This article applies to:

• Trustwave MailMarshal (SEG)
• Trustwave ECM/MailMarshal Exchange

Question:

Procedure:

MailMarshal can easily be configured to save email attachments to a local or network share, and optionally remove them from the email. These rules can be applied to specific attachment types or attachments greater than a certain size.

1. Create a windows batch file called "SaveAttachments.bat" that contains the following text. To ensure the file will be present on all processing nodes, you can save it in the Config subfolder of the MailMarshal installation directory and it will be copied to the NodeConfig folder on all processing servers each time configuration is committed.

mkdir "c:\SavedAttachments\%2\%3_%4"

xcopy %1 "c:\SavedAttachments\%2\%3_%4\"

• The %n variables are as follows:
  %1 = Full path of the attachment
  %2 = Message recipient
  %3 = Date/Time in this format: 04-26-2004_11.38AM
  %4 = Message sender
• The folder name c:\SavedAttachments\ should be changed to an appropriate location for each environment. The location must exist on all processing servers. 
• The MailMarshal Engine service must have write permissions to the location specified.
  • By default the Engine runs as the Local System and will have access to any local folder.
  • The location can also be a network share. In this case for the Engine to have reliable access it should be run as a real account with local administrator permissions. In a domain environment you may be able to grant access to the computer accounts of the processing servers.

2. Open the Management Interface (or ECM Configurator) and browse to External Commands. Add an External Command as below.
   (Click to enlarge.The ECM Configurator has different appearance but the same fields)
   

• The command line field should contain the full path to the file "SaveAttachments.bat." In the example the variable {install} expands to the location of the MailMarshal installation folder.
• The parameters field contains this text:
  "{CmdFileName}" {Recipient} {Date=%%m-%%d-%%Y_%%I.%%M%%p} {Sender}

3. Next create a new Content Analysis rule as below. This rule will call the External Command and save the email attachments to the location specified in the batch file.

Content Analysis Rule: Move Attachments to network Share
When a message arrives
Where the message is addressed to or from any user
Where message attachment is of type 'EXECUTABLE' or 'IMAGE' or 'VIDEO' or 'SOUND' or 'DOCUMENT' or 'ARCHIVE' or 'ENCRYPTED' or 'DRAWING' or 'FONTS' or 'OTHER'
And where attachment parent is not of type: 'DOCUMENT' or 'ARCHIVE'
Run the external command 'Save Attachments'
And continue processing.

• When creating the rule, choose all attachment types you want to save. In most cases you should not include Mail Components.

4. To remove the attachments, create a second rule. This rule must come after the previous rule because it will actually remove the attachments from the email.

Content Analysis Rule: Strip Attachments from email
When a message arrives
Where the message is addressed to or from any user
Where message attachment is of type 'EXECUTABLE' or 'IMAGE' or 'VIDEO' or 'SOUND' or 'DOCUMENT' or 'ARCHIVE' or 'ENCRYPTED' or 'DRAWING' or 'FONTS' or 'OTHER' or 'USER'
And where attachment parent is not of type: 'DOCUMENT' or 'ARCHIVE'
Strip attachment
And continue processing.

• The criteria of this rule should be the same as the first.

This article was previously published as:

NETIQKB29361

Marshal KB194