cancel
Showing results for 
Search instead for 
Did you mean: 

DTRACE Translation When Mailbox Not Archiving

Ravi_Bhandari
Level 6

Hi,

is there any guide available that gives instructions on how to decipher a DTRACE, when trying to determine why a mailbox is not being archived.

In the scheduled nightly archive the Report generated shows that the Mailbox was Not Processed even though the DTRACE shows the mailbox was being processed.

The provisioning has placed the mailbox in the archive everything group, ie. older than 0 days. The account isn't disabled or hidden from the address book.

I should add that the Mailboxes Not Processed list seems extremely large to me. Are these mailboxes that the archive service couldn't get around to doing in the scheduled time?

We have a large number of mailboxes with an enormous number of messages in them. They are showing as "Partially processed: pass limit reached".

Many Thanks.

18 REPLIES 18

TonySterling
Moderator
Moderator
Partner    VIP    Accredited Certified

It sounds like your archive schedule isn't long enough to allow all the mailboxes to be processed.

What is your number of items per pass set to on the archive task properties?

What is your archiving schedule set to?

Also, how many mailboxes are you working with?

 

Ravi_Bhandari
Level 6

It is set at the default, 1000 items per pass. I tried doubling it before and the exchange admin believes it may have caused the exchange server to crash.

The schedule is from midnight to 8am.

Mailboxes Targeted are 1219.

I'm looking for patterns at how mail is being archived but I can't seem to find any logic to the ordering of mailboxes processed.

TonySterling
Moderator
Moderator
Partner    VIP    Accredited Certified

I don't think it would cause Exchange to crash but I would definitely not double it.

What does you MSMQ private queues look like?  Which ones have messages in them?

Ravi_Bhandari
Level 6

Thanks for the reassurance, I'll try upping the amount to 1200 items just to play it safe

 

The A5 queue has just over 1000 messages in it.

TonySterling
Moderator
Moderator
Partner    VIP    Accredited Certified

Again, I would not up the number of items per pass.  The A5 queue is where mailboxes are queued for the schedule run.  Can you look at the top message to see when it was created?

Ravi_Bhandari
Level 6

Okay to the no go on the upping.

That's funny, the top message shows a date of 1st December 2014 at 06:52

TonySterling
Moderator
Moderator
Partner    VIP    Accredited Certified

Ok, so that means that you have not made a complete pass through your mailboxes since at least before Dec. 1st.

On your archive report does it tell you how long it ran?  Are you sure EV doesn't go into backup mode during the scheduled run?

Ravi_Bhandari
Level 6

Yes that is true.

It ran for 8 hours and 20 Mins.

Yes, it doesn't go into backup mode during the scheduled run.

Is there a benchmark available for the EV mailbox archival rate against exchange 2010. I know there are numerous factors in play but I was after a ball park figure.

GertjanA
Moderator
Moderator
Partner    VIP    Accredited Certified

What I would do is the following:

Set the tasks in report mode, and restart them. Monitor MSMQ until the queues have 0 items in them (except ofcourse the A5 queue). When queues are to 0, stop EV-services, purge the A5 queue.

start the services again. Clear report mode from the tasks, and restart the tasks. Now see what is being archived. If archiving is still not able to archive all mailboxes during your schedule, there might be a backlog in Exchange? I archive over 4000 mailboxes on 1 EV-server, without issues. Perhaps you might need to run a pwrshll query on the Exchange server to see how many items are in the mailboxes? If there are large mailboxes, it might take EV a while to process these, causing others not to be archived.

What is the EV server spec? Cores and RAM mainly. Is there perhaps an Exchange backup running during the archiving run? Is there perhaps a SQL maintenance job running during archviing? Are your database being 'maintained' properly (see http://www.symantec.com/docs/TECH74666 ) Is there perhaps a storage issue? IOPS sufficient?

There is many factors that might cause this, but the amount of mailboxes should be archived without issues.

 

Regards. Gertjan

Ravi_Bhandari
Level 6

Thank you for your comprehensive set of instructions.

I'll have to look into using Powershell to query Exchange, the EV task report show that it takes about 5 mins to archive 1000 messages.

