Symantec Enterprise Vault

We store data in many forms and in many places so keeping it safe and accessible is a demanding job. Symantec’s Enterprise Vault can help with archiving and retrieval, compliance and discovery.

In this increasingly litigious world, organisations need to enforce compliance (and demonstrate that compliance is enforced) as well as respond to discovery requirements in case of legal claims.

Compliance is all about ensuring that your employees are abiding by the rules and regulations of the industry they are working in (eg Sarbanes-Oxley in the US). Compliance is a fact of life in some industries in the UK and is becoming increasingly important in others.

Discovery is the ability to find all relevant company documents related to some particular issue in the case of a lawsuit – for example, the ability to find all e-mails and instant messages relating to a sexual harassment suit. The need for compliance and discovery features will vary by industry and by country – but when it’s needed, it’s really needed.

Rescue services
Symantec’s Enterprise Vault was built to manage the archiving
and retrieval needs of an organisation, but also to support compliance and discovery. Interestingly, there is no real equivalent available from Microsoft. System Center Data Protection Manager does a great job of protecting data and systems from harm and enabling recovery in the case of a disk or system failure, but it has none of the search, discovery or compliance features that are needed increasingly in organisations of all sizes. Nor does it aggregate data for disparate systems into a single archive.

Enterprise Vault has been around for years and has gone from strength to strength. In Gartner’s 2008 Magic Quadrant analysis of e-mail archiving, it is the clear leader and the only product in the Leader/Visionary “magic quadrant”. It is also ranked highest on both ability to execute and completeness of vision.

Added value
Enterprise Vault consists of a core product that handles the basic archiving and retrieval functions plus additional modules that support specific archiving needs. The core product by itself is not much use – you have to add on specific modules. The key add-ons include:

• File System Archiving
• Lotus Domino Archiving
• Microsoft Exchange Archiving
• Microsoft SharePoint Archiving
• Compliance Accelerator
• Discovery Accelerator
• Instant Messaging Archiving

Enterprise Vault is sold via several channel partners. Licensing is not straightforward (and not very clearly explained on Symantec’s web site). Licensing is based on what modules you take, as well as the number of users and the amount of data archived. Annual maintenance is in the region of 20 per cent of purchase price. For full details on likely costs, see a Symantec Partner.

File System Archiving
File System Archiving allows you to gather data from individual systems, file servers and so on, and put it all in one place (ie an Enterprise Vault archive vault). Once in the vault, the data can be backed up centrally and in due course it can be removed totally. The data to be archived is specified by policy, which can include age, size or other criteria. One neat feature is the ability to remove inappropriate file types. For example, you could add a policy rule that automatically removes any music files, such as MP3, SHN or FLC files.

The data file archived by Enterprise Vault can be replaced with a short cut, which users can double-click to access the file. In practice, most users won’t notice whether they’re accessing an original or an archived file.

Once Enterprise Vault has the file, it will compress it and make a text copy and store the result in a “save set” DVS file. Enterprise Vault uses the Stellant Outside-In converter tool to try to make a text or HTML representation of the file which is stored inside the DVS file. This provides a useful bit of future proofing for the document – if you no longer have the underlying application, you can still see a decent representation of it, even if you can no longer edit it.

DVS items are also single-instanced – if multiple copies of a single file are found, only one copy is archived. There are some limits to single instancing, but this can certainly reduce the amount of data in the archive.

Enterprise Vault indexes all archived items for subsequent searching and retrieval. It uses the Alta Vista tools to perform this indexing, and provides a good search interface to enable you to perform rich searches on the archived data. There’s also a shopping basket service that allows a compliance officer, say, to find multiple items and restore them to a separate file/folder (or PST in the case of e-mail).

The DVS collection mechanism is useful. Enterprise Vault can collect a number of individual DVS files into a single CAB file. Creating fewer larger files reduces the time to back up an archive vault, with only minimal impact on retrieval. Naturally, this process can be tweaked using policy settings.

E-mail archiving
The e-mail archiving features of Enterprise Vault will be a delight to many a corporate e-mail administrator who has had to manage the explosive growth in e-mail volumes. Enterprise Vault provides direct integrated support for both Lotus Domino and Microsoft Exchange as well as more limited support for general SMTP servers.

