Forum Discussion

mjscreen1's avatar
mjscreen1
Level 4
10 years ago

Enterprise Vault 7133 event log messages

 

We are seeing Event ID 7133 = "Some files were not collected because they have not been backed up. " for a Closed partition - I am trying to 100% clear on what is happening - hence posting "my theory" for validating or dismissing.


We are backing up partitions and use trigger files - same as for the open partition.
The Collection process finishes well inside the time window allocated for collections.
I see the 7133 event message is Informational.

Example:

"Log Name:      Symantec Enterprise Vault
Source:        Enterprise Vault
Date:          18/01/2015 18:10:43
Event ID:      7133
Task Category: Storage File Watch
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      ourserver.ourdomain.com
Description:   A Partition's Collector run has finished.

Some files were not collected because they have not been backed up.

Partition Root Path: \\ourstoragedevice\nas_sata_evdata1\EVServer01\MailBoxVaultStores\MBXVS02PTN9

Archived items: 73
Files added to collections: 1122
Collections: 28 "

 

Here is my theory -

The collection process "breaks down" and  "puts together" collections - according to the archive retention policy and dealing with sparse files ( https://www-secure.symantec.com/connect/blogs/events-logged-collections ) - I believe this might leave some files out of a collection at that particular point in time.  - hence when the Collection run finishes - it is true to say some files have not been backed up.

We then later place partitions into Backup mode, backup using trigger files and then bring out of Backup mode.

As the Collection always does something ( does not run in a type of informational mode way) - it always generates the Event ID 7133 messages.

Are the words above an accurate reflection of what is happening ?
and
This informational event log message is just that ( so not problems) though does inform you to do backups.

Enterprise Vault
Error messages
Information Governance
Windows Server (2003-2008)
  • AndrewB's avatar
    AndrewB
    10 years ago

    it's kind of a chicken/egg type situation the way i see it and i agree that the event message is more FYI.

    however:

    are you running collections before you backup? might make sense to schedule them to begin after backups complete. 

    does your archiving schedule overlap with your collections schedule? you want to avoid any overlap. 

    are users allowed to manually archive? could be related if you're running collections during business hours when users are archiving.

    there are a few things like these that you can check to reduce the likelihood of some files not being collected. but all in all it's nothing to be alarmed about

12 Replies

Sort By
  • AndrewB's avatar
    AndrewB
    Moderator
    10 years ago

    it's kind of a chicken/egg type situation the way i see it and i agree that the event message is more FYI.

    however:

    are you running collections before you backup? might make sense to schedule them to begin after backups complete. 

    does your archiving schedule overlap with your collections schedule? you want to avoid any overlap. 

    are users allowed to manually archive? could be related if you're running collections during business hours when users are archiving.

    there are a few things like these that you can check to reduce the likelihood of some files not being collected. but all in all it's nothing to be alarmed about

  • mjscreen1's avatar
    mjscreen1
    Level 4
    10 years ago

    Hi AndrewB, thank you for responding

    We run daily backups - starting at 3 am - this finishes usually in 3 hours ( 6am ish)

    The Collections are run from 6PM until 10PM - this is verified from the event logs - I believe we have no overlap - to answer the question, we run backup then collection then next days backup and next days collection etc

    Users cannot manually archive

  • AndrewB's avatar
    AndrewB
    Moderator
    10 years ago

    so you have a 12 hour gap between the end of your backup and the start of collections. that's 12 hours where items (that havent been backed up) could be archived and result in the message you're getting.

    and what's the schedule for your archiving tasks? might make sense to adjust collections to start closer to the end of your backup window.

  • mjscreen1's avatar
    mjscreen1
    Level 4
    10 years ago

    Our Archiving shedule runs from 10 PM ( afer the collection finishes ) through to 3AM ( when the Backup starts)

     

  • mjscreen1's avatar
    mjscreen1
    Level 4
    10 years ago

    Hi,  - we do not journal - also re-iterating we see this for a closed partition ( not sure if relavent ) - thank you

  • AndrewB's avatar
    AndrewB
    Moderator
    10 years ago

    i must have missed it before if you said your inquiry is about a closed partition. as you may know, cab files will be extracted if/when users retrieve archived items from them or if items are exported by the admin or by an eDiscovery process (even in a closed partition including index rebuilds and other admin activity.)

    bottom line, nothing really to worry about.

  • ManishN's avatar
    ManishN
    Level 4
    10 years ago

    In this case i would recommend to create a trigger file for that closed partition(since you are using trigger file)  when you perform a backup for the next schedule.

  • mjscreen1's avatar
    mjscreen1
    Level 4
    10 years ago

    Thank you ManishN -  We have tried this already - and still get the
    "Some files were not collected because they have not been backed up."


     

  • ManishN's avatar
    ManishN
    Level 4
    10 years ago

    I guess "Some files were not collected because they have not been backed up" is generic informational message along with the print of Event ID 7133 and not a problem.

    If files are not been collected then you will see something like below

    Archived items: 0 |Files added to collections: 0 |Collections: 0

    If files are collected then you will see something like

    Archived items: 1 |Files added to collections: 7 |Collections: 1

    In your case event you see

    Archived items: 73
    Files added to collections: 1122
    Collections: 28 "

    So it looks not an issue. If the items are getting collected when run, in the end it gives you information in the Event ID 7133. However i will confirm this.