Each line of the rules file takes the following format:
keyword:value
Table: List of Selective Journaling keywords for rules describes the keywords and values that you can enter in the file.
Table: List of Selective Journaling keywords for rules
Note: |
You can view the legacyExchangeDN property using ADSIEdit.msc or a similar Active Directory tool. |
Employees and resources in an organization may have several SMTP addresses in addition to an internal, Exchange Server address. If you want to capture all email to a recipient in your organization use either the recip or distlist keyword with the address specified using the legacyExchangeDN. For example:
recip:/o=acme/ou=first administrative group/cn=recipients/cn=John Doe
Alternatively, specify a distribution list that the recipient is a member of. For example,
distlist:/o=acme/ou=first administrative group/cn=recipients/cn=Sales
Using the recip or distlist keyword will capture email to any of the recipient's SMTP addresses and also internal email to their Exchange Server address. In this situation, the keywords, exact, starts, ends, and cont are not appropriate, as they may not capture external inbound email to all the addresses that the recipient may have.
You can use the keywords, exact, starts, ends, and cont to capture email to and from domains or SMTP addresses that are external to your organization. For example, you could use ends:acme.com to capture all communication to and from the external domain, acme.com.