Forum Discussion

dorlow1's avatar
dorlow1
Level 3
8 years ago

Mailbox not vaulting

I have one user that I am attempting to vault.  When I first received the request, I added the user to the Windows sercurity provisioning group that added user to be provisioned for EV.  I then synced the mailbox and started the forced archive.  When the request came in, the user's mailbox was close to 100 GB!  The mailbox is now down to 30 GB and 59 GB is in the vault.  But the policy the user is assigned to moves all IPM.Note items older than 60 days to the Vault.  I impersonated his mailbox in OWA and he still has many items older than 60 days in his mailbox.  I've forced vaulted him many times.  Nothing more is moving to the Vault.  Earlier today, I disabled him for Vault, zapped both the archive and his mailbox and re-enabled him.  Still nothing moving to vault.  

I've followed this link.

https://vox.veritas.com/t5/Articles/Troubleshootin...

The user is still part of our 60 day provisioning group.  (I uploaded an image showing he is...)

His mailbox is not hidden in the GAL or disabled in AD.

He is not disabled for archiving.  I check that by attempting to disable someone.  If they're not provisioned at all, I can't find them to enable or disable.  But if I can disable someone, I know they're enabled.  (I then just cancel out of the disable user wizard.)

The user is still on the same mailbox server as then the ticket came in.

About this entry...

Wrong mix of policy settings?

Sometimes in a purely quota based archiving situation it might seem like items are not being archived, but really that might be perfectly normal.

We don't have quotas, so this is not it.  We don't have Symantec support anymore.  But Symantec used to always focus in on the quota for a user and I'd have to overly disprove them that there are no quotas.  They'd pull out the dtrace and say, the user does have a quota because dtrace shows it.  I'd show them over and over, no they don't.  After an hour or so, they'd drop it and we'd find the problem elsewhere.  But here's the proof...

[PS] C:\Windows\system32>get-mailbox user | fl *database*,*quota*

Database                     : DAG02DB10
UseDatabaseRetentionDefaults : False
UseDatabaseQuotaDefaults     : True
ArchiveDatabase              :
DisabledArchiveDatabase      :
ProhibitSendQuota            : unlimited
ProhibitSendReceiveQuota     : unlimited
RecoverableItemsQuota        : unlimited
RecoverableItemsWarningQuota : unlimited
UseDatabaseQuotaDefaults     : True
IssueWarningQuota            : unlimited
RulesQuota                   : 64 KB (65,536 bytes)
ArchiveQuota                 : unlimited
ArchiveWarningQuota          : unlimited

[PS] C:\Windows\system32>get-mailboxdatabase dag02db10 | fl *quota*

ProhibitSendReceiveQuota     : unlimited
ProhibitSendQuota            : unlimited
RecoverableItemsQuota        : 30 GB (32,212,254,720 bytes)
RecoverableItemsWarningQuota : 20 GB (21,474,836,480 bytes)
QuotaNotificationSchedule    : {Sun.1:00 AM-Sun.1:15 AM, Mon.1:00 AM-Mon.1:15 AM, Tue.1:00 AM-Tue.1:15 AM, Wed.1:00 AM-
                               Wed.1:15 AM, Thu.1:00 AM-Thu.1:15 AM, Fri.1:00 AM-Fri.1:15 AM, Sat.1:00 AM-Sat.1:15 AM}
IssueWarningQuota            : unlimited

Below is a snippet of a dtrace on archivetask. (I doctored it up removing our company name and other identifiable information of the innocent...)

