cancel
Showing results for 
Search instead for 
Did you mean: 

Deleted vault vanished but event 7113 still occurs??

Sani_B
Level 6
Partner Accredited

Hello,

Somewhat weird problem:

Deleted user entry from database using query:

USE EnterpriseVaultDirectory
DELETE
FROM ExchangeMailboxEntry
Where MbxDisplayName = 'Lastname Firstname'

Put the vault of this user to Deleted state using VAC.

For a while the 7113 event started to show:

Following archive could not be deleted as it contains items that are on hold, or their retention category does not allow deletions, or a compliance device retention period prevents them from being deleted.

Archive Name = Lastname Firstname 

Archive Entry Id = ***************************************************************

Total items on hold = 6359

 

Now that I investigated this issue after several weeks:

 - There is no entry for this user in the Directory database

- The archive has vanished from the list of archives in VAC

BUT this event is still occurring in the event log and this query produces a result:

USE EnterpriseVaultDirectory

SELECT * FROM Archive

WHERE ArchiveStatus = 4

It produces a row with this user info...

This article would possibly been useful if the archive still existed in the VAC archive list but it's not there:

http://www.symantec.com/docs/TECH178002

 

  1. Within SQL Management Studio run the following:

    USE EnterpriseVaultDirectory
    SELECT *  FROM  Archive
    WHERE ArchiveStatus = 4


    This will generate a list of all of the Archives set for Deletion.
     
  1. Check the results and make sure that the ArchiveName column contains the Archive/s in question. Take note of the RootIdentity for each Archive.
     
  1. Within SQL run the following SQL query to change the status back to Available:

    USE EnterpriseVaultDirectory
    UPDATE Archive
    SET ArchiveStatus = 1
    WHERE ArchiveStatus = 4 AND RootIdentity = 'RootIdentity taken from step2'

     
  1. Refresh the view in the VAC and make sure that the vault status for the archive/s have changed from Marked for Deletion to Available.
     
  1. Restart the Storage Service, delete the archive/s again and Dtrace the StorageDelete process.
     
  1. Refresh VAC and the archive should now be gone, although it may take a few minutes depending on the size of the archive.

What do I do to get rid of the event 7113 now that the archive itself appears to be already be deleted...?

EV version is 11.0.1

 

Sani B.

 

 

 

1 ACCEPTED SOLUTION

Accepted Solutions

JesusWept3
Level 6
Partner Accredited Certified

well if the items are on hold, you shouldn't be trying to get rid of the archive?
i mean there has to be the archive still there if the event is continually being shown

https://www.linkedin.com/in/alex-allen-turl-07370146

View solution in original post

2 REPLIES 2

JesusWept3
Level 6
Partner Accredited Certified

well if the items are on hold, you shouldn't be trying to get rid of the archive?
i mean there has to be the archive still there if the event is continually being shown

https://www.linkedin.com/in/alex-allen-turl-07370146

Sani_B
Level 6
Partner Accredited

Hi,

Couldn't find it on the list having the archives organized by name, but after checking by status I saw it.

"Them little mistakes you do while rushing into things..."

Sani B.