Applies to: Exchange Server 2010 SP3, Exchange Server 2010 SP2
Topic Last Modified: 2010-01-20
When planning for journaling in a mixed Microsoft Exchange Server 2010 and Exchange Server 2003 environment, it's important to understand how they interoperate.
 Note: |
|---|
| For journaling interoperability, Exchange 2003, Exchange 2010, and Exchange Server 2007 have similar characteristics. |
To learn more about journaling, see Understanding Journaling.
Looking for management tasks related to managing journaling? See Managing Journaling.
Contents
How Exchange 2003 and Exchange 2010 Identify Journal Reports and Journaled Messages
Exchange 2003 and Exchange 2010 Journaling Interoperability
Journaling in Exchange 2003
The journaling feature in Exchange 2003 allows you to journal all the mailboxes on a mailbox database. If you want to journal only some mailboxes in a mailbox database, you have to do either of the following:
- Journal all the mailboxes in that mailbox database.
- Create a new mailbox database, enable journaling on that
mailbox database, and then move the mailboxes to be journaled to
the new database.
Exchange 2003 doesn't let you centrally manage its journaling capabilities. You have to manage journaling on a per-mailbox store and per-Mailbox server basis.
By default, when a message is journaled in Exchange 2003, only the original message is delivered to the journaling mailbox. To journal the envelope information of the original message, you must manually enable envelope journaling. Even with envelope journaling enabled, only basic subject and recipient information is captured.
Journaling in Exchange 2010
The journaling feature in Exchange 2010 has been significantly redesigned to enable more control over what recipients and senders you journal. In Exchange 2010, you can create journal rules to target specific recipients and senders, distribution groups, or a combination of both. It doesn't matter where the recipients or senders are located.
Using journal rules, the granularity of journaling is improved so that you can selectively journal one or more recipients. You can also locate mailboxes that you want to journal on a mailbox database that may also contain mailboxes you don't want to journal. Only the messages that are sent from or to senders and recipients for which you've created journal rules are journaled.
In addition, you manage journal rules centrally on Hub Transport servers. Journal rules are stored in Active Directory. Journal rules created on a Hub Transport server are automatically replicated throughout the Active Directory forest and become available to all Hub Transport servers. This means that all Hub Transport servers in your organization use the same journaling configuration.
In Exchange 2010, you can still journal messages on a per-mailbox database basis. This configuration is equivalent to the Exchange 2003 per-mailbox database configuration where all messages sent to or from mailboxes on a journaled mailbox database are journaled.
Exchange 2010 uses envelope journaling and provides much more information in the journal envelopes to help you sift through the potentially large amount of data that can be collected when mailboxes are journaled. The journal envelopes are formatted to enable automated searching of journal report contents by third-party or custom applications.
For more information about journal reports in Exchange 2010, see Understanding Journal Reports.
How Exchange 2003 and Exchange 2010 Identify Journal Reports and Journaled Messages
In Exchange 2003, the journaling of messages and the
identification of journal reports are controlled by using the
X-EXCH50 binary large object (BLOB). The
X-EXCH50 BLOB contains extended information about the
message that can't be stored elsewhere in the e-mail message. The
information stored in the X-EXCH50 BLOB contains a
variety of information, such as journaling, spam confidence level
(SCL), and other MAPI properties that don't have MIME
representation.
By examining the X-EXCH50 BLOB, Exchange
2003 can determine whether a message is a journal report and
therefore bypasses various system limits, such as message size and
mailbox recipient restrictions. Exchange 2003 also uses the
X-EXCH50 BLOB to determine whether a message has
already been journaled on a previous hop on another Exchange 2003
server. This prevents other Exchange 2003 servers that may handle
the message from journaling it again. However, the limitation of
the X-EXCH50 BLOB is that it's a proprietary Extended
Simple Mail Transfer Protocol (ESMTP) verb. As such, it can't be
propagated by computers that don't have Exchange installed.