The EV server is a Dell R710 with Quad Core ( Shows as 8 cpu's in task manager) 16GB of Ram.

There is no exchange backup taking place at the time EV archive task is scheduled to run.

Also there are no SQL Maintenance jobs running during the archiving.

SAN attached Storage was recently upgraded, however the system disks are not solid state.

GertjanA
Moderator
Moderator
Partner    VIP    Accredited Certified

ok, you can also run the below on the EV-directory database:

--Hourly Rate
SELECT "Archived Date" = left (convert (varchar, archiveddate,20),14),"Hourly Rate" = count (*),"MB (orig)" = sum (originalsize)/1024/1024,"MB (in EV)" = sum (itemsize)/1024
from saveset with (nolock) inner join savesetproperty with (nolock) ON saveset.savesetidentity = savesetproperty.savesetidentity
where archiveddate > dateadd("hh", -24, getdate ())
group by left (convert (varchar, archiveddate,20),14)
order by "Archived Date" desc

 

Change -24 to -120 to get 5 days of result. That might shed a light too.

Regards. Gertjan

Ravi_Bhandari
Level 6

Very useful bit of SQL, however I'm concerned that my Original Size is showing consistently lower than size in EV.

GertjanA
Moderator
Moderator
Partner    VIP    Accredited Certified

Query might not be correct in regards to that :-), the below one should be better.

 

--Hourly Rate

SELECT "Archived Date" = left (convert (varchar, archiveddate,20),14),"Hourly Rate" = count (*),"MB (orig)" = sum (originalsize)/1024/1024,"MB (in EV)" = sum (itemsize)/1024

from saveset with (nolock) inner join savesetproperty with (nolock) ON saveset.savesetidentity = savesetproperty.savesetidentity

where archiveddate > dateadd("hh", -24, getdate ())

group by left (convert (varchar, archiveddate,20),14)

order by "Archived Date" desc

Regards. Gertjan

Ravi_Bhandari
Level 6

If there are 62,000 items in queue a2, will running in report mode bring this number down?

I feel I'm missing something.

GertjanA
Moderator
Moderator
Partner    VIP    Accredited Certified

A2 =

Individual items to process. Used for manual archive requests and whenever Enterprise Vault cannot directly communicate with the Storage Archive queue of the Storage service

Setting in report mode should allow this to clear.

This would explain slow archiving.

Regards. Gertjan

Ravi_Bhandari
Level 6

Ok thanks, the queue did eventually clear down at around 11pm at night.

I'm interested to try and understand how this would explain slow archiving and how I could improve the archival rate. Apparently the exchange storage is under pressure and is probably because of the lack of archiving.

GertjanA
Moderator
Moderator
Partner    VIP    Accredited Certified

Hello Ravi,

Obviously, it is difficult to asses, but here is what I would try:

1 - verify you do not have many mailboxes having 0 items (i.e. users that have left the organization). EV has to work it's way through every mailbox which is enabled, and having many empty mailboxes will slow down processing.

If you have many, disable them for archiving.

2 - re-verify your schedules (When goes EV in backup/out of backup, when is Exchange backed up etc) Make sure the archiving schedule has enough time to make a full pass.

3 - if you have multiple mailbox archiving tasks on 1 EV-server, try to schedule each task to have a dedicated window. Meaning: Task 1 runs from 8 to 10, task 2 runs from 10 to 12, task 3 runs from 12 to 2.

4 - if at all possible, run the archiving task during the weekend. If possible, make sure the schedule on the task has some 'gaps'. (meaning, schedule to run from 8 to 12, from 1 to 4, from 5 to 8, from 9 to 1 etc).

5 - if you have multiple exchange-servers, archive 1 server (set the other tasks in report mode)

6 - try to get a performance log for the indexing and storage disks. Perhaps there is a bottleneck there.

Again, I am archiving lots more, within a timeframe of 3 hours. I know there are people here that do way more than I do. If all this does not help, you might want to engage a partner, to help resolving this issue.

 

 

Regards. Gertjan

JimmyNeutron
Level 6
Partner Accredited

you might have quota set on these archiving mailboxes. You need to set them to no limit