Problem archiving a particular mailbox

Can you check the modified date of the old messages?  If the messages were restored they won't be archived until the modified date reaches the Archive rules threshold.

If that is the case then you can use IgnoreEVDates to force it to archive right away.

If 32bit HKLM\Software\KVS\Enterprise Vault\Agents

or If the Windows Servers operative system is 64bit, add the key to the following path:

HKEY_LOCAL_MACHINE\Software\Wow6432Node\KVS\Enterprise Vault\Agents

IgnoreEVDates

0 = Off
1 = Ignore Archived date
2 = Ignore Restored date
3 = Ignore both Archived and Restored date

Set to 3, do a run now and archive the mailbox then set to 0.

Sorry i should have said that i had checked the modified dates and they do met the archiving policy criteria. I had come across this on a previous occasion but i wasn't aware of the IgnoreEVDates registry entry so thanks for that.

Any other ideas?

Next thing would be to check the message class for the items.  Also, can you manually archive them?

Lastly, do a dtrace of the Archive Task whilst doing a run now against that mailbox.

Is the mailbox "suspended" from archiving?  You can check in the directory database, or do a run now in report mode.

The message class is IPM.Note which is set to be archived in the policy.

I can manually archive the items as the icon changes to pending.

The mailbox isn't suspended. If i perform a 'Run Now' in report mode i get no output in the reports folder.

I am planning to run a DTrace but i find it hard to decipher these sometimes :)

What quota's do you use?  I assume it's within the send/receive limit?

I'm guessing the Dtrace may be pretty short - feel free to post here so we can take a look.

-Karl

Are you doing a Run Now? I'm guessing the DTRACE wasn't a Run Now against the user Graham Topley? If so, these jobs go onto the A3 MSMQ. The A5 is scheduled jobs and can be purged (it 'should' goto 0 if there is enough time to do the work overnight etc)

Looking at the trace I would say that shortcuts in the mailbox TCEJ have invalid references and this is causing a delay in your archiving window. The particular thread ran for 170 mins against a number of mailboxes, trying to do the shortcut processing. It's trying to contact an EV server with an alias of DIUSSITE_ALIAS - can you ping this? I suspect it's not contactable.

I would suggest looking into this mailbox, if you can, or disable it temporarily from archiving.

Looking at the Graham Topley mailbox we did the following:-

1  Mailboxes processed for archiving (Process User)
1  Mailboxes detected as being enabled.
60  Folders scanned
11252  Items checked for eligibility for archiving (IsEligible)
1000  Items selected for archiving and sent for storing. (MakeitemPending...)
1  Items that are Archive Pending but not old enough to be cancelled yet.
4099  Shortcuts found but have not been moved.
1000  MSMQ Items picked up and processed by the agents
 

so we sent 1000 items to storage

you could also look at turning off shortcut processing to just get the mailboxes archived. Which version of EV are you running?

I was doing a 'Run Now' against Graham Topley and it was reflected in the A3 queue.Interestingly at the moment it says 1 when i view via the Private queues but when i look at the queue itself there is nothing there. I tried purging this but it still says 1.

 I mention the other queue as i saw things in it.The issue with the user TCEJ is worrying i thought DIUSSITE_ALIAS was something to do with EV. I did remember awhile back having a problem with someone who had been using a google connector in Outlook which stored IMAP information in a PST file. This PST was migrated to the EV and it caused a lot of issues with archiving. I will exclude this mailbox from archiving until i've worked out what is going on.

What impact will it have if i turn off shortcut processing?

Thanks for your help.

Darryl.

If you exclude this user then you won't need to worry about shortcut processing, as their mailbox won't be scanned and therefore won't cause the RPC errors.

When I mentioned shortcut processing, I was referring to when you do a Manual RUN NOW and you can choose to do everything, or just archive. Shortcut Processing does a number of different operations which include checking for shortcuts that have moved, items that are ready for deletion, orphaned links etc.

I, personally, would purge the A5 MSMQ (whenever you purge you also need to purge the relevant ADMIN MSMQ too as the purged jobs drop into here). MSMQ also needs refreshing in the screen as they are not dynamic, and they can also show "ghost" entries - there are tools out there that are better than the Windows MSMQ viewer but I can't recall the names, Google MSMQ viewers and see what you find.

This TN, http://www.symantec.com/docs/TECH47392, shows how you can setup monitoring on the Storage Queue and get an idea of how your archiving is going with regard to your time window. It looks like you have a big enough window to be honest but anything that causes delays like this dodgy mailbox will have an impact.

From what I can see in the log the mailbox Graham.Topley was processed three times.  For the first two passes the task reports 1000 items sent to storage and 6668 left to process.  What stands out as wrong here is that the second time there is still the same number of items left to process.

What stood out to me was the number of Operation Failed calls being processed in the trace (1998 in total). 

These indicate an issue with the Storage Service.  The archiving task appears to be archiving and sending items to storage which are then not being archived.  It would appear the mailbox is potentially stuck in a loop - sending the items to be archived, getting back the failures then sending the same items back again and so on.

Are there any errors in your EV logs regarding Storage?  Perhaps tracing StorageArchive at the same time might help.

Regards

Karl