A journal report is the message that Microsoft Exchange generates when a message matches a journal rule and is to be submitted to the journaling mailbox. The original message that matches the journal rule is included unaltered as an attachment to the journal report. This type of journal report is called an envelope journal report.

Note:
Exchange 2007 supports envelope journaling only.

The information that is contained in the journal report is organized so that every value in each header field has its own line in the journal report. This enables you to easily parse the reports manually or by using an automated process, depending on your requirements.

When the Journaling agent journals a message, the Journaling agent tries to capture as much detail as possible about the original message. This information is very important in determining the intent of the message, its recipients, and its senders. For example, whether the recipients that are identified on the message are directly addressed on the To field, the Cc field or are included as part of a distribution list may determine how the recipient is involved in the discussion in the message.

Depending on the situation, Exchange 2007 may generate more than one journal report for a single message. Whether a single message generates one journal report or multiple journal reports depends on several reasons, such as bifurcation or whether there are distribution groups that have been expanded.

Journal reports can contain very sensitive information and must be protected so that they can't be viewed by unauthorized individuals. For more information about how you can protect journal reports, see Protecting Journal Reports.

For more information about journaling and journal reports, see the following topics:

• Understanding How to Manage Journal Reports
  
  
• Overview of Journaling
  
  

The following sections describe each field that is contained within journal reports that are generated by Exchange 2007. These fields are separated into the basic fields and the extended fields that are shown in the following table.

Basic and extended journal report fields

Whether extended journal report fields are populated depends on the following circumstances:

• MAPI submission to a Hub Transport server   Recipient addressing can be determined when a message is submitted to a Hub Transport server that uses MAPI from a client such as Microsoft Office Outlook 2007 or Outlook on a mobile device.
  
  
• Authenticated SMTP submission to a Hub Transport server   Recipient addressing can also be determined when a message is submitted to a Hub Transport server by using authenticated Simple Mail Transfer Protocol (SMTP). The sender must not have Send-As-Anyone permissions as this indicates that the sender was a server.
  
  

If recipient addressing can be determined for a particular recipient, the recipient e-mail address is inserted into the appropriate extended To, Cc, or Bcc field, which are described in the "Extended journal report fields" table later in this topic. The recipient e-mail address is not inserted into the basic Recipient field, which is described in the "Basic journal report fields" table later in this topic.

If a message is submitted to a Hub Transport server by using any other method, such as anonymous submission from an Edge Transport server or submission from a server that is running Exchange Server 2003, Exchange cannot verify that the recipient addressing has not been tampered with. If recipient addressing cannot be verified, the recipient e-mail address is inserted in the basic Recipient field and not into an extended To, Cc, or Bcc field.

For each recipient addressed on a message, one recipient journal report field is added. No recipient field contains more than one recipient e-mail address, except as follows:

• Recipient fields that contain recipients that have been expanded from a distribution group
  
  
• Recipient fields that contain recipients that have received a message forwarded from another mailbox
  
  

For expanded or forwarded messages, the e-mail address of the recipient that received final delivery of the message and the e-mail address of the distribution group or mailbox that was originally addressed are included.

Basic Journal Report Fields

Extended Journal Report Fields

Expanded and Forwarded Fields

In Exchange 2003, the journaling of messages and the identification of journal reports are controlled by using the X-EXCH50 binary large object (BLOB). In Exchange 2007, the X-EXCH50 BLOB is deprecated and replaced with SMTP headers to which header firewall is applied. These SMTP headers can be accessed only by the Exchange 2007 transport components. They are removed from messages before delivery to mailboxes or delivery outside the Exchange 2007 organization. The X-MS-Exchange-Organization-Journal-Report SMTP header identifies an Exchange 2007 journal report. The X-MS-Exchange-Organization-Processed-By-Journaling SMTP header identifies messages that have been processed by the Exchange 2007 Journaling agent.

If the X-MS-Exchange-Organization-Journal-Report SMTP header is included on a message, Exchange 2007 knows the message is a journal report and allows the message to act a system message and bypass message size and mailbox recipient restrictions. If the X-MS-Exchange-Organization-Processed-By-Journaling SMTP header is included on a message, Exchange 2007 recognizes that the message has already been processed by the Journaling agent on a previous Hub Transport server and does not re-journal the message. 

Note:
Because the X-MS-Exchange-Organization-Journal-Report SMTP header is removed by the header firewall when the journal report is delivered to a journal mailbox, the X-MS-Journal-Report SMTP header is added to the journal report. The X-MS-Journal-Report SMTP header lets you differentiate a journal report from a regular message but is not used by any Exchange 2007 transport components.

The X-MS-Exchange-Organization-Journal-Report SMTP header, X-MS-Exchange-Organization-Processed-By-Journaling SMTP header, and X-MS-Journal-Report SMTP header do not contain values. The existence of these SMTP headers on a message as described above determines whether the message is a journal report or has been processed by journaling.

For more information, see the following topics:

• SMTP header firewall   Understanding Header Firewall.
  
  
• Exchange 2003 and Exchange 2007 interoperability   Understanding Journaling in a Mixed Exchange 2003 and Exchange 2007 Environment
  
  

The first figure in this section shows an example of a journal report that was generated when a message was sent from an Exchange 2007 mailbox to a Hub Transport server. The recipients of the original message were addressed as follows:

• The To field contains the Sales Group distribution group. The following are the four members of the Sales Group distribution group: Brian Smith, David Simpson, Maria Cameron, and Ray Chow.
  
  
• The Cc field contains the recipient Christine Hughes. The mailbox for Christine Hughes is configured to automatically forward messages to the mailbox for Katie Jordan.
  
  
• The Bcc field contains the recipient Blaine Dockter.
  
  

In Exchange 2000, three journal reports were created when the original message was sent. The journal report shown in the following figure lists only the recipients expanded from the Sales Group distribution group.

Note:
In Exchange 2007 SP1, only a single journal report is generated.

In Exchange 2007, two additional journal reports were generated from the previous example message. The journal reports for the Cc and Bcc recipients are identical to the preceding figure, except instead of the To journal report fields, the following fields are present in each journal report respectively: 

• Cc: katie@adatum.com, Forwarded: christine@adatum.com
  
  
• Bcc: blaine@adatum.com
  
  

The following figure shows an example of a journal report that was generated when a message that originated from the Internet was processed by a Hub Transport server. The recipients in this message were addressed the same as the recipients in the previous example. However, in the journal report in this figure, the recipients are put in the Recipient field because the original message was sent from the Internet. Because the message originated from the Internet, Exchange cannot verify that the recipient addressing has not been tampered with. As with the first example, three journal reports were created for the single message. The following figure shows only the recipients that were expanded from the Sales Group distribution list.

Note:
In Exchange 2007 SP1, only a single journal report is generated.

In Exchange 2007, two additional journal reports were generated from the second example message. The journal reports for the Cc and Bcc recipients are identical to the "Journal report that displays basic recipient fields" figure, except each journal report contains the remaining recipients addressed in the second example message:

• Recipient: katie@adatum.com, Forwarded: christine@adatum.com
  
  
• Recipient: blaine@adatum.com
  
  

To ensure that you are reading the most up-to-date information and to find additional Exchange Server 2007 documentation, visit the Exchange Server TechCenter.

---

© 2008 Microsoft Corporation. All rights reserved. Legal Information

---

• Перевести на английский

Journal report that displays basic recipient fields

Journal report that displays extended recipient fields