Error Message

Event Type: Warning
Event Source: Enterprise Vault
Event Category: Journal Task
Event ID: 3375
User:  N/A
Computer: SERVER1
Description:
The following envelope message could not be archived as the attached message does not appear valid.

Title: MessageSubjectLine
Mailbox: /O=EXAMPLE/OU=EXCHANGE ADMINISTRATIVE GROUP (FYDIBOHF23SPDLT)/CN=RECIPIENTS/CN=EXCH_JOURNAL

No further attempts will be made to archive this message. The message has been moved to the 'Enterprise Vault Journaling Service\Invalid Journal Report' folder. 
V-437-3375

When the messages are viewed in Microsoft Outlook, the message will have more than one attachment.

Performing a DTRACE of the JournalTask, the following line will be found:

(JournalTask) <7268> EV:M IsEnvelopeMessage - Exiting Routine [IsEnvelope=True] [IsExchange2007=True] [0x00000000]
(JournalTask) <7268> EV:M OpenP2Message - Attachment count is not valid of an Envelope message Error Point [20] [0x80070057]
(JournalTask) <7268> EV:M CExchangeArchivableItem::SetEnvelopeState - Call to OpenP2Message failed [0x80070057]
(JournalTask) <7268> EV:M CArchivingAgent::ProcessItemInternal - Call to SetEnvelopeState Failed RetryCount[0] [0xC0040D2E]
(JournalTask) <7268> EV:M GetJournalPartProperty - Related Journal Part Property not found on message
(JournalTask) <7268> EV:M CExchangeShortcutAccessor::MoveFailedMessage - Routine Entry|
(JournalTask) <7268> EV:M GetJournalPartProperty - Related Journal Part Property not found on message
(JournalTask) <7268> EV:M CExchangeShortcutAccessor::MoveFailedMessage - Exit [0x00000000]|
(JournalTask) <7268> EV~W Event ID: 3375 The following envelope message could not be archived as the attached message does not appear valid. |Title: MessageSubjectLine |Mailbox: /O=EXAMPLE/OU=EXCHANGE

ADMINISTRATIVE GROUP (FYDIBOHF23SPDLT)/CN=RECIPIENTS/CN=EXCH_JOURNAL |No further attempts will be made to archive this message. The message has been moved to the 'Enterprise Vault Journaling Service\Invalid Journal Report' folder. |

Exchange Journaling is performed by taking the original message and placing it into an 'Envelope' message, with the original message as an attachment to the Envelope Message. Enterprise Vault (EV) will strip the Envelope and will read the original message (the attachment) to archive. When more (or less) than one attachment is present in the envelope message, EV will declare the envelope as not being valid and will move the item to the 'Invalid Journal Report' folder of the Journal mailbox.

This may be observed when 3rd party applications add yyyyyyyy.txt (file name varies) disclaimer attachments to journal messages that originate from a different Exchange Server, including Microsoft Business Online Productivity Suite (BPOS). The local Exchange server will read the internet header of the inbound message as a type 'X-MS-Journal-Report' and simply pass this on to the local Journal mailbox without re-enveloping the message.

Determine the cause of the additional attachments being added to the Journal envelope and correct. If a 'Disclaimer' message needs to be added to internal or external mail items, a rule may be created in Exchange to add this to your messages. To do this on Exchange 2007, open Exchange Management Console. Expand to the following: Organization Configuration > Hub Transport. In the Actions pane, select 'New Transport Rule'. Select your conditions and click 'next'. Select 'append disclaimer text using...' and create your disclaimer message.

Workaround

In the event that the root issue cannot be determined, AND the second attachment filename is always the same, the following workaround may be used. Since the issue is that the items are not recognized as a valid Journal Envelope, the items may be redirected to a non-journal mailbox and archived using the standard mailbox archiving task. To do this, perform the steps below:

1. Create a new user and mailbox to be used strictly for this workaround. It is suggested to name this including a Journal identifier of some type (e.g. 'Journal Alternate')
2. Follow 100019803 to create the proper EV policies, but matching the retention policy as your standard Journal archives
3. In Exchange 2007, create a new Hub Transport rule that has
   1. In the 'Conditions' part of the transport rule, set 'sent to people' to the standard journal mailbox; and set 'when any attachment file name...' to the name of the txt file
   2. In the 'Actions' part of the transport rule, set 'redirect the message...' to the new user from step 1 (Journal Alternate)
   3. No exceptions are required
4. If you have EV Accelerators installed (CA or DA), please add the 'Journal Alternate' archive as an additional archive to search

Event ID 3375 is being generated and Exchange Journal messages are being moved to the 'Invalid Journal Report' folder.