Forum Discussion

SheltonS's avatar
SheltonS
Level 3
13 years ago
Solved

How do you find what objects have been retrieved from the Archive in the last 48 hours?

I'm new to EV (inherited it last month) and we just had an issue where an FSA protected volume suddenly lost 250GB of space over the weekend.  We show that no one added that much data to the volume so the only explination we can come up with is someone or something triggered a restore from archive for the 250 GB.  Being new to EV, however, I can't figure out how to prove this or find what person or process casued it assuming it was EV.  I've looked at the reports and they seem weak on this type of need and I found out we do not have auditing turned on.

Can anyone help?

 

Thanks,

Shelton

Enterprise Vault
Features
Information Governance
Monitoring
Reporting
  • TonySterling's avatar
    TonySterling
    13 years ago

    So there is one caveat, do you use Last access time for your rules?

    The following TN has this:

    A file that is recalled to the file server replaces the placeholder shortcut.

    • If the recalled file remains unmodified, then Enterprise Vault converts the file back to a placeholder on the next archiving service run. The only exception is if the archiving policy's shortcut creation rules are based on the last access time. In that case, Enterprise Vault reverts the file only when the shortcut creation rules are met.

    • If the recalled file becomes modified, then Enterprise Vault converts the file back to a placeholder according to the archiving policy's shortcut creation rules.

    About placeholder shortcuts

    Article:HOWTO57685  |  Created: 2011-08-01  |  Updated: 2012-09-23  |  Article URL http://www.symantec.com/docs/HOWTO57685

     

4 Replies

Sort By
  • TonySterling's avatar
    TonySterling
    Moderator
    13 years ago

    without auditing it will be a bit difficult to know for sure.

    One thing to note, even if some recalled a lot of items the next time the FSA archive task ran it would normally convert them back to placeholders, unless you set a registry key to prevent it.

  • SheltonS's avatar
    SheltonS
    Level 3
    13 years ago

    I was afraid that not having auditing was going to limit the information.  I have since activated it.

     

    As for the other comment, won't the files need to re-age again before they will be converted back to placeholders?

  • TonySterling's avatar
    TonySterling
    Moderator
    13 years ago

    No, FSA is a bit different than Mailbox shortcuts.  When you view a placeholder it only temporarily restores the item to the file server.  Some times the item reverts to placeholder before the archive task runs but if it hasn't yet reverted the file will be turned back into a placeholder with the task runs.

     

  • TonySterling's avatar
    TonySterling
    Moderator
    13 years ago

    So there is one caveat, do you use Last access time for your rules?

    The following TN has this:

    A file that is recalled to the file server replaces the placeholder shortcut.

    • If the recalled file remains unmodified, then Enterprise Vault converts the file back to a placeholder on the next archiving service run. The only exception is if the archiving policy's shortcut creation rules are based on the last access time. In that case, Enterprise Vault reverts the file only when the shortcut creation rules are met.

    • If the recalled file becomes modified, then Enterprise Vault converts the file back to a placeholder according to the archiving policy's shortcut creation rules.

    About placeholder shortcuts

    Article:HOWTO57685  |  Created: 2011-08-01  |  Updated: 2012-09-23  |  Article URL http://www.symantec.com/docs/HOWTO57685