I have recently completed a short contract where part of my job was to do health check on an Enterprise Vault system. One of the things that I found was several thousand mail items that were stuck in sub-folders in the Journal mailbox.
Any items within the Inbox folder of a journal mailbox targeted by Enterprise Vault will become candidates for archiving. Every minute up to 1000 items are processed by Enterprise Vault. The journal archiving task will try 3 times to archive the item and then the item will be moved into a sub-folder within the Inbox folder where it will not be processed again. The items in the sub-folders are not archived which means that the Journal Archive is not an accurate representation of all emails in and out of the organisation. Also in time the Journal Mailbox could fill up with unarchived emails. A regular procedure is required to examine the emails and either fix the problem or delete the item from the sub-folder.
Above Maximum Size
The limit for Journal Archiving is 250MB so any internal emails that are larger than this will be placed in the Above Maximum Size folder. If proper size limits are set for both internal and external emails within Microsoft Exchange then you should not find this folder.
Failed DL Expansion
There is a setting in the Journaling Policy to prevent emails where the distribution list cannot be expanded from being archived. You could try dragging these emails back into the Inbox folder to archive, if they are still not archived then delete them from the Journal Mailbox. An alternative is to change the setting with the Journaling Policy so that these emails are archived even though the Dls are not expanded.
Failed External Filter
If you are using a custom filter check that it it configured properly.
Failed to copy
Items within this folder are are usually corrupt so they cannot be archived. First try dragging the message back into the Inbox to see whether it is archived. If that doesn’t work you can try dragging the message to the desktop and opening it from there. If that works then drag the message to the Inbox folder of the Journal Mailbox and delete the original corrupted message in the Failed to Copy folder. If none of these actions work then delete the message from the Failed to copy folder.
Failed to store
These are generally items where there has been a temporary failure of archiving. Drag the items back into the Inbox folder so that they Enterprise Vault can try archiving them again.
Invalid journal report
These are emails where the journal report has been altered so that Enterprise Vault is unable to archive the message, for example if a security gateway has intercepted the journaled email and striped the attachment. Drag the item into the Inbox and see whether it is archived successfully (this will take at least 5 minutes). If this is unsuccessful then delete the email because it cannot be archived by Enterprise Vault.