Default Filter Rules doesn't work.

Hello everybody.

I have a task to do archiving based on some specific MAPI attribute. If MAPI attribute has Success value - move items to Deleted folder, otherwise (with all other values) – archive it as usually.

Partially this question was raised here, and I used this post to configure my EV to index additional email attributes.

http://www.symantec.com/connect/forums/indexing-additional-email-header-info

So, my Custom Properties.xml file looks like:

<?xml version="1.0" encoding="UTF-8"?>

<CUSTOMPROPERTYMETADATA xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="customproperties.xsd">

    <!-- 1. DEFINITION OF CONTENT CATEGORIES AVAILABLE -->

    <CONTENTCATEGORIES DEFAULT="HeaderData">

        <CONTENTCATEGORY NAME="HeaderData">

            <INDEXEDPROPERTIES RETRIEVE="Y">

                <PROPERTY TAG="Header"/>            

            </INDEXEDPROPERTIES>

        </CONTENTCATEGORY>    

    </CONTENTCATEGORIES>

    <!-- 2. DEFINITION OF CUSTOM PROPERTIES AVAILABLE -->

    <CUSTOMPROPERTIES>

        <NAMESPACE TYPE="MAPI">

            <PROPERTY NAME="0x007D" TAG="Header"/>

        </NAMESPACE>

    </CUSTOMPROPERTIES>

    <!-- 3. DEFINITION OF PRESENTATION PROPERTIES AVAILABLE -->

    <PRESENTATION>

        <APPLICATION NAME="search.asp" LOCALE="1033">

            <FIELDGROUPS>

                <FIELDGROUP LABEL="HeaderData">

                    <FIELD TAG="Header" LABEL="Header" CATEGORY="HeaderData"/>

                </FIELDGROUP>

            </FIELDGROUPS>

            <AVAILABLECATEGORIES>

                <AVAILABLECATEGORY CONTENTCATEGORY="HeaderData" LABEL="Header"/>

            </AVAILABLECATEGORIES>

        </APPLICATION>

    </PRESENTATION>

</CUSTOMPROPERTYMETADATA>

My Default Filter Rules file looks like:

Default Filter Rules.xml

<?xml version="1.0"?>

<RULE_SET xmlns="x-schema:ruleset schema.xdr">

<RULE NAME="MoveDeletedItemsIfSuccess" ACTION="MOVE_DELETED_ITEMS">

<NAMEDPROP TAG="Header" INCLUDES="ANY">

<PROP VALUE="x-si-jrda-result: success" />   (comment: here I have put “success”\”error”\” x-si-jrda-result: success”, and other possible and impossible values)

</NAMEDPROP>

</RULE>

</RULE_SET>

TraceLog:

2960     11:35:29.134     [9596]  (JournalTask)      <7620> EV:L     [CustomXMLFilter] Adding property 'Header' to Items XML. [tag='Header', value='Received: from ServerName (IP 154.56.21.36) by ServerName (IP 112.236.56.47) with Microsoft SMTP Server id 14.3.169.1; Mon, 12 May 2014| 11:32:44 +0200|Content-Type: application/ms-tnef; name="winmail.dat"|Content-Transfer-Encoding: binary|From: "User1)"<User1@domain.level>|To: "User2"|<User2@domain.level>|Subject: MAPIAttribute 1/3-05/12/2014 11:32:44|Thread-Topic: MAPIAttribute 1/3-05/12/2014 11:32:44|Thread-Index: AQHBxDO+slLIBg3/GZpuir9SS9MXow==|Date: Mon, 12 May 2014 09:32:44 +0000|Message-ID: <8f98cad6-c802-425e-a166-3c2ae6cb7219@servername.domain.level>|X-MS-Has-Attach: yes|X-MS-TNEF-Correlator: <8f98cad6-c802-425e-a166-3c2ae6cb7219@server.domain.level>|MIME-Version: 1.0|X-SI-JRDA-Result: Success|']

Comment: so, additional attribute was successfully found and indexed. Last sting this is actually what I am looking for: “X-SI-JRDA-Result: Success”

2961     11:35:29.134     [9596]  (JournalTask)      <7620> EV:L     [CustomRules][CRule] Evaluating item against MoveDeletedItemsIfSuccess rule...

2962     11:35:29.134     [9596]  (JournalTask)      <7620> EV:L     [CustomRules][CNamedPropClause] testing against ANY of 1 NamedProps

Comment: EV starts analyzing header against my rule.

2963     11:35:29.134     [9596]  (JournalTask)      <7620> EV:L     [CustomRules][CNamedPropClause] : success  DID NOT MATCH  received: from servername (ip 154.56.21.36) by servername (ip 112.236.56.47) with microsoft smtp server id 14.3.169.1; mon, 12 may 2014| 11:32:44 +0200|content-type: application/ms-tnef; name="winmail.dat"|content-transfer-encoding: binary|from: "user1)"<user1@domain.level>|to: "user2"|<user2@domain.level>|subject: mapiattribute 1/3-05/12/2014 11:32:44|thread-topic: mapiattribute 1/3-05/12/2014 11:32:44|thread-index: aqhbxdo+sllibg3/gzpuir9ss9mxow==|date: mon, 12 may 2014 09:32:44 +0000|message-id: <8f98cad6-c802-425e-a166-3c2ae6cb7219@servername.domain.level>|x-ms-has-attach: yes|x-ms-tnef-correlator: <8f98cad6-c802-425e-a166-3c2ae6cb7219@server.domain.level>|mime-version: 1.0|x-si-jrda-result: success

So, rule didn’t find matches against my custom attribute. But attribute exist there.

Here I have several consideration:

1. Match doesn’t work, because this “target string”: “success” is a part of big attribute value. Does anybody can confirm it?
2. It will work if this attribute is separated , independent attribute with its own PropertyName.
3. Funny thing, that I can do precise searching against key words :”success” and “error” via search.asp. Printscreen.

Thanks for any comments.

PS: Fake IP addresses, hostnames, etc.