Configuring custom filtering

Selective and group journaling provide very limited filtering capabilities and are only available with Exchange Server journal mailbox archiving; the same filtering is applied to all journal mailboxes serviced by the Exchange Journaling tasks configured on the Enterprise Vault server computer. Custom filtering provides more sophisticated filtering for all types of Exchange Server archiving (user and journal mailbox and public folder). For example, you may want items with a particular subject, sender or recipients to be sent to a separate archive, or you may want messages sent within the company to be given a special retention category of "Internal".

You can set up default filters that apply to all archiving tasks that are enabled for custom filtering. In addition, you can create separate custom filters for public folder archiving, or specific user or journal mailboxes.

If custom properties have been added to items, you may want these properties indexed for selected items.

Instructions are provided on how to extend custom filtering to use the custom properties feature.

See About configuring custom properties.

To implement custom filtering

Enable custom filtering for the required archiving tasks by configuring registry settings.

See Configuring registry settings for Exchange Server journal filtering.

See Configuring registry settings for Exchange Server user mailbox filtering.

See Configuring registry settings for Exchange Server public folder filtering.
Create filter rules and actions. These are held in one or more XML ruleset files, which must be placed in the folder, Enterprise Vault\Custom Filter Rules.
Restart the archiving tasks that have custom filtering enabled.

The following message is sent to the Enterprise Vault event log when the Exchange Server archiving tasks start:
```
EventID = 45329
Description = External Filter 'EnterpriseVault.CustomFilter'
initialising...
```
The following message is sent to the Enterprise Vault event log when the Exchange Server archiving tasks stop:
```
EventID = 45330
Description = External Filter 'EnterpriseVault.CustomFilter'
stopped.
```