I have been asked this question several times.
The short answer is that Archive Sink allows capturing emails that go through a specific SMTP virtual server. Journaling will capture every email that is sent and/or received by users that are hosted in a specific MDB.
Let me clarify with a few scenarios:
A - I want to capture every email that is sent to the internet, but I am not interested in internal emails
B - I want to capture every email sent and received by the Executives in my company
C - I want to capture the emails between two of the companies my company owns
In scenario A we would use Archive Sink. In fact, we are really interested in the traffic that goes to the Internet, which means I can simply install the Archive Sink on the Exchange bridgehead server(s) that are relaying email to the Internet (or to Internet Gateways).
In B I will use Journaling, as I am really interested on the emails that some users are sending or receiving. In this case Journaling is the easiest feature to use. There's a catch. If the executives are in different MDBs then you will need to turn on journaling for every MDB that is hosting an executive.
In the last scenario - C - we can go back to using Archive Sink. In fact, in this scenario I will likely have an internal SMTP Relay server between the two companies and I can simply install the Archive Sink on this server.
Aside from the usage pattern, I want also make sure that we understand another big difference between Archive Sink and Journaling: message format.
Journaling will require a mailbox (or PF) as "archive repository". Archive Sink will drop a copy of the message (and an extra xml file) to a local NTFS folder on the box. This is a pretty big difference and again it highlights the fundamental difference in usage pattern between these two features.
Just for fun...an historical perspective: Archive Sink was not originally "designed" as an archiving tool, but rather as a troubleshooting tool. In fact, the problem we were trying to solve was the "I received corrupted messages" case. Let me elaborate just a bit more on this. There are cases in which users receive an email with strange characters (=garbage), if the email was received from the internet the first thing you want to know is whether the email was corrupted before it got to your Internet Gateway or if it was corrupted by Exchange during the propagation from the Internet Gateways to the mailbox server. Well...Archive Sink was designed to help answer that specific question. The idea was to capture the message as soon as it is received by the gateway so that the administrator could check whether it was corrupted before we received it. As customers started using the tool...they realized that they wanted to use it for more than just troubleshooting.
Below I included some good documentation for your reference. Now, before I get questions about "are you guys improving journaling?"...the short answer is "Yes, we are committed to make the archiving experience much better as we move forward". I can also say that we received very good feedback on what we did with our Envelope Journaling in Exchange Server 2003 SP1. The build in feature set augmented with our archiving partners' solutions should help our customers with Compliance requirements.
References:
Journaling in Exchange Server 2003 (SP1):
http://www.microsoft.com/technet/prodtechnol/exchange/2003/library/journaling.mspx
Archive Sink link:
http://www.microsoft.com/downloads/details.aspx?FamilyId=5D3475BD-6915-4110-959D-6E4CB233D79D&displa...
Tool to enable Envelope Journaling:
http://www.microsoft.com/downloads/details.aspx?FamilyId=E7F73F10-7933-40F3-B07E-EBF38DF3400D&displa...
Exchange archiving partners:
http://www.microsoft.com/exchange/partners/archivingandcompliance.asp
- Max Ciccotosto
