Forum Discussion

KeirL's avatar
KeirL
Level 6
11 years ago

EV10.0.4 slow journal archiving

Hello

I'm trying to find a good workflow technote on EV journalling to help troubleshoot a slow journal archiving scenario.

Is there anything around that could help?

Essentially we're testing a single journal arhcive that recieves about 4 messages a second (about 15k per hour). I was expecting the EV server to keep pace with this over a 24Hr period but finding that even after 1 hr it falls woefully behind and before long the number of IPM.Note messages raises above 1000 which has the effect of causeing the pending items never to be removed from the journal mailbox - Symantec say this is a hard-coded limit  - which subsequently causes journal issues with Exchange.

A Dtrace run by Symantec has shown that the EV server is archiving about 1 item every 2 seconds

Symantec have offered several opinions - They said the issue is with the Hub Transport server causing a bottle neck as Exchange passes the messages back through the HT server when EV archives the items....!? really?  I can't see any connection with archiving items from the Journal mailbox and the HT server - surely once the email is in the journal mailbox the HT server is no longer in the equation - but happy to stand corrected.

They also say that another EV Journal server could help - but looking at the resources of the current journal server it's bearly breaking a sweat when looking at CPU and RAM.

Also the SQL server is also good as far as CPU/RAM/Network goes.

Should I be concentrating on Disk IO (EVserver or SQL server?)? Message Queues (which ones)? Disk IO on message Queue disk?

From what I can see visually the items change from IPM.Note to Pending Archive pretty quickly but then spend an age being deleted from the mailbox - so what is EV doing during the part of the process?

There are probably lots of things that can cause archiving to be slow so I guess I'm just after a set of logical steps to narrow things down - hence why I thought some kind of process flow would be a good place to start.

thanks in advance

Enterprise Vault
Information Governance
Windows 8
  • AndrewB's avatar
    AndrewB
    11 years ago

    do you have any AV or AS scanning going on in Exchange?

  • KeirL's avatar
    KeirL
    Level 6
    11 years ago

    Thanks again

    I'm perhaps still a little confused - so the limit associated with the MSMQ journal setting has nothing to do with the EV journal queues but it instead refers to the actual Journal for the MSMQs themselves (I can get that bit)....and enabling MSMQ Journalling isn't a good idea unless Symantec support say to do this as it fills up quick....but it's still a good practive to change the setting from 1Gb to 8Gb anyway? - is that just in case Symantec say to enable it?

    But I've seen to have seen a couple of posts where users appear to have 'fixed' slow journal mailbox archiving by increasing this figure and also some posts whereby Alex has spoken about 'hitting the 1Gb limit'

    see below

    https://www-secure.symantec.com/connect/forums/journal-archiving-very-slow  (final post)

    https://www-secure.symantec.com/connect/forums/journaling-mailbox-keeps-increasing (see Alex's bit on 'breeching the 1Gb limit)

    I still think there is a concept here that I'm mis-understanding........

    thanks

  • KeirL's avatar
    KeirL
    Level 6
    11 years ago

    Thanks

    I've started a new thread with this now as I'm trying to research the archive queues a little more closely to help me understand the inner workings.

    https://www-secure.symantec.com/connect/forums/ev-journal-archiving-queues

    cheers