Indexing backlog increasing - Event 41352
Hello everyone,
we do have an environment where the indexing backlog for all index volumes / archives is increasing. A few minutes after restarting the indexing service Event 41352 is occuring for many index volumes:
The processing of the Index Volume has stopped following errors.
Archive name: "Name of the archive"
Task: <none>
Index Volume ID: "ID of the volume"
Reason: <none>
Error Type: NonCritical
Description: Die COM-Klassenfactory für die Remotekomponente mit der CLSID {3A92686F-E5E8-4505-ABB5-49E5F725617A} konnte aufgrund des folgenden Fehlers nicht von Computer "evserver" abgerufen werden: 80070005 "evserver".
sometimes with the following error description:
Description: Could not connect to the storage service on "evserver". ArchiveId=["ID"] Inner exception: Die COM-Klassenfactory für die Remotekomponente mit der CLSID {3A92686F-E5E8-4505-ABB5-49E5F725617A} konnte aufgrund des folgenden Fehlers nicht von Computer "evserver" abgerufen werden: 800706ba "evserver".
At the same time DCOM Event 10006 and 10016 do appear in the system eventlog.
10006:Fehler "2147942405" in DCOM wurde vom Computer "evserver" empfangen, als versucht wurde, den folgenden Server zu aktivieren:
{3A92686F-E5E8-4505-ABB5-49E5F725617A}
10016: Durch die Berechtigungseinstellungen für "Anwendungsspezifisch" wird dem Benutzer "NT-AUTORITÄT\ANONYMOUS-ANMELDUNG" (SID: S-1-5-7) unter der Adresse "Adress of the evserver" keine Berechtigung vom Typ "Remote Aktivierung" für die COM-Serveranwendung mit der CLSID
{3A92686F-E5E8-4505-ABB5-49E5F725617A}
und der APPID
{9FB267AD-C6CE-4084-A18F-5100B54964B3}
im Anwendungscontainer "Nicht verfügbar" (SID: Nicht verfügbar) gewährt. Die Sicherheitsberechtigung kann mit dem Verwaltungstool für Komponentendienste geändert werden.
I can see the dcom events already occurring when starting the storage service but for a variety of CLSIDs. The CLSID mentioned above lead me to Enterprise Vault.StorageCrawler for which we modified the dcom configuration but the issue persists.
We already checked the following: https://www.veritas.com/support/en_US/article.000088120 .Firewall was disabled as well. Anyone having another idea what else to check? Version is 12.3 Please excuse the German phrases in the events, I can surely add the English ones if necessary. Search for items already indexed seems to be not affected.
Regards
Marc
Hello Marc,
The only reference I found to the error you mention is below: errorcode
Interestringly, this points to firewall, which you say is disabled. See if the advise in the entry resolves it. It might also be that a MS KB patch causes this. That however is hard to find, as you need to figure out when you started getting these events, and then figure out what changed on the system.
I don't have further ideas, sorry.
<edit> Further Googling showed:
https://www.veritas.com/support/en_US/article.000087698
other articles indicate firewall issue.
Hi everyone,
Gertjan might have been right. A few hours after installing September Windows updates on the EV server the issue is completely gone. DCOM messages stayed away and the indexing backlog went below the threshold within a few hours. Except of the Windows updates nothing else has been performed on the EV server.
Kind Regards
Marc
