CA DLP Tuesday Tip: Using Dataminder to discard events from EV.

Discussion created by devan05 Employee on Jul 17, 2012
Latest reply on Jul 18, 2012 by Chris_Hackett
Using CA (DLP) Dataminder to discard events from Symatec Enterprise Vault (SEV) posted by Andrew Devine Snr. support Engineer 17 July 2012

CA DataMinder can integrate with the Symantec Enterprise Vault archive solution when it is being used to archive Exchange or Domino emails. Integration is provided through a CA DataMinder custom filter for Enterprise Vault, wgnsev.dll. In this article, the term ‘EV archive agent’ refers to this custom filter.

Enterprise Vault extracts an e-mail from the Exchange journal mailbox and notifies the EV archive agent that an e-mail is available for processing.
The EV archive agent passes the e-mail to the DataMinder HUB which then allocates the e-mail to a policy engine (PE) for processing.

The Smart Tags setting in each policy trigger defines the tag associated with that trigger. The PE applies triggers as necessary and applies the associated smart tags to the e-mail.

A diagram of this process is available on page 123 of the Archive Integration Guide Release 14.1 - DLP_Archive_Int_ENU.pdf, which is available from the r14.1 CA DataMinder bookshelf.

CA DataMinder and Enterprise Vault can be used together to produce a smart tag with a retention date. This retention date specifies when Enterprise Vault will purge the archived email event. You can also use retention categories to discard e-mails from the archive. On the machine hosting the Enterprise Vault server agent, configure the "RetentionSmartTag" registry value to match one of the following;


On the machine hosting the Enterprise Vault server agent, configure the RetentionSmartTag registry value and then set the following registry keys to the discard values you wish to exploit in the DataMinder policy triggers;


For example,

Set the "RetentionSmartTag" registry value to "retain"
set the "RetentionSmartTagDiscardValue" key value to "discard"
set the "RetentionSmartTagForceDiscardValue" key value to "force"

Once the registry settings are specified, to discard an email event from the archive you must define a DataMinder policy trigger which will apply the criteria to match against excluded events. For example, a policy trigger which includes a Smart Tag called "retain" with a Smart Tag Value of "discard".

Note: This will only discard events that have fired no other triggers that have a valid retention value. To ensure that e-mails of a certain criteria are always discarded set the Smart Tag value to force.

For more details on SEV Integration and retention please refer to the CA DataMinder r14.1 Archive Integration Guide (DLP_Archive_Int_ENU.pdf)