SummaryOverview of missing emails scenarios
- GFI Archiver is build for resilience and doesn't lose emails, unless an Archiver UI setting explicitly drops/deletes emails or an environmental factor occurs.
CauseHere is a comprehensive list of case scenarios on why emails might not be archived.
- The journal mailbox never received a copy of the email. This can happen due to an Exchange fault or setting, such as when the journal mbox was not set for all Exchange databases; please double check this on the Exchange console > organization config > mailbox > select properties for each of the databases > to go maintenance tab, enable journal and add the GFI Archiver journal user
- Left over items in the journaling mailbox, where journaled items weren't pulled and they are sitting in the inbox.
- The email failed to be downloaded and Archiver moved the email from the inbox to a new folder called gfifailedmail (in this case, log in to owa and you should see if such a folder exists).
- An AV or backup solution interfered with the process and quarantined the items before they were processed. This can happen as follows:
- items in Pickup folder quarantined and we have no left over files, expect for unusable temp files under Core | MAIS directory; only the logs, which get overwritten in ~a few days, could tell if this happened;
- items in the Queue folder quarantined; since we "envelope" an email in into multiple parts, we should have a very high chance of finding left over files (medium change of being reprocessed).
- SQL connectivity. Emails failed to be archived to the SQL database; in this case, you would see pending archival of files in the Pickup and/or Queue folders under:
automatic archiving: ...\GFI\Archiver\Core\ | manual archiving: ...\GFI\Archiver\MAIS\
- An Anti-Spam or Malware solution quarantined the item when a copy was sent to the journal. An example with GFI MailEssentials would be when the email is whitelisted, but the copy to the journal isn't.
- Very rare: multiple domain controllers for the domain that Archiver is connected to. Sometimes, due to network issues, different DCs can return different results and if archiving restrictions are in place, the intended recipient might become "excluded", meaning that the email is dropped/deleted before archiving.
- Archive Restrictions were enabled and the email was not archived, because the respective users/owners were excluded as a licensed user. More information here: http://manuals.gfi.com/en/mar12admin/content/administrator/topics/configuration/mailboxarchiverestrictions.html
- Retention policy set to delete immediately < no record left behind, except logs
- Retention policy deleted an email after X days. When an email is archived, then removed by a retention rule, the SQL database will show in arc_delete the record
- From configuration, email deletion was enabled as "hard delete". A user/admin manually removed an email. If "soft delete" was enabled, then only the ownership is removed, but the email remains in the database (searchable by admins with full access).
Note: 10 and 11 can be checked on the auditing reports tab, only if auditing was enabled during that time.
- Different depending on recoverability
- Each of the causes should have a support case for a GFI technician to overview, confirm scenario and provide possible workarounds or recommendations.