Event ID 6578 and 6592 every 7 minutes In event log
I am running Enterprise Vault 9.0 on Windows Server 2003. I have recently completed migrating user archives from one server to another. I have taken the first offline. Now I am seeing the following 2 errors every 7 minutes in the event log of the new server. I researched and found Tech125610 which tells you to run a DTrace on the migrator service and use the EntryID that's found to search archives and identify the archive that needs to be Reset. I did just that but, when I search the archives it doesn't find any that match the EntryID. Are their other options to help track down the archive?
Event Type: Error
Event Source: Enterprise Vault
Event Category: Migrator Server
Event ID: 6578
Date: 4/13/2011
Time: 2:36:50 PM
User: N/A
Computer: Server01
Description:
Abnormal error occurred
Object: CVaultCache
Reference: RE(1)/fe
For more information, see Help and Support Center at http://evevent.symantec.com/rosetta/showevent.asp
Data:
0000: 54 68 65 20 52 50 43 20 The RPC
0008: 73 65 72 76 65 72 20 69 server i
0010: 73 20 75 6e 61 76 61 69 s unavai
0018: 6c 61 62 6c 65 2e 20 20 lable.
0020: 5b 30 78 38 30 30 37 30 [0x80070
0028: 36 62 61 5d 6ba]
Event Type: Error
Event Source: Enterprise Vault
Event Category: Migrator Server
Event ID: 6592
Date: 4/13/2011
Time: 2:36:50 PM
User: N/A
Computer: Server01
Description:
Abnormal error occurred
VaultId: CV
Reference: %2
For more information, see Help and Support Center at http://evevent.symantec.com/rosetta/showevent.asp
Data:
0000: 49 6e 76 61 6c 69 64 20 Invalid
0008: 70 6f 69 6e 74 65 72 20 pointer
0010: 20 5b 30 78 38 30 30 30 [0x8000
0018: 34 30 30 33 5d 4003]
nono, don't search the dtrace for vc*.aspx
You want to search the IIS logs (Start -> Run -> "logfiles" and press OK then go to W3SVC1 directory and then open up the logs and just do a search for "vc" and that will give you the page, the user and ip address that is calling it.
In the dtraces you'd be looking for the VC request coming in and the archive id, so when dealing with a dtrace you would typically first look for warnings or errors (EV~E for error, EV~W for warning), if none exist or they don't relate to your issue then you can look for other error codes (such as 0x800 or 0xc00) or simply the words either Fatal or Error and then try and get it from there
