1mb size and above emails are not getting vaulted for perticular user

[AAT]

Issue:

email of the size of 14 MB is not getting vaulted
user has tried it for the last 3 days and it did not work

We are having Exchange 2007 and Enterprise Vault version is 8.0.5, we have 6 Enterprise vault server with 6 mailbox servers configured to that, Exchange maibox server is clustered envirnment.

Troubleshooting done till now:

we have run the Sync on the EV server for the perticular user mailbox, enabled and disabled the user EV mailbox, ran the manul archiving on the server side with report mode and checked it had some 254 items to vault, emails got vaulted next day but they were all below 1 mb, more than 1mb emais were there in pending vault status.

till now its in same status, please any one help me from this, there are many issues with me.

i am having bulk of issues in EV, i am new to this EV an di dont know how to resolve.

Thanks

AAT

[JesusWept3]

So start with the basics

1. Do any items archive in the users mailbox?
2. Is Enterprise Vault in Read-Only or Backup mode?
3. On the vault store the user belongs to, do you have an open partition?
4. What is the Safety Copy strategy on the open partition for the users vault store?
5. Have you checked Archive Explorer to see if the item actually HAS been archived?
6. On the EV Server that hosts the users Exchange Archiving Task, do you see any warnings or errors regarding connecting to the exchange server or users mailbox?
7. If you go to the properties of the Exchange Archiving Task and go to the Synchronization tab, can you manually select the user to synchronize, and does it come back and say that it successfully synchronized or does it fail etc?

[AAT]

1) yes, emails below 1MB only get Archive and above 1mb will be in pending status.

2) Enterprise Vault is in Backup mode

3) yes its open partition

4) It is "After Backup"

5) yes, user has checked, emails are archiving.

6) At present i dont find any Event ID related to the specific user on that EV server, i will check with the user to reproduce the issue and i will check on the EV server.

7) yes, synchronization is working for the all the user.

please can you tell me what are the troubleshooting i can do, for like this issues, i have one more user with the same issue but the user belongs to different EV server.

Thanks

AAT

[GabeV]

Hi AAT,

Can you search in the user's archive (either using Archive Explorer or Enterprise Vault Search) and verify if you can find one of those items in the archive?

[JesusWept3 · Accepted solution]

If EV is in backup mode, no items can be archived
If its After Backup then the DVS file and the DVSSP file would both need their Archive Bit removed from the physical file to show that the DVS file has been backed up , then after EV has scanned the partition, found that the items have been "Backed up" it will switch from a pending icon to a fully archived item

So when a large email is archived, it splits it up between the Email itself, and the attachment.
The email is stored as a DVS file, and the attachment is stored as a DVSSP file

So if i send 1000 people a 1MB PDF file and they all archive it, you end up with 1000 x DVS files (each individual email) and 1 x 1MB DVSSP (maybe smaller after compression)

However if all 1000 DVS files are backed up, the archive bit is removed, BUT the DVSSP (attachment) has NOT been backed up (the archive bit remains) then the items will remain in a Pending state.

You may want to look if you're getting any Monitoring events saying you have X number of items awaiting backup, you can also look on the vault store partition and go to the Backups tab, and look at the Status for how many items were backed up

Also may be worth looking at an article i wrote ages ago about EV8 backups
https://www-secure.symantec.com/connect/articles/changes-backup-procedures-enterprise-vault-8

Along with the Backup Best Practices white paper
http://www.symantec.com/business/support/index?page=content&id=TECH147148

And also you said emails are showing in Archive Explorer, do you see the pending email in there or not? because if you do then you know for a fact that the item HAS archived, its just awaiting backup to occur to change it to a fully archived item OR its failing to connect to the users mailbox to turn it in to a shortcut (known as post processing)

[AAT]

Thank you for the reply, i was confused and checked the wrong,

here is a thing what i have seen on the EV server, Enterprise Vault is not in backup mode and we see that only below 1mb emails are getting archived.

Thanks

AAT

[AAT]

Hi JesusWept3,

We see that the emails which are above 1mb are showing as pending status and below 1mb are archived and also i check the backup and in our EV its daily backup and backup runs at night.

attached is the screenshot....

[GertjanA]

AAT,

Can you verify your archiving policies? MAybe someone set to not archive items larger than 1 MB?

From your questions, you might be best off getting yourself someone onsite for a day or 2, for a crashcourse EV. I see you probably are in the UK, there are some good companies there that can do that.

EV is not a product you are going to understand quick. It requires lots of reading, clicking around to find what is where etc.

[Prone2Typos]

Hey ATT.

As JW3 implied your issue may be related to the number of items identified as not being secure. Can you confirm the events you are getting or the usage report identifies that all shared Vault Store partitions have a low or no number of items awaiting backup. Due to the OSIS model, larger items may be more suseptable to the entire enviroinement not being backed up properly. 

The replies here are pretty dated at this point... so if you have resolved this with the help of posting here please flag the posting(s) as the solution so that help can be provided where it is most needed and others may learn from this thread. 

Regards.

J 

[AndrewB]

it's also worth mentioning that you're on an unsupported version of EV and should consider upgrading once you get this issue sorted out