"-1" error: The search has been abandoned due to an unrecoverable error. Could not find the specified Vault using the Directory Service. (0xc0041c5c)

[goatboy]

Hi, running DA/CA 9.0.2

Have a frustrating issue where deleted archives that are selected in CA/DA cases/searches are returning this error:

"-1" The search has been abandoned due to an unrecoverable error.   Could not find the specified Vault using the Directory Service. (0xc0041c5c)

What is extra frustrating is that this error used to throw an event in the app logs of CA and DA in our previous v8.0.5 installation (see Event 42077 here: http://www.symantec.com/business/support/index?page=content&id=TECH50961)

Now I can't see any events for this, but have users reporting the issue.

I know what the fix is - running a SQL query to deselect the deleted archives:

Delete from tblIntVault

WHERE VaultId in (SELECT    distinct VaultId

FROM         tblSearchVault

WHERE     (IndexVolumeSetID = -1))

but I would like to be alerted when this issue occurs.

How do you deal with this issue? Have you also noticed that there is no more Event 42077 for this in 9.0.2?

Thanks

[TonySterling]

That issue should have been fixed in 9.0.1 are you using the API?

Archive synchronization issues after you installed the Enterprise Vault API Runtime on your Discovery Accelerator server [Ref 9015617, E2101749]

If you chose to install the Enterprise Vault API Runtime rather than a full copy of Enterprise Vault on your Discovery Accelerator server, issues could arise when Discovery Accelerator synchronized with the Enterprise Vault archives. During the synchronization process, Discovery Accelerator did not check for any deleted archives and register that they were no longer present. Consequently, when you later ran a Discovery Accelerator search, it would try to search the deleted archives instead of ignoring them.

This has been fixed.

Or I wonder if it is a matter that synchronization isn't occurring after the archive is deleted and before the search is ran.

[goatboy]

We installed full version of EV on the DA/CA servers, the same as we installed on the EV servers. We had a case with Symantec around this when we have 8.0.5 - they said it was a feature and the only fix was to run the SQL query to untick the archives, very annoying. Is DA (and CA) now meant to ignore deleted archives instead of searching them?

[TonySterling]

That is my take based on reading the Updates.htm.  I don't have my lab up right now to test (its EV/DA 10 anyway) but it might be worth your while to open a case.

Like I said, it could be synchonization isn't running between the time the archive gets deleted and the search is ran.

What do you have set for Synchronize archives on search in the System Configuration>Vault Directory Synchronization section?

[TonySterling · Accepted solution]

Just FYI, this is what it looks like in EV\DA 10, so I know for sure it is fixed in 10, but like I said, I think it is supposed to do that in DA 9 as well.

[goatboy]

Thanks Tony.

In DA, "Synchronise archives on search" is NOT enabled. That's interesting. CA help says "Specifies whether to synchronize all the archives when running a new search. By default, Compliance Accelerator does not synchronize all the archives."

Do you think that if it's enabled, CA and DA will no longer search the deleted archives?

[TonySterling]

By default it isn't enabled but in your case you might want to and see if it helps.  It may cause the searches to take a bit longer.

Also, by default DA synch's the archives every 6 hours, so if it is possible archives get deleted during the day and your search runs before this synch occurs that would explain why you see thoses events.

Do you delete archives often? 

[goatboy]

Interesting, thanks for that screenshot. We delete archives almost never, there were a bunch done a long time ago resulting in the "-1" errors. I will log a case with Symantec and reply back.

[TonySterling]

Ok, if you don't delete archives then it isn't much of a big deal.  At the very least Support will want you on sp 3 and if you can, I would recommend going to DA\CA 10.

[goatboy]

Symantec have recommending truncating the tblIndexVolumeSet table in CA and DA and resynching archives, will post back with the results.