Forum Discussion

BBradwell's avatar
BBradwell
Level 3
8 years ago

Large block of emails missing from Discovery Accelerator

I've recently been doing some DA searches against our Exchange journal and found that we can't find any emails between 27/06/2013 and 03/10/2014 inclusive apart from three random ones dated 10/07/2014, 15/07/2014 and 31/07/2014.

Looking at the indexes for the journal I found the following information:

Index No.LocationIDNo. of itemsStartEndOldestNewestMissing Items
1K:950015051500150604/11/200520/10/20121
2K:236500000150015071000151020/10/201226/06/20133
3K:2685000004100015112002047117/11/201103/10/20142
4K:4975000004200204722502047810/07/201404/06/20153

 

This seems to indicate a problem with index number 3 which covers that period (17/11/2011 - 03/10/2014).

Although index 4 claims to cover some of the missing period we still don't get results before 03/10/2014 apart from those three random ones.

Is there anything we can do to verify that the emails were added to the journal by interrogating the SQL database for instance?

Thanks,

Mark Whitmarsh.

  • GertjanA's avatar
    GertjanA
    Moderator
    8 years ago

    Hello Mark,

    1 option would be to grant yourself permission on the Journal Archive, then use the search page to look for the specific item. That however might be slow and cumbersome...

    If you are on EV10 or higher, have you tried the Index Administration to verify, possibly sync the index? If possible, (being on EV10 or 11) can you rebuild that one location? doing 5 mill items is not fast, might take a few days.

    If this is for an active archive, I would create a new archive, set that as target in the Journal Mailbox definition in EV, then rebuild.Again, a verify and a sync are your first options, rebuild only if verify/sync does not resolve.

    • BBradwell's avatar
      BBradwell
      Level 3
      8 years ago

      Hi Gertjan,

      I've given myself access to the journal archive and still only found the same three emails that I found with a DA search.

      FYI we're on EV11 and I did a basic check on the suspect index but that came back with no errors. Will a complete check have an impact on the journalling performance? Bearing in mind this archive is the only journal we have for all our emails I don't want to create any unecessary burden on the servers.

      What would be really useful to know is which index the odd three emails were found in but from my brief look at the database I can't work out how to trace them through the tables.

      Mark.

       

      • GertjanA's avatar
        GertjanA
        Moderator
        8 years ago

        Hello Mark,

        Performing a through check on the indexes, or perhaps a rebuild will affect Journaling performance, in that indexing items will not occurr until the index action is finished. 

        To prevent that, see my remark on creating a new archive. The new archive will be using it's own indexes, allowing EV to index whilst for the other archive you are running index verification. I currently do not have access to EV so can't get you exact details. What you could do is in the index administration tasks, look at the indexes you can add for verification. Does the amount of 'indexed items' add up to the start/end itemcount?

        It might be the indexes are fragmented. There is a KB somewhere which describes how to get the indexes defragged. That also has impact. Whatever action you select, a warning will show the effect of the action. For instance, if you select Verify thorough with include missing content, you'll see that during that check no new items will be added to the index, but the index can be searched. A rebuild however will prevent both. 

        I would create a new archive, start using that (in DA, it will search both archives btw, so no issue there), and then action the index which should have the items in there.