Search <book_title>...

Enterprise Vault™ Setting up Exchange Server Archiving

Last Published: 2018-03-29

Product(s): Enterprise Vault (12.3)

How message and attachment filters are applied for custom filtering

This section describes the order in which message and attachment evaluation is applied when filtering Exchange Server messages.

When custom filters processes messages, the following general points are observed:

Messages and attachments are evaluated separately. Messages are evaluated first against rules in the ruleset file, and then attachments are evaluated against any rules that contain an attachment action.
If an attachment is a message, the message is evaluated using message filters in rules (with attachment action set) and then any attachments to the nested message are evaluated using attachment filters in rules.
When evaluating a message, only the first rule in the ruleset file that matches the message is applied. Similarly, when evaluating attachments, only the first rule that matches is applied to the attachment. For this reason the order of rules in a ruleset file is significant.
The rule action (and attachment action) are only applied to a message (or attachment) that satisfies all the filters in the rule.
The default action for both messages and attachments is to archive the item. This means that messages and attachments that do not match any rules will be archived.

Figure: Processing attachments shows how custom filtering processes a message with attachments.

Figure: Processing attachments

The message illustrated has a nested message attached and that message has a file attached. The simple ruleset file has two rules that contain message filters and one rule that contains attachment filters, as follows:

The top-level message is evaluated using the first message rule, rule1.
If that rule does match, then the rule ACTION is applied to the message. If the rule does not match, then rule2 is tried.
(If the message ACTION is HARD_DELETE", no further evaluation is done.) As there is a rule with ATTACHMENT_ACTION, and the message has an attachment, the message attachment is evaluated using the attachment filters in rule3.
Custom filters recognizes that the attachment is a message, so the message is evaluated against message filters in any rules with ATTACHMENT_ACTION set. In this example, only rule3 has ATTACHMENT_ACTION set and it does not have any message filters, so the message will not match the rule. Items that do not match filter rules are archived (the default action).
The attachment to the nested message is then evaluated using the attachment filters in rule3. If the attachment matches the attachment filters then the ATTACHMENT_ACTION is applied to the attachment.

Message filters and attachment filters can be combined in a single rule to select attachments to particular messages.

Figure: Example message with attachments shows an example message to the recipient, Karen Little, that has an MP3 file attached and also a message attached (a nested message).

Figure: Example message with attachments

The message may also have attachments.

The following example ruleset file contains a single rule to be applied to this message. The overall effect of this rule is to delete certain attachments in Exchange Server messages to recipients other than Gill Smith or John Doe. Attachments in messages to Gill Smith or John Doe are not deleted. Attachments with the following attributes will be deleted:

MP3 attachments larger than 2 MB
JPG attachments larger than 1 MB
MPG files larger than 5 MB

<?xml version="1.0" encoding="UTF-8"?>
<RULE_SET xmlns="x-schema:ruleset schema.xdr">

<!--Disallowed attachment rule: This rule will delete the specified
attachments for all recipients except Gill Smith and John Doe.-->

<RULE NAME="Disallowed attachments (except directors)"
   ATTACHMENT_ACTION="REMOVE" >
  <RECIPIENTS INCLUDES="NONE" ALLOWOTHERS="N">
    <EA>Gill.Smith@example.com</EA>
    <EA>John.Doe@example.com</EA>
  </RECIPIENTS>
  <FILES INCLUDES="ANY">
    <FILE FILENAME="*.MP3" SIZE_GREATER_THAN_KB="2000" />
    <FILE FILENAME="*.JPG" SIZE_GREATER_THAN_KB="1000" />
    <FILE FILENAME="*.MPG" SIZE_GREATER_THAN_KB="5000" />
  </FILES>
</RULE>

Assuming the appropriate archiving task has custom filtering enabled, the filters in this ruleset will be applied to the example message, as follows:

First apply the message attribute filter (the <RECIPIENTS> element) to the top-level message.
The recipient is not Gill Smith or John Doe, so the message attribute filter matches.
As the message matches the rule, it will be archived (ACTION=).
Is there a rule that contains ATTACHMENT_ACTION? Yes. This means that any attachments to the message must be evaluated using <FILES> attachment filters.
Does the attachment file name and file size match any of the <FILE> attribute lines in the rule? Yes, the attached file matches the first <FILE> line. This means that the attachment matches the rule, so delete the attachment, as specified in the ATTACHMENT_ACTION.
Does the message have another attachment? Yes, there is an attached message. Custom filtering recognizes that the attachment is a message and evaluates the message using the message attribute filter (the <RECIPIENTS> element).
As the nested message is to John Doe, the <RECIPIENTS> filter is not satisfied. The message is therefore archived together with its attachments.