This post covers over using SMTP Journaling vs Mailbox backup support to get copies of messages into Commvault.
Mailbox Backups
The Exchange Mailbox backups agent provides item level backup and recovery on all items (visible and hidden) in a mailbox. It also supports restoring items back to a mailbox (same or different one), to PSTs, or to MSG files.
With mailbox backups, the full lifecycle of a message is tracked as is the complete mailbox structure\folders. So when the message was received, read, moved to a folder, deleted, and then purged (hard deleted) are all covered. In addition, the mailbox folder structure and non-emailed items like calendar, task, contacts, and others that are stored in a mailbox are also protected and discoverable.
The mailbox items then can be accessed by IT for restoration, deletion, or exporting. By end-users via an end-user focused web console, an optional plug-in to Outlook, or via IMAP. Furthermore, with Commvault's optional Activate add-on, full eDiscovery, sensitive data governance, and legal\retention hold are full supported.
- Exchange Mailbox Agent (Expert doc link)
- Journaling is also NOT needed to protect against "hard deleted" items by users or policy since these items are kept in a hidden folder by default for 14 days
- Since v11 SP9, the Exchange Mailbox agent has supported backing up these items in the "Recoverable Items" folder (Expert doc link) by enabling the policy to backup the Recoverable Items folder
- Microsoft docs on how hard deleted items are kept for 14 days by default: Recoverable Items folder in Exchange Online
So in my option, mailbox backup provides the best support for IT, help desk staff, end-users, and compliance\eDiscovery teams.
Mailbox backup does require Access Nodes\Proxy server and backup jobs to run to collect data. The backup jobs are normally scheduled once a day at most clients, but can be scheduled to run more often, or on-demand to get the latest mailbox data for a users, a group of users, or all users.
Journaling
Another method for meeting legal and compliance needs is via SMTP journaling. Commvault primarily supports and recommend this via our ContentStore Mail Server (CSMS) role. This role provides an SMTP server\listener that is the target for an email system’s journaling rules. All emails sent to Commvault via this method are protected and available for item level recovery. Optionally and in most cases, Commvault Activate is also purchased to provide full eDiscovery, sensitive data governance, and legal\retention hold are support on these email items.
We also support legacy Exchange Journal mailbox based journaling, where messages are sent to mailboxes in Exchange, and then Commvault Mailbox Journal agent connects to them to ingest and disposes of message in them. But we do not recommend this method of journaling anymore, since it involved more moving parts (Exchange journal mailboxes and mailbox backups jobs) without providing any benefits. Furthermore, this method increases the load and storage requirements on Exchange. Before we added the CSMS role this was the only way we supported journaling, but should not be recommended anymore and current customers should be moved off of it to the CSMS support, which just requires minor changes to Exchange journaling rules.
Journaling only provides a copy of the message as it was initially transmitted. Therefore, there is no visibility of what a user did with a message after it was received, including no folder information, so we can't restore messages back to folders or folder structure with journaling, nor do we know when a user deleted a message. Furthermore, journaling doesn't not capture non-email items, that are local only to the user's mailbox, like user only Calendar items, Task, Contacts, Drafts and more. Finally, journaling only gets new messages from the time it is enabled.
Documentation on ContentStore Mailbox Server role
- Overview: Exchange Mailbox ContentStore Mailbox
- Architecture: Architecture: ContentStore Mailbox (SMTP Journal Solution) (Expert doc link)
- Comparing Exchange journal mailbox support to Commvault ContentStore Mailbox (Expert doc link)
The setup of CSMS does not require an Access Node\Proxy server, since Exchange transport\journaling rules are configured to send messages, via SMTP, directly to the Commvault server(s) running the CSMS role. The messages are received and placed into a temporary folder and ingested and indexed by Commvault by default every 15 minutes.
The journaling support is primary designed for compliance\eDiscovery requirements only. While messages can be recovered to mailboxes, this requires that mailbox backups support is configured since an Access Node is required to put messages back into mailboxes, and message can be viewed by end-users there is no folder structure available so all messages only show up as in the "Inbox." Furthermore, for most clients they want to get all existing mailbox data also and this requires they do at least one mailbox backups, thus need Access Node(s) and permissions setup. Otherwise, only messages from the time journaling is enabled to Commvault will show up. So if if mailbox backup support is already setup to get a copy of existing data it makes sense to just keep using it to backup new mailbox data also.
There are few uses cases where doing journaling only makes sense, mainly a customer wants just basics email search/eDiscovery/compliance support without IT restore and end-user access and they don't want to setup Access Nodes, or at least keep them. It also takes less resources since with journaling a single copy of a message is delivered, vs a copy in every mailbox that received it. Therefore, with journaling less servers (Access Nodes) and storage is needed since few messages are stored by Commvault. Or to protect against the scenario where mailbox backup jobs are not running, within the 14 day period that Recoverable Items folders retains them.
Another cases where journaling might make sense, is when they need to keep emails for a very long period of time for compliance reasons only, like 15, 20 or 100 years. In this case BOTH mailbox backup (for IT, end-users, full mailbox search support, and more) can be used with CSMS role for journaling keeping messages much longer than the mailbox backup copies. Also with journaling LESS emails need to be ingested in the case where emails are sent to large distribution list, in this case one email would be ingested vs one copy from each mailbox that the message is sent to. So journaling can required less space than mailbox backup data. For Exchange, our deduplication support only applies to attachments by default, since most messages are smaller than the default dedupe block size.
A final case and maybe the most important for some organizations, is distribution list membership expansion. When Exchange sends an email to a distribution list that is targeted for journaling, the journal "envelop" message will contain a list of all members of that distribution list at the time the email was sent.
