Corrupt CAB files - Event IDs 6835, 6838, 7083 & 7083 (EV 8.0.4)

[ChadStoke]

Hi,

I recently noticed some Failed Items in one of our Jornaling Index Volumes.

I have run a Dtrace on the IndexServer and StorageCrawler whilst running a 'Repair' on the Index in question, and have tracked it down to 5 CABs.
 
Example output from the Dtrace:
 
------------------------------------------------

• Event ID: 6835 Failed to extract CAB file. |Reason: FDI Error. User aborted.|fdintNEXT_CABINET encountered.| |CAB File: G:\Enterprise Vault Stores\XXXX Prn1\2010\05\26\Collection96751.cab |
•  
• Event ID: 6838 Failed to recall a Saveset from its Collection. |Reason: Failed to extract CAB file.      [0xc0041b0f] |Relative Saveset Filename: 2010\05\26\09\510000000000000~201005260919380000~0.DVS |Relative Collection Filename: 2010\05\26\Collection96751.cab |PartitionEntryID: 1CA38A3FE8A5D03408CFFF7FAF8DEA9471q10000EVSITE.domainname|PartitionGUID: CA38A3FE8A5D03408CFFF7FAF8DEA947 |Partition Root Path: G:\Enterprise Vault Stores\XXXX Ptn1 |Secondary Location: (null) |Migrated File Id:  |Reference: NSDR/LMF
•  
• Event ID: 7083 Retrieval of saveset failed. |Archive Id: 19EBC29289D2EF445BE376792BE900AEC1110000EVSITE.domainname|Transaction Id: 4F4F3A47425F4E8C842806A159F61C3 |Extended information: Failed to extract CAB file.      [0xc0041b0f] |Internal Ref: Vault/RI |
•  
• Event ID: 7287 Unable to add the item to the index since it is not currently available from the Storage Service. |Reason: Error processing saveset       [0xc0041923] |Attempt: 3 | |Index: 19EBC29289D2EF445BE376792BE900AEC1110000EVSITE.domainname/Volume:6781 (xxx Journal Archive) |Saveset Id: 510000000000000~201005260919380000~0~4F4F3A47425F4E8C842806A159F61C3 |Sequence Number: 13956226 |

------------------------------------------------
 
I have looked at each CAB file in turn and have found the following:
 

• 3 are corrupt and not repairable with Advanced CAB Recovery tool
• 2 seem recoverable, but only for 162 and 20 items each (which seem low amounts to me)
• All have size to them (each around 10MB)

 
I have tried to go back through our backups and they are corrupt also at the first backup since they were generated.
 
As EV deletes the source .DVS file once it is committed to the .CAB file, is there any way of recovering from this situation?

I was wondering if, as we have the original .DVS files in backup, can you determine which .DVS files were part of which .CAB archive then recreate the CABs from the original source .DVS files?

We are running EV 8 SP4 on Windows Server 2003 R2 SP2 Standard (32-bit).

Many thanks for any help given!

Chad

[Michael_Bilsbor]

In SQL you can select the Vault store and then do queries like
select * from saveset where collectionidentity= 96751

[ChadStoke]

Ah, OK - so if that gives me the .DVS files required and I recover them from backup, what next?

Do I just create a standard CAB file using WinRAR, preserving the required directory structure within the CAB?

Thanks for the update!

Chad

[ChadStoke]

Hi,

Could anyone provide any more info please, as I am a little stuck?!

I have run the query above against the JournalStore database - it brings back information, but not in a way I know what to do with it (I was hoping for a list of .DVS files, including original locations).

What that query does show me is it brings back 188 results.

I then looked in the Collections table, and looking at the same Collection ID that tells me there is 162 items in the CAB file - and this is indeed the number in the (corrupt) CAB file.

So I am assuming that the CAB has 162 but should have 188 - therefore 26 items are missing??

So, what info is correct, and if there are missing items how do I set about locating them and getting them back into CAB files correctly so EV indexing can access them?

Thanks for any help!

Chad