This article applies to:

• Trustwave MailMarshal (SEG)
• Trustwave ECM/MailMarshal Exchange

Question:

Procedure:

MailMarshal can easily be configured to save email attachments to a local or network share and then remove them from the email. This rule can be applied to specific attachment types or even limited to attachments greater than a certain size.

1. Create a windows batch file called "SaveAttachments.bat" that contains the following text and save it to the MailMarshal install directory (if using an array, on each processing node server).

mkdir "c:\SavedAttachments\%2\%3_%4"

xcopy %1 "c:\SavedAttachments\%2\%3_%4\"

• The %n variables are as follows:
  %1 = Full path of the attachment
   %2 = Message recipient
   %3 = Date/Time in this format: 04-26-2004_11.38AM
   %4 = Message sender
• The path: c:\SavedAttachments\ should be changed to an appropriate location for each environment. Be sure that the account that the MailMarshal Engine service is using has write permissions to the location specified.

2. Open the MailMarshal Configurator or Management Interface and browse to External Commands. Right click on External Commands and choose New -> External Command... The command should look like this:
   (MailMarshal (SEG) 10 Management Interface has different appearance but the same fields)

• The command line field should contain the full path to the file "SaveAttachments.bat."
• The parameters field contains this text:

"{CmdFileName}" {Recipient} {Date=%%m-%%d-%%Y_%%I.%%M%%p} {Sender}

3. Next create a new rule that looks like below. This rule will call the External Command and save the email attachments to the location specified in the batch file.

Standard Rule: Move Attachments to network Share
When a message arrives
Where the message is addressed to or from any user
Where message attachment is of type 'EXECUTABLE' or 'IMAGE' or 'VIDEO' or 'SOUND' or 'DOCUMENT' or 'ARCHIVE' or 'ENCRYPTED' or 'DRAWING' or 'FONTS' or 'OTHER'
And where attachment parent is not of type: 'DOCUMENT' or 'ARCHIVE'
Run the external command 'Save Attachments'
And pass message to the next rule for processing.

• When creating the rule, choose all attachment types except Mail Components.

4. Finally, create a second rule. This rule must come after the previous rule because it will actually remove the attachments from the email.

Standard Rule: Strip Attachments from email
When a message arrives
Where the message is addressed to or from any user
Where message attachment is of type 'EXECUTABLE' or 'IMAGE' or 'VIDEO' or 'SOUND' or 'DOCUMENT' or 'ARCHIVE' or 'ENCRYPTED' or 'DRAWING' or 'FONTS' or 'OTHER' or 'USER'
And where attachment parent is not of type: 'DOCUMENT' or 'ARCHIVE'
Strip attachment
And pass message to the next rule for processing.

• The criteria of this rule are the same as the first.

This article was previously published as:

NETIQKB29361

Marshal KB194