Cannot recall placeholders for Symantec Enterprise Vault w SEP installed

[SMack76]

We are running SEP on our file servers that are being vaulted by Symantec Enterprise Vault 10.0.3.1090. Recall of the placeholders fails. Uninstalling SEP resolves the issue. Worked with the EV team to exclude offline files and that didn't resolve the issue.

I've opened a case with the SEP team.  This seems like it may be a bug, has anyone else had this issue?  I can recreate it consistently. 

[GabeV]

Hi,

If you worked with the EV team, I'd like to confirm if you applied this TN to exclude the SEP executables from recalling the PH files:

http://www.symantec.com/docs/TECH51039

You can setup FSA pass-through, so the PH files would be delivered directly to the application and wouldn't be restored in the file server. If you run a dtrace of the EVPlaceholderService in the file server, do you still see the SEP executable recalling the files?

[SMack76]

Gabe,

I went throught this document with the EV team and performed the registry edits.  When I experience the issue I'm able to recall the file locally on the server without an issue but when accessing from a client I'll get an access denied. 

The other symptom I'm seeing is that I'll install SEP on the Server; reboot and recalls work properly.  It's not until the next morning that I have issues; almost as if the SEP nightly scan has corrupted the files.  The only way to resolve the issue at that point is to restore the placeholders and uninstall SEP.  

I have a ticket open with SEP and should be calling them shortly, I'll update the post once I find a resolution. 

[GabeV]

I am not sure if this is related, but take a look at this technote:

Placeholders are recalled with PGP 9.5.2 Desktop Installed
http://www.symantec.com/docs/TECH59331

[SMack76]

Got in touch with SEP support and they suggested installing SEP with a a basic package and no SONAR or Firewall protection.  Deployed the packed rebooted and this monring my placeholders are corrupt again.

I've gone through TECH51039; excluded the placeholder service in the registry. (Note the registry location on my Windows 2008 R2 machine is:  HKLM\Software\Wow6432Node\KVS\Enterprise Vault\FSA\PlaceholderService.

Ran a Dtrace which I've included.

[SMack76 · Accepted solution]

Ran through this document.

TECH51039 

The path was slightly different on my machine

HKLM\Software\Wow6432Node\KVS\Enterprise Vault\FSA\PlaceholderService

Exclude the rtvscan.exe

[Rob_Wilcox1]

I think rtvscan is the 'main' executable that forms SEP, right?

[GabeV]

Thanks for providing the registry path for 64bits. Basically, the TN was the solution but we just need to make a note for Windows 64bits version.

[SMack76]

Rob - Yes it is.

Gabe - I looked here.  TECH102748

So to summarize.  Neither the SEP or EV teams properly diagnosed or solved this issue, I figured it out myself.  To be more specific the EV team (Asia-Pac group I believe), gave me the wrong .EXE on the first pass which led me down a rabbit hole for several weeks.  It was not until I doubled back on my own after the SEP team couldn't assist me that I was able to resolve.  

In all honesty I'm reluctant to call support as I find they are very low level Tier 1 analysts who are doing nothing more than searching internal support documents which I can do on my own.  When we pay these heft support contracts the expectation is set that we'll be in touch with someone who has a level of familiarity with the product.  To be clear my bad experiences have been mostly dealing with the (Asia-Pac group).  Usually when I'm escalated to US based support they solve my issue fairly quickly. 

Anyway, problem solved.  Lastly this seems like a bug to me, correct me if I'm wrong.  Two products from the same company should not "break" one another.  This reg edit should automatically be loaded if SEP detects SEV. 

-Shane