Forum Discussion

Dushan_Gomez's avatar
Dushan_Gomez
Level 6
14 years ago

Abnormal error occurred in Stream object Error ?

Hi,

Is there anything that I should look or worry about this error event ID:

 

EVSrv01-VM 09/04/2011 6:15:22 PM
Enterprise Vault 
 
Abnormal error occurred in Stream object
Name: C:\DOCUME~1\evadmin\LOCALS~1\Temp\EV_CVT_Temp_1\0002.htm
Reference: OF/cf
 
because this is one of the event viewer that I come across with during my investigation in EV Server backup failure.
Enterprise Vault
Error messages
Information Governance
Troubleshooting
VMware
Windows
  • JesusWept3's avatar
    JesusWept3
    14 years ago

    The fact that it grows to 5.4GB then goes down to nothing to me suggests you have your Vault Store Partition set to "After Backup" meaning that items have to be backed up on the Enterprise Vault Stores before the items are removed from the journal mailbox.

    In Enterprise Vault on the Vault Store Partition Properties you have three options for removing safety copies

    1. After Backup
    2. After Backup (Immediately For Journaling)
    3. Immediately

    In an After Backup scenario ALL mailboxes regardless of being a user mailbox, resource mailbox, journal mailbox etc, will have their items put in to a pending mode, so that the item exists both in Enterprise Vault and in Exchange, then when the item on the Enterprise Vault server is confirmed as being "Secure" (i.e. backed up to tape or disk and the archive bit removed), then it switches from a Pending Item to an Archived Item (replaced with a shortcut).

    In regards to Journaling, it simply deletes the item out of the mailbox after the backup has been confirmed


    In an After Backup (Immediately For Journaling) scenario, mailboxes have items put in to a pending mode, and will await for the items to be backed up before turning them in to a full archived item shortcut, however because most companies with journaling end up having huge mailboxes and cannot wait for a backup to occur, they take a small risk by saying "Immediately After Archiving", meaning as soon as Enterprise Vault has confirmed it has stored the item on the EV Servers, then it will simply delete the message out of the journal mailbox.

    The last scenario is Immediately after archiving, meaning that for all mailboxes, when you run an archiving task, or someone manually archives an item, or an item gets journaled, then it will keep them in a pending state for only a few seconds until EV has confirmed it has archived the item properly.

    This one has the most risk, for instance if you have an item in your mailbox and you archive it, EV goes ahead and creates the files necessary on the EV server, and then it effectively deletes the original message in the users mailbox replacing it with a shortcut (i.e instead of being a long email with 5000 characters, it now is limited to 500 characters, and the attachments have been stripped etc).....

    When you double click the item, it then retrieves from the EV storage, if the EV Server is offline or the data isn't available on the server, they will see an error that item could not be retrieved.....So the risk then comes in if you lose EV storage BEFORE the item has been backed up, if you have to go back to a previous nights backup, you have now lost data (because the new item was never backed up) etc

13 Replies

Sort By
  • Dushan_Gomez's avatar
    Dushan_Gomez
    Level 6
    14 years ago

    and also the following two Events:

    Event Type: Error

     

    Event Source: Enterprise Vault 
    Event Category: File System Archiving Task 
    Event ID: 41070
    Date: 10/04/2011
    Time: 6:01:07 AM
    User: N/A
    Computer: EVSrv01-VM
    Description:
    File archiving on FSCLuster01 Homedir FSA Task reported 2541 errors.  See report file for details. 
    For more information, see Help and Support Center at http://evevent.symantec.com/rosetta/showevent.asp

    ---------------------------------------------------------------------------------------------------------------------------------------------

    EvSrv01-VM 11/04/2011 12:00:07 AM Enterprise Vault 3221490949
    This mailbox has duplicate entries in the directory and cannot be processed.

    LegacyDN:
    /O=CorporateFinancialSERVICES/OU=SYDNEY/CN=RECIPIENTS/CN=EVJOURNAL
     
    DefaultVaultID:
    16B2B914BDF05B141A7696FFFA98C44E31110000EvServerP01
     
    Image full URL: https://www-secure.symantec.com/connect/imagebrowser/view/image/1727771/_original
     
  • JesusWept3's avatar
    JesusWept3
    Level 6
    14 years ago

    For the File Server Archiving error, you are going to have to go to your installation directory then look under reports and the find the last File Server Archiving report and open it up and find in there where the errors are occuring. It could be anything from permissions to the file being in use etc.

