Archive and Restore slow at the first time

[Roy_]

I'm currently install EV 9.0.2 for Exchange 2010 SP1. I have 2 Exchange 2010 and its are running DAG.

Users are using Outlook 2010, when users perform Archive/Restore on the Outlook client at the first time, it need around 10-15 seconds to complete the action.

Anyone encounter similar issue?

[JesusWept3]

I'm on a similar setup and I don't notice that many slow Dow downs, but for 10-15 seconds once? Not sure it's that big a deal But really what you are going to have to do is set maximum logging on your client trace and maybe dtracig W3WP, AuthServer, ArchiveTask and StorageArchive and see where the slow down is coming from Usually when ts a first time thing then I tend to think it's authentication lookups

[Roy_]

I logged a support call to Symantec Support and they collected the logs, but they can't find out any error that slow down the process.

[JesusWept3 · Accepted solution]

Well the fact is I wouldn't expect to see an error due to the fact that it does work, its just slow.
So what you would do is get the logs from the client making its first request, and get the logs from the server making the first request
Then you would get the logs when you make the request where its fast from the client and the server

You would then look for slow deltas, so try to see if theres any big gaps of 10 or so seconds that you can see which call is taking the longest
You then compare the slow logs to the fast logs and see what exactly the difference is.

My best guess is that its AuthServer doing an Active Directory lookup to determine whether you have the rights to archive or restore items.
Then after this it caches the credentials so the next call it doesn't need to do the same lookup.

There are lots of other parts where EV will cache certain thingsso it doesn't need to go through it each time

[Roy_]

Thanks for Explanation!

How can I capture the log from the client?

Do you have same experience on that?

[JesusWept3]

So do the following for us

1. In Outlook, hold CTRL-SHIFT and click an Enterprise Vault icon (such as Store In Vault)
2. From the dialog choose "Maximum Tracing" and press OK
3. It will tell you to Restart Outlook, at this time just Close outlook
4. Go to the Enterprise Vault Server that the user belong to
5. Open a Command Prompt and CD to your \Program Files\Enterprise Vault directory
6. Type "DTrace" and press Enter
7. Type "set w3wp v" and press Enter
8. Type "set AuthServer v" and press Enter
9. Type "set StorageArchive v" and press Enter
10. Type "set ArchiveTask v" and press Enter
11. Type "log C:\SlowArchiving.txt" and press Enter
12. Minimize the command prompt
13. Go back to the client and now Open Outlook
14. Select an item and hit Store In Vault and wait for it to archive
15. Select another item and hit Store In Vault and wait for it to archive
16. Keep storing items in the vault until it becomes as fast as you expect it to be
17. Go back to the Enterprise Vault Server
18. Click the command prompt window with the dtrace running
19. Type "Exit" to stop the dtrace
20. Copy the *.txt file you just created to a shared location
21. In Outlook hold CTRL and press an EV Icon (such as store in vault)
22. You will now see the EV log in a Notepad, save this to the same shared location
23. Zip up the contents of these log files

You should then send this to EV support, letting them know the username (i.e DOMAIN\thisUser) and the email address of the user and the full name as well as the Subjects of the emails that you archived

So for instance something like

Username: DOMAIN\myUser
Email: myUser@domain.com
DisplayName: LastName, FirstName

Emails archived:
RE: Hello
FW: Some email message
 

This way when they go through the DTrace on the server, they can isolate only the parts that relate to that user and that message (since other users maybe archiving items at that time)

Also in the client trace they can pick out the titles of the email

I would suggest running the traces outside of your provisioning schedule, synchronization schedule, archiving schedule and backup schedules.

I.e if you do it at 2am, you may be archiving, so the traces will be full of regular archiving from the tasks
if you do it at 9am you will be provisioning your environment.
If you do it at 12pm you might be doing synchronization and will flood the logs of irrelevant information
and if you do it at 5am you might be in Backup mode so it wouldn't be able to archive items either.

If you want, you can upload the logs here as well, or you can PM me with them and i'll have a look

[Roy_]

Thanks!

I have sent two logs to you!

[Roy_]

Hi JesusWept2,

Do you have any findings on the logs?

ThankS!