Discovery Accelerator search results inaccurate

Question

We continue to experience inaccurate results which consist of items for a non-selected user&nbsp;that does not meet the criteria in the search.&nbsp; We have tested with two&nbsp;different searches that produce&nbsp;very different&nbsp;results.&nbsp; We use the following search criteria for&nbsp;a search that gives&nbsp;us not only the specific users hits for the day, but another user is included in the hits which appears to only meet the date criteria and not the&nbsp;to or from criteria selected.&nbsp;&nbsp;This is created using a specific date range which is Oct. 3rd - October 3rd. Search terms to or from and we select a single&nbsp;user name by clicking on the target and custodian icon on the right.&nbsp; Miscellaneous - Message type is set to all content sources.
On the other hand, when we run the same search by typing the name in the to and from field, "first last" then we do not get the additional user listed in the hit however, we do not get the Instant Messages either.
Has anyone heard of this?
Any assistance is greatly appreciated.
Thanks.&nbsp;

kenneth_adams · Accepted Answer

Mr. Adams?&nbsp; Please call me Ken.&nbsp; Mr. Adams was my Dad.&nbsp; 
The "Use Historical Information for Custodians and Custodian Groups" option can have an affect on what is included in the search criteria.&nbsp; To provide some background to answer your question about this option, let me explain a little of how a DA search&nbsp;using Custodians is processed on the DA server prior to being submitted.
Each Custodian is referenced to their SMTP address or addresses by the use of an AddressOwnerID that is unique to each Custodian.&nbsp; The SMTP address or addresses are kept in an address table.&nbsp; The Custodian names are kept in an address user table and a principal table, with the address user table containing each Custodian's display name, last name, first name, etc.&nbsp; When certain administrative actions are applied to a Custodian -&nbsp;such as removal of an SMTP address, deactivation or deletion -&nbsp;information for the custodian will be placed into an address history table.
When a DA search using a Custodian is created, the Custodian is referenced by&nbsp;their AddressOwnerID.&nbsp; That AddressOwnerID is translated into the SMTP address or addresses that we have for that Custodian in the Custodian Manager database.&nbsp; The SMTP address or addresses, which are obtained from the address table,&nbsp;are then configured into the search criteria&nbsp;before being passed to the search engine on the EV indexing server(s).
Now, when&nbsp;a search is being configured&nbsp;with the "Use Historical Information for Custodians and Custodian Groups" option enabled (which is enabled by default), the search creation process&nbsp;will also look in the address history table for any SMTP address or addresses that are associated with the Custodian's AddressOwnerID.&nbsp; So, if your selected Custodian has an&nbsp;address history table entry of "0" for an&nbsp;address, you'll get this "0" address included in the search criteria.
It sounded like your Custodian had the "0"&nbsp;address in the address table, not the address history table.&nbsp; That "0" address could have been manually added as the SMTP Address field in Custodian Manager is configured to take any text.&nbsp; We occassionally recommend adding a Custodian's Display Name and variations of it into the SMTP Address field to allow for more matches to message.&nbsp; This would be in the event that an e-mail was sent with only a Display Name indexed for the author or recipient (as in an archived message from the user's Drafts folder before the message was configured with any recipients).
I know checking all of the Custodians for a Display Name or Address of 0 can be very time consuming.&nbsp; I also know that you may have other instances of a Display Name or Address of other numbers.&nbsp; Here is a SQL query to run against your Custodian Manager database to see all instances of an address or display name of 0, 1, 2, 3, 4 or 5.&nbsp; You can adjust the WHERE clause condition to include more numbers if you need by just adding a comma, space, and the next number surrounded by single quotes as you can see in the query.
SELECT ta.Address AS 'Address or Display Name'
	&nbsp;&nbsp;&nbsp;&nbsp; , tat.Name AS 'Address Type'
	&nbsp;&nbsp;&nbsp;&nbsp; , ta.AddressOwnerID
	&nbsp;&nbsp;&nbsp;&nbsp; , tau.DisplayName AS 'Custodian Display Name'
	&nbsp;&nbsp;&nbsp;&nbsp; , tau.FirstName AS 'Custodian First Name'
	&nbsp;&nbsp;&nbsp;&nbsp; , tau.Surname AS 'Custodian Last Name'
	FROM tblAddress AS ta
	JOIN tblAddressUser AS tau
	&nbsp; ON ta.AddressOwnerID = tau.AddressOwnerID
	JOIN tblAddressType AS tat
	&nbsp; ON ta.AddressTypeID = tat.AddressTypeID
	WHERE ta.Address IN ('0', '1', '2', '3', '4', '5')
	ORDER BY ta.Address
You can run the same query against the address history table by changing the FROM line's table name from tblAddress to tblAddressHistory.
You can also change the WHERE statement to list all entries that have&nbsp;a 0 in the Address column to be
	WHERE ta.Address LIKE '%0%'
I offer the above change to the query so you can see all Custodians that have a 0 in their address or display name.
You can use the query to quickly identify any Custodian(s) that may need to be accessed through Custodian Manager to remove the number entry from the Address and / or Display Name field.
Let us know if you find this information useful or if you need more clarification, please.&nbsp; We'll be glad to help as we are able.
Ken
&nbsp;

tonysterling · Answer

What version of EV and DA?
Is this a target or custodian?
Have you verified the properties of the custodians	argets that are in the results?
You can also enable DA to save the search criteria.&nbsp; This is very useful in troubleshooting issues like this.