In Exchange 2010, the X-EXCH50 BLOB is
deprecated and replaced with SMTP headers to which the header
firewall is applied. These SMTP headers can be accessed only by the
Exchange 2010 transport components. They are removed from messages
before delivery to mailboxes or delivery outside the Exchange 2010
organization. The following SMTP headers are used by the Exchange
2010 Journaling agent:
-
X-MS-Exchange-Organization-Processed-By-Journaling This
SMTP header identifies messages that have been processed by the
Exchange 2010 Journaling agent. If this header is included in a
message, Exchange 2010 recognizes that the message has already been
processed by the Journaling agent on a previous hop by another Hub
Transport server and doesn't journal the message again.
-
X-MS-Exchange-Organization-Journal-Report This
SMTP header identifies an Exchange 2010 journal report in the
transport pipeline. If this header is included in a message,
Exchange 2010 knows the message is a journal report. It allows the
message to act as a system message and bypass message size and
mailbox recipient restrictions.
- X-MS-Journal-Report Before delivering a
journal report to the journaling mailbox or an external journaling
recipient, the header firewall removes all Exchange Server
Organization headers, including the
X-MS-Exchange-Organization-Journal-Reportheader. Instead, theX-MS-Journal-Reportheader is added to identify it as an Exchange 2010 journal report after it has left the transport pipeline. This header isn't used by any Exchange 2010 transport components. It lets you differentiate a journal report from a regular message.
For more information about the SMTP header firewall, see Understanding Header Firewall.
Exchange 2003 and Exchange 2010 Journaling Interoperability
This section describes how journaling functionality works in a mixed Exchange environment.
Supporting Exchange 2003 Journaling in an Exchange 2010 Organization
Exchange 2003 and Exchange 2010 identify journal
reports and journaled messages differently. To support journaling
in a mixed Exchange 2003 and Exchange 2010 organization, Exchange
2010 supports using the X-EXCH50 BLOB. However,
Exchange 2003 doesn't support or recognize the new SMTP headers
that are used by Exchange 2010.
When Exchange 2010 journals a message, it adds a
property to the X-EXCH50 BLOB in addition to the
X-MS-Exchange-Organization-Processed-By-Journaling
SMTP header so that Exchange 2003 servers that encounter the
message know that the message has already been journaled.
Exchange 2010 treats journal reports similarly. When a
journal report is created in Exchange 2010, the
X-EXCH50 BLOB is added to the message in addition to
the X-MS-Journal-Report header. This enables the
journal report to travel through the Exchange organization and to
be treated as a journal report by all the Exchange servers that it
encounters.
Exchange 2010 also reads the Exchange 2003 journaling configuration from Active Directory. This configuration tells the Exchange 2010 Hub Transport servers which Exchange 2003 mailbox databases have journaling enabled and also which journaling mailboxes they have sent the journal reports to. When a message is sent to a recipient on a journaled Exchange 2003 mailbox database from Exchange 2010, the Exchange 2010 Hub Transport server journals the message and sends a journal report to the journaling mailbox configured on the Exchange 2003 mailbox database.
For more information about journal reports in Exchange 2010, see Understanding Journal Reports.
Configuring Routing Group Connectors Between Exchange 2003 and Exchange 2007
When you install a Hub Transport server in an Exchange 2003 organization, Exchange 2010 automatically creates the routing group Exchange Routing Group (DWBGZMFD01QNBJR). This routing group contains all the computers in the organization that are running Exchange 2010. All Exchange 2010 servers are members of this routing group. Exchange 2010 configures a routing group connector to connect the Exchange 2010 routing group to an existing Exchange 2003 routing group.
The routing group connector created by Exchange 2010 is
configured to enable the X-EXCH50 BLOB to pass between
Exchange 2010 servers and Exchange 2003 servers. If you create
additional routing group connectors between the Exchange 2010
routing group and other Exchange 2003 routing groups, the
connectors are also configured to enable the X-EXCH50
BLOB to pass between Exchange 2010 servers and Exchange 2003
servers.
 Important: |
|---|
| You must use the New-RoutingGroupConnector cmdlet to create routing group connectors between Exchange 2010 servers and Exchange 2003 servers. The New-RoutingGroupConnector cmdlet configures the required permissions and defaults to enable communication between Exchange 2010 and Exchange 2003. For more information, see New-RoutingGroupConnector. |
For more information about routing group connectors, see the following topics:
Reducing Multiple Journal Reports
In a native Exchange 2010 organization, when a message passes through Hub Transport servers, the message is evaluated by the Journaling agent. Unless the recipient list changes on that message before delivery, the Journaling agents on later Hub Transport servers don't reevaluate the message. Because the message is evaluated for journaling only on one Hub Transport server, only one journal report is typically created and sent to the journaling mailbox.