For Exchange, Enterprise Vault supports archiving of mailboxes and journal mailboxes as well as providing a great mechanism to eliminate PST files. By archiving items in Exchange mailboxes, you can significantly (in some cases) reduce the Exchange backup window while simultaneously providing a workaround for limited mailbox quotas. I’d love to have this feature if only to remove my reliance on PST files to get around low quotas.
Enterprise Vault’s Exchange support provides add-ins for both Outlook and Outlook Web Access (OWA). These add-ins allow users to access archived items seamlessly and to archive items manually where necessary from both Outlook and OWA. The Outlook add-in also provides integrated support for Windows Desktop Search, enabling WDS to index archived e-mail.

For compliance support, Enterprise Vault enables archiving of mail sent to a journal mailbox. This means that it can take a copy of all mail flowing through your system (either all mail or mails for selected inboxes) before that mail even hits the mailbox. To aid in discovery and compliance, this mail can be written to WORM drives, thus preventing “accidental” deletion of incriminating or actionable e-mail.

Bursting out
With many e-mail systems full to bursting, all too many users have more mail to save than their quota will allow. With Exchange, users typically store this mail in PST files. While PST files are a good solution, they tend to be stored all over the place and are often not backed up properly. Recently I lost a moderate PST file when I reformatted a disk on my laptop. I had a fairly recent backup but some mails in that archive were lost. You may also get archive corruption when PST files grow too large. For a deeper insight into some potential issues with PST files, see http://tinyurl.com/56a3d8.

Enterprise Vault enables you to locate, collect and migrate PST files into central archives. This allows the organisation to centralise all this data and ensure that it is fully backed up and that retention is carried out based on corporate policy. Enterprise Vault offers four mechanisms to enable PST migration, in response to the various needs of different organisations. “Client push” is the simplest – the Enterprise Vault Outlook add-in can be instructed to send the user’s PST files to the archiving process, optionally deleting the PST once the archive operation is complete. The other mechanisms can then be used to obtain the remaining PST files.

Remember that extracting all the PST files in an organisation is unlikely to be a weekend fix (client push only works when the user is logged in to Outlook). Mail archiving runs at 2–3GB/hour, so it can take a long time to get all your mail archived, especially in larger organisations. After all, it took years to get the data into the PST files – and it can take months or more to retrieve it all!

Enterprise Vault also supports Lotus Domino, providing similar features as for Exchange. You can archive mail from a Domino mailbox, from a Domino NSF file. Some customers are using Enterprise Vault to reduce the amount of mail in a Domino system prior to migrating to Microsoft Exchange.

Searching the archive
Enterprise Vault has a web-based Search feature (Figure 1). This enables end users to search for archived data across the various information silos and allows compliance and discovery across the entire archive. The Outlook add-in also provides additional e-mail related search which, as noted earlier, can be integrated with Windows Desktop Search.


Figure 1: Enterprise Vault’s web-based search helps users find data across the whole archive

Enterprise Vault 2007 is supported on Windows Server 2000 and 2003 (Server 2008 support comes with the next version due out in December 2008). You also require the .NET framework, Outlook 2003 (for Exchange archiving) and a SQL Server. You can run the included Deployment Scanner to check for all the prerequisites before committing to the installation. The install program is pretty straightforward.

Once Enterprise Vault is installed, initial directory is performed by the Configuration utility. To administer Enterprise Vault, you use the Vault Administration Console – an MMC snap-in (Figure 2).


Figure 2: You use an MMC snap-in to administer Enterprise Vault

There are some additional command-line management and troubleshooting tools. Enterprise Vault comes with a good web-based monitoring facility (Figure 3), detailed audit capabilities and rich reporting (based on SQL Server Reporting Services).  Symantec’s Enterprise Vault is a rich and complex application that gives you access to a huge variety of enterprise data.


Figure 3: Enterprise Vault has a good monitoring feature

Successful implementations, particularly if they involve PST eradication, can take a lot of time and effort to plan, but they’ll be time and effort well spent.