Rule actions

The following actions can be applied to messages that match a rule filter:

ACTION="ARCHIVE_ITEM" - Archive the message. This is the default action if you do not include the ACTION= clause or a message does not match any of the rules.

With this action you can have additional actions: assigning a retention category (RETENTION="<retention_category>") to the item, sending the item to a specific archive (ARCHIVEID="<archive_ID>") and assigning a particular content category.

ACTION="MARK_DO_NOT_ARCHIVE" - Do not archive the message; leave it in the original location.

Note:

Messages marked as MARK_DO_NOT_ARCHIVE remain in the original location. If you are applying filtering to the journal mailbox, this action should only be used for a small number of messages, as leaving lots of messages may affect journaling performance.

If you later change the rule action, you can temporarily set the Override registry key to 1 to force the task to reprocess marked items. The Override key is described in the sections describing how to configure custom filtering registry settings for archiving tasks:

ACTION="MOVE_DELETED_ITEMS" - Do not archive the message; move it to the Deleted Items folder.

This action cannot be used with public folder filtering; if this action is configured, an error will be logged and the tasks will stop.

ACTION="HARD_DELETE" - Do not archive the message; delete it immediately without moving it to the Deleted Items folder. This action is not recommended for Exchange Server public folder filtering.

Note:

If the Compliance Accelerator Journaling Connector is being used to capture a required percentage of all Exchange Server journaled messages, do not configure a custom journal filter that deletes selected messages; this will compromise the accuracy of the Compliance Accelerator monitoring policy, because any deleted messages are not available for capture by the Journaling Connector.

The following actions can be applied to message attachments that match an attachment filter:

ATTACHMENT_ACTION="REMOVE" - If a file attached to a message matches the name or size specified in the attachment attribute filter, delete it.
ATTACHMENT_ACTION="REPLACE" - If a file attached to a message matches the name or size specified in the attachment attribute filter, replace it with a file called Deleted Attachments.txt, which lists the attachments that have been deleted.

If the message has nested messages with attachments, the action will be applied to all nested message attachments.

If the action applied to a message is "HARD_DELETE", no attempt is made to evaluate any files attached to the message.

The extract below shows how a rule name, message action and attachment action might be specified in the ruleset file. In this example, any messages that satisfy the message attribute filters will be archived in the default archive. Also, any Exchange Server messages attachments that match the attachment filter will be deleted and replaced with a file called Deleted Attachments.txt:

<RULE NAME="Archive Rule 1" ACTION="ARCHIVE_ITEM"
	ATTACHMENT_ACTION="REPLACE">
  <message attribute filters>
  <attachment attribute filter>
</RULE>