Skip navigation
McAfee Secure sites help keep you safe from identity theft, credit card fraud, spyware, spam, viruses and online scams
8588 Views 3 Replies Latest reply: Jun 26, 2013 1:53 PM by iknowgod RSS
iknowgod Newcomer 3 posts since
Jun 24, 2013
Currently Being Moderated

Jun 24, 2013 10:59 AM

SaaS Email Archive System Alert

Our company utilizes the McAfee email archiving system. The system works by haveing all mail we want archived journeled in exchange 2010 into a journal mailbox then have the SAAS solution pick up mail from that mailbox through IMAP.

 

The solution works and several thousand emails are picked up and archived every day through the solution. However every day or every other day at least one alert comes to us admins saying that there was an unrecognized message format and that there is something wrong with our exchange server... Where should i even start to look for this because i dont feel like there is something wrong with the exchange server..

 

======================================================

Subject: SaaS Email Archive SystemAlert

Thisalert was generated by your SaaS Email Archiving service:

 

The mail source "mcarchive-external" is configured to ingest messagesin (unknown) format but encountered 1 message(s)
that are not a recognizable journal format and so were ingested as a genericemail message.
This usually occurs as a result of a misconfiguration of your Exchange Serverresulting in non-journal messages ending up in the journal mailbox.
Please review the SaaS Email Archiving setup documentation to make sure thatnon-journal messages cannot end up on the journal mailbox.

 

To help you troubleshoot, you can view some of the improperly formattedmessages by signing into
the SaaS Email Archiving Control Console and performing an "Archive IDSearch" for any of these Archive IDs:

 

   xxxx

 

Alert ID: 53179302

=====================================================

  • Brad McGarr McAfee Employee 154 posts since
    Dec 4, 2012
    Currently Being Moderated
    1. Jun 24, 2013 11:17 AM (in response to iknowgod)
    Re: SaaS Email Archive System Alert

    Greetings iknowgod,

     

    Being that you're only receiving the occational messages, you shouldn't be too concerned. This alert is sent out any time the Archiving system encounteres an message that is not in the format it is designated to ingest. For example, if the Archive mail source is set to look for Exchange 2007 journaled mail, and a message is in the mailbox that is not in that journal-format, it will be ingested as Generic and an alert will be issued. Take a look at the message ID's it is alerting on to see if you notice any patterns, such as calendar invites or messages to a specific sender or user.

     

    Generally though, this alert will trigger if the following settings are not properly configured (see your server documentation for details):

     

    - The journal mailbox is not configured to not receive any email directly, i.e. messages are being delivered directly to the mailbox and are not being journaled by Exchange.

    - A server administrator is manually moving messages into the Journal Mailbox, which prevents them from being journaled.

    - Some message types, such as Outlook Calendar Invites or Invite Replies are being ingested. Although these are sent over email, they are not the same as an email message and are not formatted the same.

     

    I'd recommend starting there, along with checking for patterns in the messages causing alerts.


    Brad McGarr
    McAfee SaaS Email & Web Protection
    Technical Support Technician I (Legacy & Partner Support)
    Microsoft Certified Professional
    Microsoft Technology Associate - Windows OS | CompTIA A+ Certified Technician | CIW Web Foundations Associate
    Visit my blog: Brad's Corner - Insights from SaaS Email & Web Security Support https://community.mcafee.com/blogs/brad-denver

    Frequently Requested Information

More Like This

  • Retrieving data ...

Bookmarked By (0)

Legend

  • Correct Answers - 5 points
  • Helpful Answers - 3 points