It has stopped crashing after editing the registry entry but I'd be interested to hear what people have to say about it. So in the interest of continued learning: And this is long folks but since you asked.
Event Logs:
------------------------------------------
From the Enterprise Vault Log:
Event Type: Information
Event Source: Enterprise Vault
Event Category: None
Event ID: 24624
Date: 11/19/2007
Time: 3:30:08 PM
User: N/A
Computer: NTSERVER
Description:
Scan of \\ntserver.domain.alcomgt.com\d$\shared\IT Dept started.
------------------------------------------
Again From Enterprise Vault log:
Event Type: Information
Event Source: Enterprise Vault
Event Category: None
Event ID: 24624
Date: 11/19/2007
Time: 3:47:19 PM
User: N/A
Computer: NTSERVER
Description:
Scan of \\ntserver.domain.alcomgt.com\d$\shared started.
------------------------------------------
From the Application Log:
Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Date: 11/19/2007
Time: 3:49:14 PM
User: N/A
Computer: NTSERVER
Description:
Faulting application FSAReportingService.exe, version 7.5.1.1397, faulting module RDScan.dll, version 7.5.1.1397, fault address 0x000057aa.
------------------------------------------
Relevant DTRace Info:
"
148519 16:27:58.691 [2176] (FSAReportingService) <576> EV:M CFSAReporting::GetVolumeLocalPath Server name: ntserver; Share name: d$
148520 16:27:58.691 [2176] (FSAReportingService) <576> EV:M CFSAReporting::GetVolumeLocalPath The object path is D:\
148521 16:27:58.707 [2176] (FSAReportingService) <576> EV:L CFSAReporting::GetSchedules adding reporting objects: 1 |
148522 16:27:58.707 [2176] (FSAReportingService) <576> EV:L CFSAReporting::GetSchedules size of Server Info vector 1
148523 16:27:58.707 [2176] (FSAReportingService) <576> EV:L CFSAReporting::StartSchdeuled method called |
148524 16:27:58.707 [2176] (FSAReportingService) <576> EV:M CFSAReporting::StartSchdeuled schedules started |
148525 16:27:58.722 [2176] (FSAReportingService) <896> EV:L Shedulethread method called |
148526 16:27:58.722 [2176] (FSAReportingService) <896> EV:M Timer is set for waiting |
148682 16:43:29.976 [2176] (FSAReportingService) <576> EV:L CFSAReporting::get_Servers method called |
148683 16:43:29.991 [2176] (FSAReportingService) <576> EV:L CServers::get__NewEnum method called
148684 16:43:29.991 [2176] (FSAReportingService) <576> EV:L CServer::get_Name method called
148685 16:43:29.991 [2176] (FSAReportingService) <576> EV:L CServer::GetScanStatus method called
148686 16:43:29.991 [2176] (FSAReportingService) <576> EV:L CFSAReporting::GetServerInfoIndex method called ntserver |
148687 16:43:29.991 [2176] (FSAReportingService) <576> EV:L CFSAReporting::GetServerInfoIndex returning index 0
148688 16:43:29.991 [2176] (FSAReportingService) <576> EV:H CServer::GetScanStatus scanstatus is 0
148689 16:43:30.069 [2176] (FSAReportingService) <576> EV:L CFSAReporting::get_Servers method called |
148690 16:43:30.085 [2176] (FSAReportingService) <576> EV:L CServers::get__NewEnum method called
148691 16:43:30.085 [2176] (FSAReportingService) <576> EV:L CServer::get_Name method called
148692 16:43:30.085 [2176] (FSAReportingService) <576> EV:L CServer::GetScanStatus method called
148693 16:43:30.085 [2176] (FSAReportingService) <576> EV:L CFSAReporting::GetServerInfoIndex method called ntserver |
148694 16:43:30.085 [2176] (FSAReportingService) <576> EV:L CFSAReporting::GetServerInfoIndex returning index 0
148695 16:43:30.085 [2176] (FSAReportingService) <576> EV:H CServer::GetScanStatus scanstatus is 0
**** DTrace exit - log terminated
Registry info
HKEY_LOCAL_MACHINE\SOFTWARE\KVS\Enterprise Vault
\Admin
\Auditing
LogDatabaseInformation (DWORD) 0 [0x0]
\Categories
OnOrOff (DWORD) 1 [0x1]
\FSA
LogLevel (DWORD) 0 [0x0]
SiteID (SZ) 1243310379BA25A4DA11014E47E79BBD01d10000AlcoVault.Domain.AlcoMgt.com
FileServerID (SZ) 1CAE9716A0954DF42A4EE2FEAFB995CBF1z10000AlcoVault.Domain.AlcoMgt.com
\FileScreenService
CentralizeQuarantineLocation (SZ)
CentralizedQuarantineEnabledFlag (SZ) 0
SMTP Server (SZ)
Sender (SZ)
ExchangeServer (SZ)
ExchangeUser (SZ)
MailType (SZ) 0
QuarantineDir (SZ)
\ExcludeUsers
0 (BINARY)01 05 00 00 00 00 00 05 15 00 00 00 8e 5f 41 53 79 39 8d 2f d2 6d ff 36 9b 0b 00 00
\Parameters
(Default) (SZ)
Flags (DWORD) 1 [0x1]
\Signature
*.aif (SZ) ##################################0000##############00##40########00##000000####################0000############00
Incomplete (error=More data is available. [0x800700ea])
\SNMP
PathName (SZ) C:\Program Files\Enterprise Vault\FSA_SNMP_Agent.dll
\PlaceholderService
FileSizeEmulation (DWORD) 0 [0x0]
OpenFileTimeout (DWORD) 30 [0x1e]
ReleasedItemExpiryInterval (DWORD) 5 [0x5]
ReleasedItemProcessingInterval (DWORD) 5 [0x5]
ReleasedItemRetries (DWORD) 2 [0x2]
ExcludedExes (SZ) ntrtscan.exe;PccNTMon.exe;PccNT.exe;TmListen.exe;tsc.exe;vxmon.exe;beremote.exe,ofcdog.exe;tmpfw.exe;tsc.exe;vscanwin32.exe
RecallLimitMaxRecalls (DWORD) 20 [0x14]
RecallLimitTimeInterval (DWORD) 10 [0xa]
BypassRecalLimitsForAdmins (DWORD) 0 [0x0]
NoOfItemProcessorThreads (DWORD) 20 [0x14]
RevertItemsToPlaceholders (DWORD) 1 [0x1]
\Reporting
FilePartSize (DWORD) 500 [0x1f4]
WebServiceTimeout (DWORD) 20 [0x14]
ReportingServer (SZ)
http://SHIVA ScanThreads (DWORD) 5 [0x5]
RDBufferSize (DWORD) 48 [0x30]
SiteID (SZ) 1243310379BA25A4DA11014E47E79BBD01d10000AlcoVault.Domain.AlcoMgt.com
RDThreads (DWORD) 8 [0x8]
TempFilePath (SZ) C:\Program Files\Enterprise Vault\
\Install
PlaceHolder (SZ) Installed
(Default) (SZ)
InstallPath (SZ) C:\Program Files\Enterprise Vault\
Version (SZ) 7.5.1.1397
MSIVersion (SZ) 7.5.5493
-----
[Closed: 2007/11/20 16:44:02]
=====
"
Sorry to dump so much out there but I've always appreciated as full descriptions of issues as possible. Again my fix appears to be working but I would appreciate if someone were able to tell me a little more if there is another possible cause.