24254    09:36:50.631     [8272]    (ArchiveTask)    <9252>    EV:M    FindExchServerDn - Exchange Server Found. DN: CN=TN001WEXMBX004,CN=Servers,CN=Exchange Administrative Group (FYDIBOHF23SPDLT),CN=Administrative Groups,CN=xxx Exchange,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=xxx,DC=net
24255    09:36:50.631     [8272]    (ArchiveTask)    <9252>    EV:M    {GetExchangeServerValues:#4291} Exchange DN: [CN=TN001WEXMBX004,CN=Servers,CN=Exchange Administrative Group (FYDIBOHF23SPDLT),CN=Administrative Groups,CN=xxx Exchange,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=xxx,DC=net]|Exchange AD search path: [GC://TN001WGC11.US.xxx.net]|Exchange FQDN: [US.xxx.NET]
24256    09:36:50.631     [8272]    (ArchiveTask)    <9252>    EV:L    {CExchangePolicyCache::GetDefaultPolicy:#270} Default policy is [13C154C35E01BC147B294FA9B593FFEAF1012700EVSARCHIVE01 (Default Exchange Mailbox Policy)]
24257    09:36:50.631     [8272]    (ArchiveTask)    <9252>    EV:H    {CArchivingAgent::ProcessUserEx:#18105} Beginning processing of mbx [], mode [RN_ARCHIVING, RN_SCPROCESSING (0x3)], report mode [False]...
24258    09:36:50.631     [8272]    (ArchiveTask)    <9252>    EV:M    CMailboxUsage::SetMailboxInUse - Adding MbxDN to List:[/O=xxx EXCHANGE/OU=EXCHANGE ADMINISTRATIVE GROUP (FYDIBOHF23SPDLT)/CN=RECIPIENTS/CN=USERNAME]
24259    09:36:50.631     [8272]    (ArchiveTask)    <9252>    EV:L    {CArchivingAgent::Initialise} (Entry)
24260    09:36:50.631     [8272]    (ArchiveTask)    <9252>    EV:L    {MigratedDominoItems::Reset} (Entry)
24261    09:36:50.631     [8272]    (ArchiveTask)    <9252>    EV:L    {MigratedDominoItems::Reset} (Exit)
24262    09:36:50.631     [8272]    (ArchiveTask)    <9252>    EV:L    CPrioritizedItemTable::InitialiseTable(Age) - Setting up the table.  Size: [1000]
24263    09:36:50.631     [8272]    (ArchiveTask)    <9252>    EV:L    CPrioritizedItemTable::InitialiseTable(Quota) - Setting up the table.  Size: [1000]
24264    09:36:50.631     [8272]    (ArchiveTask)    <9252>    EV:L    {CArchivingAgent::Initialise} (Exit) Status: [Success]
24265    09:36:50.631     [8272]    (ArchiveTask)    <9252>    EV:M    CAA::PUEX() - Calling FindUser()|LegacyMbxDn = /o=xxx Exchange/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Recipients/cn=username|ExchangeFQDN = US.xxx.NET|ExchSearchPath = GC://TN001WGC11.US.xxx.net
24266    09:36:50.631     [8272]    (ArchiveTask)    <9252>    EV:M    SanitizeUserName() - Sanitized username '/o=xxx Exchange/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Recipients/cn=username' to '/o=xxx Exchange/ou=Exchange Administrative Group \28FYDIBOHF23SPDLT\29/cn=Recipients/cn=username'
24267    09:36:50.631     [8272]    (ArchiveTask)    <9252>    EV:M    FindUser() - Using searchbase GC://TN001WGC11.US.xxx.net
24268    09:36:50.631     [8272]    (ArchiveTask)    <9252>    EV:M    FindUser() - Search filter: (&(objectCategory=user)(legacyExchangeDN=/o=xxx Exchange/ou=Exchange Administrative Group \28FYDIBOHF23SPDLT\29/cn=Recipients/cn=username))
24269    09:36:50.631     [8272]    (ArchiveTask)    <9252>    EV:M    FindUser() - [homeMDB] = CN=DAG02DB10,CN=Databases,CN=Exchange Administrative Group (FYDIBOHF23SPDLT),CN=Administrative Groups,CN=xxx Exchange,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=xxx,DC=net
24270    09:36:50.631     [8272]    (ArchiveTask)    <9252>    EV:M    FindUser() - [distinguishedName] = CN=username,OU=Users,OU=Corporate,DC=US,DC=xxx,DC=net
