Jounaling - How to find content in it?

%3CLINGO-SUB%20id%3D%22lingo-sub-2406048%22%20slang%3D%22en-US%22%3EJounaling%20-%20How%20to%20find%20content%20in%20it%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2406048%22%20slang%3D%22en-US%22%3E%3CP%3ESo%20I'm%20new%20to%20Journaling.%26nbsp%3B%20I've%20read%20and%20found%20how%20to%20enable%20it.%26nbsp%3B%20I've%20tested%20it%20and%20confirmed%20journal%20content%20arrives%20in%20the%20journal%20mailbox%20(on-prem)...%20but%20what%20happens%20after%20that%2C%20I%20can't%20find%20much%20documentation%20on%20how%20to%20use%20it%20afterwards.%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EFor%20example%3A%3C%2FP%3E%3CP%3EHow%20do%20I%20search%20the%20journal%20mailbox%20for%20content%3F%3C%2FP%3E%3CP%3E-%20Does%20the%20O365%20eDiscover%20find%20on-prem%20content%20(doesn't%20look%20like%20it%20from%20my%20research)%3F%3C%2FP%3E%3CP%3E-%20I%20assume%20I%20would%20use%20my%20On-Prem%20server%20to%20search%3F%26nbsp%3B%20Do%20I%20use%20eDiscovery%20there%3F%3CBR%20%2F%3E-%20Give%20user%20permission%20to%20open%20the%20mailbox%20and%20view%20it%20in%20OWA%20or%20Outlook%20and%20search%20that%20way%3F%26nbsp%3B%20It%20seems%20in%20my%20environment%20the%20search%20feature%20wasn't%20working%2C%20maybe%20the%20indexing%20process%20runs%20once%20a%20day%20or%20something%2C%20or%20its%20disabled%2C%20will%20look%20into%20this%20shortly.%3C%2FP%3E%3CP%3E-%20Can%20an%20eDiscovery%20find%20it%3F%26nbsp%3B%20Can%20I%20search%20%22all%20mailboxes%22%20and%20use%20criteria%20to%2Ffrom%20John%20Doe%2C%20and%20will%20that%20also%20find%20the%20original%20content%20in%20the%20journal%3F%26nbsp%3B%20If%20I%20want%20to%20specifically%20search%20the%20journal%20mailbox%20do%20I%20use%20eDiscovery%20and%20select%20that%20mailbox%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ESorry%2C%20probably%20some%20dumb%20questions%2C%20I'm%20just%20a%20noob%20when%20it%20comes%20to%20this.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThanks%20for%20any%20tips%2C%20much%20appreciated.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EUsing%20Exchange%20Online%2C%20journaling%20to%20on-prem%20Exch%202013%20box%20(I%20know...%20it%20was%20inherited).%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-2406048%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3E2013%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EExchange%20Online%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EExchange%20Server%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E
New Contributor

So I'm new to Journaling.  I've read and found how to enable it.  I've tested it and confirmed journal content arrives in the journal mailbox (on-prem)... but what happens after that, I can't find much documentation on how to use it afterwards. 

 

For example:

How do I search the journal mailbox for content?

- Does the O365 eDiscover find on-prem content (doesn't look like it from my research)?

- I assume I would use my On-Prem server to search?  Do I use eDiscovery there?
- Give user permission to open the mailbox and view it in OWA or Outlook and search that way?  It seems in my environment the search feature wasn't working, maybe the indexing process runs once a day or something, or its disabled, will look into this shortly.

- Can an eDiscovery find it?  Can I search "all mailboxes" and use criteria to/from John Doe, and will that also find the original content in the journal?  If I want to specifically search the journal mailbox do I use eDiscovery and select that mailbox?

 

Sorry, probably some dumb questions, I'm just a noob when it comes to this.

 

Thanks for any tips, much appreciated.

 

Using Exchange Online, journaling to on-prem Exch 2013 box (I know... it was inherited).

 

1 Reply
If you are already using O365, best stick to using the built-in compliance features instead of Journaling. Put whichever mailboxes you want to preserve on hold, then use eDiscovery to search/export as needed. One of the biggest benefits for this approach is that all data stays in place, all in the same system, and you dont need any additional tools.

If you need to use Journaling for some reason, you will have to rely on whatever the external system supports. In the case of Exchange Server, you can use eDiscovery or the good old Search-Mailbox cmdlet, here are some references:
https://docs.microsoft.com/en-us/Exchange/create-in-place-ediscovery-search-exchange-2013-help
https://docs.microsoft.com/en-us/exchange/policy-and-compliance/ediscovery/message-properties-and-se...
https://docs.microsoft.com/en-us/powershell/module/exchange/search-mailbox?view=exchange-ps