When messages are journaled in a mixed Exchange 2003 and Exchange 2010 organization, the possibility of creating multiple journal reports for a single message increases. This is because both an Exchange 2010 Hub Transport server and the Exchange 2003 server that receive or send the message from or to a Hub Transport server evaluate the message for journaling.
Exchange 2010 reduces multiple journal reports that are
generated for a single message by supporting the
X-EXCH50 BLOB. The Exchange 2010 Hub Transport server
stamps the X-EXCH50 BLOB on the original message with
the address of the journaling mailbox where the journal report was
sent. When an Exchange 2003 server receives the message from the
Exchange 2010 Hub Transport server, the Exchange 2003 server
examines the X-EXCH50 BLOB to see whether the message
has been journaled. If it has been journaled, and if the journal
report was sent to the same journaling mailbox configured on the
mailbox store where the mailbox resides, Exchange 2003 doesn't
generate another journal report.
| Note: |
|---|
Although Exchange 2010 supports the X-EXCH50 BLOB,
the Journaling agent doesn't read it when it evaluates a message
that was received from an Exchange 2003 server. If a message
matches an Exchange 2010 journal rule, a journal report is created,
even if Exchange 2003 already journaled the message and sent a
journal report to the same journaling mailbox. |
Journaling Mailbox Location
If you want to journal mailboxes that reside on an Exchange 2003 mailbox database, the journaling mailbox must be located in an Exchange 2003 mailbox database that doesn't have journaling enabled. Configuring a mailbox database to journal messages to a mailbox located on a non–Exchange 2003 mailbox database isn't supported. If you locate a journaling mailbox in an Exchange 2003 mailbox database being journaled, excessive disk utilization can occur.
You can configure Exchange 2010 journal rules to deliver journal reports to either Exchange 2003 or Exchange 2010 mailboxes.
Distribution Group Expansion
Both Exchange 2003 and Exchange 2010 provide distribution groups. Distribution groups are mail-enabled groups that can contain any number of e-mail recipients. When a sender sends a message to a distribution group, the server takes the original message, accesses the distribution group membership, and sends the message to each recipient in the membership list. This process is known as distribution group expansion.
In both Exchange 2003 and Exchange 2010, you can specify which servers perform distribution group expansion. This is typically done to optimize server and network traffic load. By default, Exchange 2010 distribution groups are configured to use any Hub Transport server as a distribution group expansion server. Any Exchange server can act as a distribution group expansion server in Exchange 2003.
When you install Exchange 2010 into an existing Exchange 2003 organization and perform journaling in this mixed organization, we recommend that you configure all distribution groups to use Exchange 2010 Hub Transport servers as distribution group expansion servers. This is recommended because messages wouldn't be journaled, even if the recipients are configured for journaling, if the following conditions are true:
- Exchange 2010 recipients are configured for journaling.
- Exchange 2010 recipients are included in the distribution group
Sales, for example.
- The Sales distribution group is configured to use an Exchange
2003 distribution list expansion server.
In this scenario, the following chain of events occurs if an Exchange 2010 sender sends a message to the Sales distribution group:
- The message is sent to a Hub Transport server.
- Because the Sales distribution group isn't configured to use a
Hub Transport server as the distribution group expansion server,
the journal rules in the Exchange 2010 organization can't access
the distribution group recipients. Therefore, no journal rules can
be applied to the recipients in the distribution group.
- The message is routed to the Exchange 2003 server for
expansion.
- The Exchange 2003 server expands the distribution group.
Because the Exchange 2003 server can't access the Exchange 2010
journal rule configuration, no messages are journaled.
- The Exchange 2003 server routes the expanded messages back to
the Exchange 2010 Hub Transport server for delivery to the Exchange
2010 recipients.
- The Hub Transport server receives the message. Because this
isn't the first server to route these messages, the Hub Transport
server assumes the messages have already been evaluated for
journaling and the journal rules aren't applied.