24271    09:36:50.631     [8272]    (ArchiveTask)    <9252>    EV:L    :CArchivingAgent::ProcessUser() |Getting a MAPI session from the session pool |
24272    09:36:50.631     [8272]    (ArchiveTask)    <9252>    EV:M    CMAPISession::GetMapiSessionFromPoolEx(AdditionalFlags = 0)
24273    09:36:50.631     [8272]    (ArchiveTask)    <9252>    EV:M    CMAPISession::GetMapiSessionFromPoolEx: Exit status: 0x0
24274    09:36:50.631     [8272]    (ArchiveTask)    <9252>    EV:L    {CPolicyTargetGroupCache::GetUsersPolicyTargetGroup:#225} Found entry for user [/o=xxx Exchange/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Recipients/cn=username] in cache.
24275    09:36:50.631     [8272]    (ArchiveTask)    <9252>    EV:L    {CPolicyTargetGroupCache::GetUsersPolicyTargetGroup:#250} User [/o=xxx Exchange/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Recipients/cn=username] maps to policy [13D7DA27F340B0E4FBB432CC08A52C4591012p00EVSARCHIVE01] [xxx EVS Users]
24276    09:36:50.631     [8272]    (ArchiveTask)    <9252>    EV:L    {CExchangePolicyCache::GetPolicy:#243} Returning policy: [13C154C35E01BC147B294FA9B593FFEAF1012700EVSARCHIVE01 (Default Exchange Mailbox Policy)]
24277    09:36:50.631     [8272]    (ArchiveTask)    <9252>    EV:M    CAA::GUP() - /o=xxx Exchange/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Recipients/cn=username is using Policy : Default Exchange Mailbox Policy
24278    09:36:50.631     [8272]    (ArchiveTask)    <9252>    EV:L    :CArchivingAgent::ProcessUser() |Creating the Entry ID of user mailbox to be processed |
24279    09:36:50.631     [8272]    (ArchiveTask)    <9252>    EV:M    :CArchivingAgent::ProcessUser() |Open users message store |
24280    09:36:50.756     [8272]    (ArchiveTask)    <9252>    EV:L    :CArchivingAgent::ProcessUser() |Getting the entry ID of the mailbox wastebasket or deleted items folder |
24281    09:36:50.756     [8272]    (ArchiveTask)    <9252>    EV:L    {CFolderHelper::GetSpecialFolders:#2060} Getting special folder Ids (Wastebasket, Outbox, Sent Items &c.), attempt [1] of [4]
24282    09:36:50.771     [8272]    (ArchiveTask)    <9252>    EV:L    {CArchivingAgent::ProcessOWARestoredItems()} (Entry)
24283    09:36:50.771     [8272]    (ArchiveTask)    <9252>    EV:M    ProcessOWARestoredItems: OWARestoredItemTimeout: 120 minutes
24284    09:36:50.771     [8272]    (ArchiveTask)    <9252>    EV:M    ProcessOWARestoredItems: Deleting item(s) restored on or before: 13:36:50 10/02/2017

 

I just opened the user's mailbox via Outlook and checked the types of emails that are old and verified they are mostly IPM.Note.  None are pending or any types of messages that are filtered out by the archiving policy.

    • dorlow1's avatar
      dorlow1
      Level 3

      Running EV 9.0.2.  There is no "report" tab in the vault task that I hear the newer versions have.  The report log in the log folder I've never found to be useful.  The dtrace is way more useful.

      • dorlow1's avatar
        dorlow1
        Level 3

        I just checked.  The <ev install location>\Reports\Exchange Mailbox Archive\ folder hasn't created a log in about 8 months.  I've asked that question to EV support before we lost support and they didn't know why our servers weren't creating log files on some of the servers.  But they never troubleshot it.  They would just create a dtrace to fix the problem at hand.