    For the Mailbox has duplicate entries, go by the following technote:
    http://www.symantec.com/business/support/index?page=content&id=TECH56857

    As for the converter error, do you have Anti Virus excluding that directory from being scanned?

  • Dushan_Gomez's avatar
    Dushan_Gomez
    Level 6
    14 years ago

    Thanks Jesus for your quick reply,

    "As for the converter error, do you have Anti Virus excluding that directory from being scanned?"

    so do you mean that I must exclude that directories in the FileServer or in the EV Server ?
    I do have SEP in both servers but I didn't exclude anything so it should scan all without exception.

  • JesusWept3's avatar
    JesusWept3
    Level 6
    14 years ago

    OK so on the Enterprise Vault servers, there are several places that you need to exclude from being scanned, these will be the Vault Store Partitions, the Index Locations, the Cache locations and the Temp directory.

    So for the Vault Stores you would exclude something such as
    E:\Enterprise Vault\VaultStore Ptn1\

    For the Indexes you'd exclude something such as the following
    I:\Enterprise Vault\Index1\
    I:\Enterprise Vault\Index2\
    I:\Enterprise Vault\Index3\

    For the cache location, when you go to the property of your Enterprise Vault Server in the Vault Admin Console, you will have a Cache Location specified, this is where the MDC/DB files are created and downloaded to users when their vault cache is being built

    So for instance if you give someone Vault Cache capabilities, EV will create several PST files in something like E:\Enterprise Vault\EVCache\ ... then when the MDC/DB (PST Files) have been built, they will be downloaded to the client then deleted from the server.

    For the Temp directory, this would be
    C:\Documents and Settings\EVAdmin\Local Settings\Temp (Windows Server 2003)
    C:\Users\EVAdmin\AppData\Local\Temp (Windows Server 2008)

    In this location, a bunch of items are created, so when EV archives an item it creates TMP files in this directory, and then when the DVS/DVSSP files are finalized the TMP Files are then deleted.

    Also when an item is being converted to either HTML or TXT, the files are opened and converted and their contents are placed in the temp directory....again when the DVSCC file has been created, the temporary files are then deleted

    If you look at the error above, you are seeing an issue with the item being converted in the temp location

    Name: C:\DOCUME~1\evadmin\LOCALS~1\Temp\EV_CVT_Temp_1\0002.htm

    You can tell that its a conversion file due to the CVT name here.
    Anti Virus can be the cause of a lot of issues, especially when you have On Access scanning, meaning that it can read/write information to the file, sometimes incorrectly identifying items as a virus or trojan and then deleting the item (by quarantining it)


    What some customers do as a compromise if they have McAfee AntiVirus or another anti virus with the capability is by excluding the Processes accessing the items from getting the item scanned.

    For instance you exclude EVConverterSandbox.exe from having anything it does scanned.
    So if EVConverterSandbox.exe accesses 0002.htm, the Anti Virus Scanner will not scan the item
    But if another process such as Notepad.exe opens 0002.htm, then it will scan it etc


    Anti Virus scans and exclusions should be detailed in the Administrators guide
    You can also read more here:
    http://www.symantec.com/business/support/index?page=content&id=TECH48856


     

  • JesusWept3's avatar
    JesusWept3
    Level 6
    14 years ago

    Well before we go any further, is the EV journal task working correctly and the journal mailbox being cleared out properly?

     

  • Dushan_Gomez's avatar
    Dushan_Gomez
    Level 6
    14 years ago

    Sorry to interrupt you again man,

    "your installation directory then look under reports and the find the last File Server Archiving report" --> which one ? my EV Server or my Windows Server File System cluster ?

  • JesusWept3's avatar
    JesusWept3
    Level 6
    14 years ago

    The EV Installation directory (i.e. C:\Program Files\Enterprise Vault\Reports\)

     

  • Dushan_Gomez's avatar
    Dushan_Gomez
    Level 6
    14 years ago

    hm... good question Jesus,

    the EVJournal mailbox that is used by Symantec is currently 5.6 GB+ and wil always grow, does it eventually comes down to zero or lower size of will it be growing unti it cannot grow anymore ?

  • Mohawk_Marvin's avatar
    Mohawk_Marvin
    Level 6
    14 years ago

    It depends on the volume of traffic hitting the mailbox and the settings on the task.

    However that said 5.6gb and growing suggests that the journal task is most likely hosed.