Forum Discussion

james14's avatar
james14
Level 3
11 years ago
Solved

Converter Sandbox 4252 errors

Hi All,

We recently deployed 2x new EV servers, one file and one mail.

Both are VM's with the following specs:

OS: Server 2012 R2 (Latest patches as of 07/07/2014)

Ram: 16GB

CPU: 8x vProcs

EV Version: 10.0.4.1354

VMware Tools: 9.4.5, build 1734305

Our EV file archiving server has been generating errors around the Converter Sandbox process for quite some time now. Symantec support are recommending a re-install of the entire OS, and also EV itself. Before we go down that path, I wanted to get the advice of some of the community members on here first. There must be a better way of resolving this then just blasting the thing and starting all over again. Yes it's a virtual machine, and yes all the config is back on SQL, but that's not really the point.

Below is a copy of the error. I have also attached a DTRACE which captured the 4252 errors occuring. I have noticed this in the DTRACE logs:

3935    13:38:03.238     [2672]    (EVConverterSandbox)    <5068>    EV:M    Loading DLL: D:\Program Files (x86)\Enterprise Vault\Converters\SCCDA.DLL Handle:74950000 Sts:0

3936    13:38:03.238     [9864]    (EVConverterSandbox)    <14584>    EV:L    {CMMStream::Close} (Entry)
3937    13:38:03.238     [9864]    (EVConverterSandbox)    <14584>    EV:L    {CMMStream::Close} (Exit) Status: [Success]
3938    13:38:03.238     [9864]    (EVConverterSandbox)    <14584>    EV:M    ~CMMStream Deleting file: T:\TEMP\EV$MMS$FM$C$6$SRC.tmp
3939    13:38:03.238     [9864]    (EVConverterSandbox)    <14584>    EV:M    ~CMMStream Delete failed: 5
3940    13:38:03.238     [9864]    (EVConverterSandbox)    <14584>    EV:L    {CMMStream::Close} (Entry)
3941    13:38:03.238     [9864]    (EVConverterSandbox)    <14584>    EV:L    {CMMStream::Close} (Exit) Status: [Success]
3942    13:38:03.238     [9864]    (EVConverterSandbox)    <14584>    EV:M    ~CMMStream Deleting file: T:\TEMP\EV$MMS$FM$C$6$DST.tmp
3943    13:38:03.238     [9864]    (EVConverterSandbox)    <14584>    EV:M    ~CMMStream Delete failed: 5

Symantec Error in Application Logs:

Log Name:      Symantec Enterprise Vault

Source:        Enterprise Vault 
Date:          4/09/2014 2:38:21 PM
Event ID:      4252
Task Category: Converter Sandbox
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      BNE-EV02.corp.detir.qld.gov.au
Description:
Abnormal error occurred within the Memory Mapped Stream object 
 
Name: C$1$SRC 
Reference: IM/OFM 
Vault Id:  
SaveSet Id:  
Attachment Id:  

For more information, see Help and Support Center at http://entced.symantec.com/entt?product=ev&language=english&version=10.0.4.0&build=10.0.4.1189&error=V-437-4252
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Enterprise Vault " />
    <EventID Qualifiers="49156">4252</EventID>
    <Level>2</Level>
    <Task>61</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-09-04T04:38:21.000000000Z" />
    <EventRecordID>41444</EventRecordID>
    <Channel>Symantec Enterprise Vault</Channel>
    <Computer>BNE-EV02.corp.detir.qld.gov.au</Computer>
    <Security />
  </System>
  <EventData>
    <Data>C$1$SRC</Data>
    <Data>IM/OFM</Data>
    <Data>
    </Data>
    <Data>
    </Data>
    <Data>
    </Data>
  </EventData>
</Event>

  • based on this thread and the other thread you posted, it looks like you may have some weird permissions things going on, this one is Access Denied, so i'm wondering if you were to run procmon whether you can see it showing the Access Denied there, maybe a weird GPO or some security software stopping certain operations

  • is Antivirus scanning that T:\TEMP location or any other EV locations?

  • No we have completely disabled AV now and it's still occuring.

  • based on this thread and the other thread you posted, it looks like you may have some weird permissions things going on, this one is Access Denied, so i'm wondering if you were to run procmon whether you can see it showing the Access Denied there, maybe a weird GPO or some security software stopping certain operations