Deleted Items waiting to be Deleted from Indexes on Mailbox Store

[ChrisATS]

Server: Windows 2008 R2

Enterprise Vault 10.0.4.1189

I reviewed this discussion: https://www-secure.symantec.com/connect/forums/41022-deleted-items-waiting-be-deleted-indexes-ev-1001  much of it did apply as it appear I also have a single mailbox store with items waiting to be removed from the indexes.  I discovered this by running the SQL queries.  

We haven't performed an SQL restore at any point.  Unlike the earlier post when I attempt to resynch the mailbox index the process is stuck in 'processing'.  When I check the report file it shows several "Retrying failed items" as well as "Synchronize paused as the index server porcessing the task is overloaded."  I've done a couple different dtrace operations on the mailbox and indexing and don't see glaring errors in any of them.

[JesusWept3]

did you look at this technote that was mentioned in that forum post?
http://www.symantec.com/business/support/index?page=content&id=TECH203681

[ChrisATS]

Yes, well I've done several dtrace on indexing and all are showing indexing level at 10.0.4.1189 which is correct for the environment.  

[ChrisATS]

I attempted to run a index synchronization.  As expected it failed.  The log shows:

The synchronize subtask has failed.

Error Code: 57

Description: Indexing engine unreachable. The HTTP request is unauthorized with client authentication scheme 'Ntlm'. The authentication header received from the server was 'Negotiate,NTLM'. The remote server returned an error: (401) Unauthorized.

For more information:  http://www.symantec.com/docs/TECH160420

[GabeV]

Chris,

Open IIS in the Enterprise Vault server, go the Default Web Site > click EVindexing, then open 'Authentication' and select 'Windows Authentication'. In the right pane, click on Providers..., what settings do you have? If this is the first time you receive this error message?

[ChrisATS]

Gabe,

Windows authenticatin is enabled and the providers listed are Negotiate and NTLM in that order.  Yes, this is the first time I've seen this error message.  It's only occurring in association with one user account.  

[GabeV]

ChrisATS,

I understand that this issue is affecting only one user, but If you try to synch another index volume (different archive), do you get the same error code (57)? You can also run a dtrace for IndexVolumesProcessor to verify if the indexing engine is trying to process an item in this archive and for some reason is not going through.

[ChrisATS]

I sync'd a couple different archives and both completed successfully.  I retried the the failed archive and did a DTRACE to include the IndexVolumeProcessor.  Their are several occurances of that process in the log.  I don't see any red flags but maybe you can shed some light on it further.

[TonySterling]

Hi ChrisATS,

Just curious if you had sorted this and what the outcome was.

Regards,

[ChrisATS]

Tony,

I've opened a ticket with Symantec Support.  When I get a solution I will post.

Separate topic but I do custom filtering for journaling with EV as well.  I'm trying to customize the 'Default Filter Rules.xml' to do two things.  First, I want to strip 'TIF' attachments (we get a ton) as well as filter email sent to particular email addresses.  Every time I add rule 4 below the journaling task fails with event ID 2276.  I've added the required registry dword for this option.  

Second, the example xml file has a variety of rules including a rule to exclude email if it originates from an email address but not 'sent to'.  How would I filter for email 'Sent to' said email?  Would it be similar to the distro group example below?  Also, thought maybe the Rule 3 would apply here but that desciption also says 'if it originates' not sent to like I'm looking for.  Would it be as simple as changing author to recipient(s)?

<!--Rule 2: This rule will exclude any email from archiving
        if it is sent to distribution list.-->
        <RULE NAME="DISTRO Email" ACTION="HARD_DELETE">
        <RECIPIENTS>
            <DISPN>Sales</DISPN>
        </RECIPIENTS>
    </RULE>

<!--Rule 3: This rule will exclude any email from archiving
        if it originates from the email address below.-->
        <RULE NAME="Confirmation" ACTION="HARD_DELETE">
        <AUTHOR>
            <EA>noreply1@domain.com</EA>
        </AUTHOR>
    </RULE>

<!--Rule 4: (Available for Exchange Server archiving only)
  Delete TIF attachments before archiving-->
    <RULE NAME="DeleteTIF" ATTACHMENT_ACTION="REMOVE">
        <FILES>
            <FILE FILENAME="*.TIF"/>
        </FILES>
    </RULE>