How do I move my quarantined email to a new node?

This article applies to:

• Trustwave MailMarshal (SEG)
• Trustwave ECM/MailMarshal Exchange 7.X

Question:

• How do I move my quarantined email to a new node?
• How do I migrate email processing nodes in SEG/MailMarshal SMTP?
• How do I migrate email processing nodes in SEG/MailMarshal Exchange 7.X?

Background:

MailMarshal stores archived and quarantined email in files on the servers that process email (standalone server, or email processing nodes of an array). MailMarshal indexes these files in the SQL database.

If you move to a new server, to preserve the quarantined and archived email you must move the files. In many cases you must then make changes so that MailMarshal can find the files in their new location.

The method described in this article involves renaming your quarantined email. This is the commonly used method.

• If the new server has not yet been used to process messages, it is significantly faster to use another method, described in Q10411, that involves manipulating SQL table entries.

Procedure:

This procedure assumes that you have already installed the MailMarshal software on the new node and confirmed that it is working. For array installation, during installation you will have joined the new node to the array.

1. Determine the ServerID of your new and old processing servers.
   • You can determine the Server ID and match it to the Server Name of each node in the MailMarshal (SEG) 10 Web Console > Mail Servers pane  or MailMarshal Configurator > Servers pane.
     • Caution: The node ID in the user interfaces and database is shown as a decimal value. Email file names encode the server ID as hexadecimal. Node ID 16 in the configurator or database has email files with the extension 0010.mml
   • You can find the ServerID by examining file names of new quarantined email on each server. The ServerID is used in the file names of all quarantined email (ending in .0010.mml, for example, for a ServerID of 10 HEXADECIMAL - shown as "16" decimal in the interfaces).
   • You can view the Server table in the MailMarshal SQL database to note the ServerID and servername values. 
   • You can find the Server ID information in the Registry of each node. The ID is stored in the value NodeID within the MailMarshal Node registry key.
     
     • For details of the Registry location for each MailMarshal version, see Q10832 (MailMarshal SMTP) or Q14003 (MailMarshal Exchange).
2. Move all of your quarantined email from the old node to the target node. The quarantined email is stored, by default, in {install}\Quarantine, and within the Quarantine folder we see subfolders with GUID names (naming format is  xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx). Move this entire GUID folder structure to an equivalent location on the target node. If the MailMarshal Configuration has been committed to the new node, folders with the same names should already exist. (You do not need to move the Symbolic folder).
   • Use Robocopy with appropriate flags to preserve the file and folder timestamps. Other copying methods might not preserve the creation times, and file purging could be delayed. 
3. If the ServerID is the same for both servers, stop here. No further action should be necessary. Use the Console to verify that messages can be retrieved.
4. If the ServerID differs, complete additional steps:
   
   • It is necessary to change the names of all the MML and LOG files that you have moved, to reflect the ServerID of the target server.  
   • In recent versions that have "sent history" it is also necessary to rename MML.ZIP files
     For example, if you moved from ServerID 1 to ServerID 3, you would need to change all names of the copied files from *.0001.mml to *.0003.mml,  and from *.0001.log to *.0003.log, and from *.0001.mml.zip to *.0003.mml.zip

   • DO NOT try to use the Windows Rename command!

   • You can use Windows Powershell commands similar to the following (the example moves from server 2 to server 1; remember to substitute the required names to find and replace):
     
     
     Get-ChildItem -Filter "*.0002.Log" -Recurse | Rename-Item -NewName {$_.name -replace '.0002.Log','.0001.Log' } 
     Get-ChildItem -Filter "*.0002.mml" -Recurse | Rename-Item -NewName {$_.name -replace '.0002.mml','.0001.mml' } 
   • With Windows Command Extensions, you may be able to use the FOR command with wildcards to rename the files. You could also script a solution in VBS or another scripting language, or use a third party renaming tool such as A.F.5 Rename Your Files 1.1 (http://www.fauland.com/)
   • As always, back up the original files and test your solution before applying it to the entire set.
5. Run the Quarantine Sync tool to make MailMarshal "see" all the new quarantined email correctly. Before you rename the files and run this tool, you will see the email in the Console, but when you drill into, or process, a specific message you will get access errors (MailMarshal is unable to locate the message file). After running the Quarantine Sync tool, you should be able to view the message correctly, and you should be able to process the message as normal. In the Console, confirm that you are indeed looking at the new node by looking at the Message Name column - this should reflect the NodeID of the target server.

Note: Current versions install the Sync Tool by default and you can open it from the Start menu on each processing node.

Notes:

• To move your MailMarshal Array Manager see Q10413 - How do I move the Array Manager component to another server?
  
  
• Thanks to a customer for suggesting the Powershell commands.

This article was previously published as:

NETIQKB44336