Cross Mailbox Search

Discuss your pilot or production implementation with other Zimbra admins or our engineers.
sheehanje
Posts: 5
Joined: Sat Sep 13, 2014 2:25 am

Cross Mailbox Search

Postby sheehanje » Thu Apr 13, 2017 2:18 pm

I've been tasked with a rather large eDiscovery. Normally we've been limited to single or limited mailbox searches, which have been rather easy - but we are now required to run a large query across all our mailboxed (close to 800). I am running into a few issues and if someone could help clear them up it would be greatly appreciated.

First off, we are running Zimbra Network Edition - verion 8.6. We've finally finished up a very long migration process from Exchange 2007. Some of our user mailboxes are now almost 20 years old, and we don't have a defined retention policy except for "keep everything" - as dictated by upper management and our attorneys - so some mailboxes are rather large, upwards of 30 to 40 gigs. We have an archive server, but it was implemented late in the migration process - and some of our users were already on Zimbra well before the archive went into effect, so our archive server has a good percentage of mailboxes that don't have all historical emails. Because of the requirement of this ediscovery we must search the production mailbox servers (we have 3) to make sure we get an accurate result.

My first question - is it possible to search all mailbox servers with the same search job, or do I need to run 3 jobs to cover each mailbox server?

Second, a few of the search terms are 3 letter acronyms. This poses a problem because of attached files that are stored in the message as binary, and those terms come up multiple times in the binary. So I'm getting a lot of unwanted email in some test runs I did with those terms. I think I could limit them greatly if I could either run a case sensitive search term, or be able to include whitespace in the term. Is it possible to do a search on "TST" as case sensitive, or include only results that have whitespace before or after the term?

Finally, I would really like to be able to allay some of this if we get tasked with it in the future. The best way would be to get historical mail on the Archive server. I have a couple questions there. Is there a way to make a copy of a users mailbox to the archive server within a date range? Also, is there a way to check for users that we may have missed setting up archive accounts for? Is there a way to either show just archive accounts, or just regular accounts?

Thanks in advance. I know it's a lot of questions in one post - but it's really a part of the implementation I would like to get full use out of as we may have some more audits coming up.


lytledd
Outstanding Member
Outstanding Member
Posts: 467
Joined: Sat Sep 13, 2014 12:54 am
ZCS/ZD Version: Release 8.7.11.GA.1854.UBUNTU14.64

Re: Cross Mailbox Search

Postby lytledd » Sun Apr 16, 2017 10:13 am

I've been tasked with a rather large eDiscovery. Normally we've been limited to single or limited mailbox searches, which have been rather easy - but we are now required to run a large query across all our mailboxed (close to 800). I am running into a few issues and if someone could help clear them up it would be greatly appreciated.


Been there, not fun.

First off, we are running Zimbra Network Edition - verion 8.6. We've finally finished up a very long migration process from Exchange 2007. Some of our user mailboxes are now almost 20 years old, and we don't have a defined retention policy except for "keep everything" - as dictated by upper management and our attorneys - so some mailboxes are rather large, upwards of 30 to 40 gigs. We have an archive server, but it was implemented late in the migration process - and some of our users were already on Zimbra well before the archive went into effect, so our archive server has a good percentage of mailboxes that don't have all historical emails. Because of the requirement of this ediscovery we must search the production mailbox servers (we have 3) to make sure we get an accurate result.


Since you are a Zimbra customer, I'd suggest opening a ticket with them on your questions, they are very responsive. You've mentioned 'archive server', would that be?

https://wiki.zimbra.com/wiki/ZAD

For the company that I work for, we purchased MailArchiva, it allows for syphoning off users mailboxes and receiving copies of email directly from Zimbra, and puts a query engine behind it.

Doug

Return to “Administrators”

Who is online

Users browsing this forum: No registered users and 14 guests