Archiving event errors 3176 and 2270

[James_Slack]

Hi,

Background: I was getting some weird errors trying to import some PSTs in to Vault from some new users from a company we just took over. I thought I would give the server a reboot and now I am seeing a lot of strange errors in the event viewer.

Specifically, I see 2 errors flashing up every 20 seconds.

Event 3176 = A RetrieveMarkedItems request has failed and it shows the mailbox and says "The RPC server is unavaiable"

Event 2270 = A queued operation exceeded the retry count and has been discarded.

This one is interesting as it lists the Mailbox but it says the server is "Outlook1" which is not a phsical server but the loadbalancer MAPI address.

Could that be what is wrong and if so, where did it pick this up from? The Outlook1 address has not been configured into Vault - only the 2 physicall servers EXCH1 and EXCH2.

Any ideas?

I will try and get the full event added here, but copy / paste still doesn't work for IE11.

Thanks - James

[James_Slack]

Vault errors attached

[GabeV · Accepted solution]

Hi James,

:Looking at the attachment, It appears to be that this mailbox:

/o=COMPANY/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Recipients/cn=paul.name 

was provisioned in enterprise Vault. Have you reviewed the A3/A5/A7 MSMQ queues to see if the mailbox was added to the queues? If you check the mailbox properties in the Exchange Mangement Console, is this mailbox located in that Exchange Server? Also, take a look at the provisioning reports to confirm if the mailbox is being reported.

[A_J1 · Accepted solution]

Hi James,

As you said recently you have imported some PST..

Did you import any PST for this user ???

I guess it could be either of the following two reasons..

1. Either the Shortcut which its trying to retrieve is corrupted..
2. Or the shortcut was created in the mailbox from another environment.

But i am not sure as the Events logs you attached doesn't tell which process logged this errors.. over here i am assuming Retrieval task.

IF its archiving task then the story could be different...

I would suggest whichever process is logging this error, enable a Dtrace on those process.

You can follow the below article on how to enable dtrace.

http://www.symantec.com/docs/TECH38122

I hope this helps !!!

[James_Slack]

The PSTs were for different users, but they had errors (would not import attachments).

I'll go through and find out about the user and queues now.

Thanks

[James_Slack]

Hummm... it might be that someone has being doing something stange with the takeover of this other email system.

The name in the error shows up as "Paul.name3b" whereas in Exchange / Provisioning report, that is showing correctly as "Paul.name".

What I think happened was Paul.Name had a 2nd account on our system, then when we needed to merge email, his old one got renamed "paul.name3b" and a new one might have been created called "paul.name".

Total guess as the people involved no longer work here.

I do know we have SynchInMigrationMode = 1 set.

Looking in the queues, I can see movement in the A1 queues, but A5, A6 and A7 queues have not gone down since boot time.

A_J - sorry, just checked and this is RETRIEVAL task. Does that just mean the user is trying to open a tag that was from a different Vault server, their old one?

[GabeV]

James,

What about the R1/R2 queues? Do you see messages in those queues for this mailbox?

[James_Slack]

Bit strange, one server is showing 1 message in the R1 queue, but when I open that queue to look it is empty.

Other than that 1 message, nothing else and the errors have stopped in the event viewer.

[JesusWept3 · Accepted solution]

what version of EV is this btw?
I remember there being a lot of issues in EV8 where if you moved a user from Exchange A to Exchange B, and the user either wasn't synched, or didn't restart Outlook, then it would post a restore request to the wrong Queue, and EV would just loop over it each time and never reject it.

https://www-secure.symantec.com/connect/ideas/check-see-if-users-mailbox-really-does-exist-exchange-prevent-3310-errors

[James_Slack]

Hi. It's V10.

Having a look at your link - will pick this up again on Monday - thanks and have a nice weekend all.

[A_J1]

Hi James,

Do you have any update ??

[James_Slack]

Sorry, had visitors on site all day yesterday.

Everything looks fine and is working OK today.

The A queues seem to be a bit high, particularly the A6 - but everything I need to do at the moment is working. So will close this down.

Thanks all.

[GabeV]

Great to know that everything is working well now. Please, mark the post that best solves your problem as the answer to this thread.

[James_Slack]

Thanks, I already had requested a split solution as the problem kinda went away on its own and you all gave good advice to help me.

Thanks again for your help.