Discovery Accelerator Not Properly Finding Archived Emails.

[SBMTMiller]

Previously working Enterprise Vault 10 on Windows 2012 - We have an issue with at least two users where when we search for emails, Discovery Accelerator is skipping several months or not finding emails at all then must reboot the Discovery and EV server. (We are journaling.) For example, b/w two dates, there are several months missing. If I search 1/2014 - 5/2015, accept / export the results and view the emails, we might be missing emails from 10/2014 - 4/2015. The results are really inconsistent with different hit values after doing the same searches. 

Could anyone provide any insight to how to start to troubleshoot this issue?   

There are two error messages I notice during this process:

1. (When selecting the user) "Some custodians do not have values for Primary attribute".......... (Yes - Symantec's answer is to upgrade everything)

2. Event log errors, missing emails:

APP AT - Customer ID: 2 - Warning:
Some items could not be searched:
Archive: 'Journal Archive'
ID: 1FA042CB64BA9B64591527A429C9AE9541110000houevault
Index Volume: 2619
Search ID: 264

Description:
Items or content missing from the index
Reason: Items or content missing from the index
Stack:

3. Event log errors after we start getting 0 hits:

APP AT - Customer ID: 2 - Error processing Vault to Search off the queue: Searching Vault Thread - worker thread for index server: 1 (7)
Vault ID: 9992
Number of tries: 5
Cause:Index Search failed: APP AT - Customer ID: 2 - Error processing Vault to Search off the queue: Searching Vault Thread - worker thread for index server: 1 (7)
Vault ID: 9992
Number of tries: 5
Cause:Index Search failed: APP AT - Customer ID: 2 - Error processing Vault to Search off the queue: Searching Vault Thread - worker thread for index server: 1 (7)
Vault ID: 9992
Number of tries: 5
Cause:Index Search failed: APP AT - Customer ID: 2 - Error processing Vault to Search off the queue: Searching Vault Thread - worker thread for index server: 1 (7)
Vault ID: 9992
Number of tries: 5
Cause:Index Search failed: %1    Index: %3   Internal reference: %2      (0xc0041c0e)    Index: %3   Internal reference: %2      (0xc0041c0e)    Index: %3   Internal reference: %2      (0xc0041c0e)    Index: %3   Internal reference: %2      (0xc0041c0e)

Index Search failed: Index Search failed:     Index:    Internal reference:       (0xc0041c0e)  
Index: 1FA042CB64BA9B64591527A429C9AE9541110000houevault/VolumeSet:1796 
Internal reference: SRCI 

Thanks 

[TonySterling · Accepted solution]

I would suggest upgrading to at least 10.0.4 CH3 as described here:
 

Selecting Custodians for a Discovery Accelerator Search - Warning: Some custodians do not have values for Primary attribute

•  
• Article URL: http://www.symantec.com/docs/TECH208789

Problem

Warning message "Some custodians do not have values for the Primary attribute" appears when Selecting Custodians for a Discovery Accelerator Search with the "Use Historical Information" option disabled and with deactivated Custodians present

When configuring the Search Criteria for a new Discovery Accelerator (DA) Search, the following warning message is seen:

"Some custodians do not have values for the Primary attribute 'Display Name' and will not appear in search results. Contact your administrator."

This warning is logged when the Search configuration has the "Use Historical Information for Custodians or Custodian Groups" option unchecked and an attempt is made to select at least one Custodian by using the 'Targets and Custodians' icon to the right of the 'To Or From' field. The 'Choose custodians and / or custodian groups' dialog box is displayed with the warning. Acknowledging the warning allows for successful completion of the Search Criteria and allows the Search to be saved and run.
 

Error Message

Some custodians do not have values for the Primary attribute 'Display Name' and will not appear in search results. Contact your administrator.

Solution

This issue has been addressed in the following release:

Enterprise Vault 10.0.4 Cumulative Hotfix 3 Release
http://www.symantec.com/docs/TECH215093

Symantec Enterprise Vault 11.0 0 Release Details
http://www.symantec.com/docs/DOC7401