imalwayssmiling · Answer

EV 9.0.1.1073
DA 9.0123
Custodian - The results include a user who the administrator has not allowed to be searched.&nbsp; Basically that person does not even show up as a custodian.&nbsp; Yes,&nbsp;we verified in the To and From since that along with the date are the only criteria that was set for the search.&nbsp; It is a simple search and the requested custodian shows up as well as one that should not and is not in that criteria.
We did two searches with the same Oct. 3 date and then chose the custodian by checking the box c:first last and the other by typing the name "first last"&nbsp;and the latter of the two only has the correct user, but does not find any of the Instant Messages even though the all content sources is checked.
Thank you for your time.
&nbsp;
&nbsp;

kenneth_adams · Answer

A couple of suggestions:

When you create the search, ensure the option to include historic information is not checked.&nbsp; This option is checked by default and can cause searches to include custodians that you don't expect.
	Enable the 'Save Search Criteria' option as Tony recommended so you can obtain a copy of the search criteria that is actually sent to the search engine.&nbsp; To enable this option:

Click on the Configuration tab.
	Click on the Settings sub-tab.
	Expand the Diagnostics section.
	Click on the check box in the Value column of the 'Save Search Crirteria' option.
	Click the Save button.
	Click the OK button to acknowledge the pop-up stating the need to restart the Customer Background Tasks.
	Close the DA Client.
	On the DA server, restart the Enterprise Vault Accelerator Manager Service (we call this EVAMS for short).
	When EVAMS has finished the restart, the DA server should have a new folder named "SearchCriterias" in the DA installation folder.
	Launch the DA Client.
	Run the search.
	When the search has started processing the index volumes, check on the DA server in the "SearchCriterias" folder for a new folder named after the DA Customer.
	Look in the folder named after the DA Customer for 3 files that were created (2 .txt and 1 .xml).
	Look in either of the .txt files for the 'Native Query' section.
	Look at the information in this section to see the actual search criteria passed to the search engine.

I suspect you'll see something like "Smith" OR "John", which would return results for every Smith and every John in your Custodian Manager database.&nbsp; Of course, what you'll actually see will be showing the names you specified instead of "Smith, John".
Actually seeing the search criteria in this manner can help you determine the criteria specifications that you'll need to make to fine tune the search results.
&nbsp;

imalwayssmiling · Answer

Thank you Ken.&nbsp; I enabled the save search feature and I am still baffled as to why if I request a search for one user for one day that I get a that info and more.&nbsp; Am I missing something?&nbsp; It is a simple search.&nbsp; I have to add that the custodian that should never come up in any searches sometimes come up in other searches as well.&nbsp; This same person.&nbsp; In this case, I can duplicate the problem over and over.&nbsp; I attached my txt files from my search.&nbsp; I would appreciate a second set of eyes.
Thanks.
name (ESQany - 0): 0 jdoe@domain.org
	date (0): 10/3/2013 12:00:00 AM to 10/3/2013 11:59:59 PM
	anum (0): 0 to 0
	Vault.PolicyAction (ESQall): -EXCLUDE
	***** The last 5 are And
Native Query:
	-------------
	((name:0 OR name:jdoe.domain.org) AND date:[03/10/2013-03/10/2013] AND anum:[anum:0-0] AND (ssid:{**} AND NOT qeaultzkxolicykiction:exclude) AND snum:[snum:1-4294967294]) AND (anum:[anum:0-0])
	#rank&nbsp; #rankend
Raw Query:
	----------
	"name" 0 "0 jdoe@domain.org"
	"date" 0 [20131003:000000-20131003:235959]
	"anum" 0 0-0
	"&#127;Vault&#127;&#127;PolicyAction" 1 "-EXCLUDE"
	"snum" 0 1-fffffffe
	0,5

imalwayssmiling · Answer

I completed another search but instead of selecting the custodian from the right, I typed in the email address.&nbsp; basically came up with this txt file.&nbsp; However, I see a line that differs and not sure what that means.
((name:0 OR name:jdoe.domain.org)
(name:jdoe.domain.org AND date:[03/10/2013-03/10/2013] AND anum:[anum:0-0] AND (ssid:{**} AND NOT qeaultzkxolicykiction:exclude)
&nbsp;
&nbsp;
name (ESQany - 0): jdoe@domain.org
	date (0): 10/3/2013 12:00:00 AM to 10/3/2013 11:59:59 PM
	anum (0): 0 to 0
	Vault.PolicyAction (ESQall): -EXCLUDE
	***** The last 5 are And
Native Query:
	-------------
	(name:jdoe.domain.org AND date:[03/10/2013-03/10/2013] AND anum:[anum:0-0] AND (ssid:{**} AND NOT qeaultzkxolicykiction:exclude) AND snum:[snum:1-4294967294]) AND (anum:[anum:0-0])
	#rank&nbsp; #rankend
Raw Query:
	----------
	"name" 0 "jdoe@domain.org"
	"date" 0 [20131003:000000-20131003:235959]
	"anum" 0 0-0
	"&#127;Vault&#127;&#127;PolicyAction" 1 "-EXCLUDE"
	"snum" 0 1-fffffffe
	0,5

Forum Discussion

Discovery Accelerator search results inaccurate

12 Replies

Related Content

Re: What is the difference between Enterprise Vault Compliance Accelerator and Enterprise Vault Discovery Accelerator?

EV discovery accelerator

Veritas Compliance Accelerator Configuration

How to audit Discovery Accelerator ?

Discovery Accelerator vs. Archive Discovery

Recent Discussions

Exporting and recreating split PST files

Discovery Accelerator Automatically accept search results issue

Exporting mail details without restoring

can we run any reports to pull the details of all the historical cases which are also deleted?

Moving DA databases