Watchfile table and remove safety copies immediately

just as a matter of interest, what are the dates on those items? are they recent or from some time ago?
this can happen if someone changes it from immediately after archiving back to awaiting back up and then switch it back, those items that were archived under an After Backup scenario will be put in to the Watch File table and the JournalArchive table


In EV7 and below if an item is stored in an Immediately After Archive scenario, it would
1. Create an entry in the JournalArchive table and set BackupComplete to 1
2. It would then await for Indexing to index the email then set IndexCommited to 1
3. As soon as both indexCommited = 1 and  BackupComplete = 1 it would then remove the entry

In EV2007 it would work the same as above, but it would keep the transaction for 14 days
In EV8 it would put the item in to the WatchFile table and it would await for the item to be backed up properly, even in an Immediately After Archive scenario, it would still await those items to be backed up, and also any SIS parts from other vaults stores.


So for instance if you have an item where the DVS file is in Vault Store 1, and you're backing that up, and it gets SIS'd to an attachment item in Vault Store 2 and thats not being backed up, if it detects that the VS2 item is still awaiting backup, then it won't do anything until all parts of the message have been properly backed up.

I wrote more about this here:
https://www-secure.symantec.com/connect/pt-br/articles/changes-backup-procedures-enterprise-vault-8