML shows how you can include one or more attachment attribute filters in a rule:

<RULE NAME="rule_name" ... ATTACHMENT_ACTION="action">

   [<message_attribute>... </message_attribute>]

   <FILES INCLUDES="ANY|ALL|NONE">
       <FILE FILENAME="filename" SIZE_GREATER_THAN_KB="integer" />
       <FILE ... />
       ...
   </FILES>

   <FILES INCLUDES="ANY|ALL|NONE">
       <FILE ... />
       ...
   </FILES>

</RULE>

The <FILES> tag defines an attachment filter.

If you specify an attachment action (ATTACHMENT_ACTION=), then you need to include at least one attachment filter (using the <FILES> tag). For an attachment to match a rule (and the attachment action applied), the attachment must satisfy all attachment filters specified in the rule. The order of attachment filters in a rule is not significant.

The INCLUDES= operator enables you to define how the following attribute lines are to be applied, when evaluating each attachment.

An attachment filter contains one or more <FILE> elements, that define the attributes to match. Each <FILE> element contains one or both of the following attributes:

FILENAME="filename"
<filename> is all or part of the file name to match. Wildcards can be included in the file name. You can use this attribute to filter files with specific text strings in the name or extension, for example, "*.AVI".
When selecting files using the file extension, custom filtering only evaluates the file name; it does not check the type of the file contents. If files that would normally be deleted by a filter are given a different extension, they will not be deleted by the filter.
Also, files contained in compressed files, such as .ZIP files, are not evaluated.
SIZE_GREATER_THAN_KB="integer"
This enables you to configure the filter to remove attachments over a certain size.

Where file name and size are specified in a <FILE> element, both must be satisfied for an attachment to match. For example, if an attachment is to match the following line, it must have an extension of .MP3 and be larger than 1 MB:

<FILE FILENAME="*.MP3" SIZE_GREATER_THAN_KB="1000" />

If you specify multiple <FILE> elements to use in evaluating attachment files, each one will be applied. For an attachment to match the rule, it must match each <FILE> element.

To define how the <FILE> lines are to be applied, when evaluating each attachment, use the INCLUDES= operator:

INCLUDES="ANY" means that the attachment matches if it has the attributes specified in at least one of the <FILE> lines. This is the default action if the operator is not specified.
INCLUDES="ALL" means that the attachment matches only if it has the attributes specified in all the <FILE> lines.
INCLUDES="NONE" means that the attachment matches if it does not include any of the attributes specified in the <FILE> lines.

In the following example, an attachment will match the filter if all the following are true:

The file is an MP3 file larger than 2MB
The file name includes the text, "enlarge", and the file is larger than 1 MB
The file has the extension, MPG
The file is larger than 12 MB

<FILES INCLUDES="ANY">
  <FILE FILENAME="*.MP3" SIZE_GREATER_THAN_KB="2000" />
  <FILE FILENAME="*enlarge*.*" SIZE_GREATER_THAN_KB="1000" />
  <FILE FILENAME="*.MPG" />
  <FILE SIZE_GREATER_THAN_KB="12000" />
</FILES>

The following example shows how multiple attachment filters can be used to exclude certain attachments from deletion:

<RULE NAME="Filter attachments rule" ... ATTACHMENT_ACTION="REMOVE">

   [<message_attribute>... </message_attribute>]

   <FILES INCLUDES="NONE">
       <FILE FILENAME="signature.jpg" />
   </FILES>

   <FILES INCLUDES="ANY">
       <FILE SIZE_GREATER_THAN_KB="5000" />
   </FILES>

</RULE>

With these attachment filters, attachments will be deleted if they do not have the filename, signature.jpg, and are larger than 5 MB.