cancel
Showing results for 
Search instead for 
Did you mean: 
Highlighted

EV 9.01 6273 Storage File Watcher

Anybody know what the following error is? I can't seem to pin it down. I've been running DTraces to no avail so far.

 

Log Name:      Symantec Enterprise Vault
Source:        Enterprise Vault
Date:          1/28/2011 7:43:31 PM
Event ID:      6273
Task Category: Storage File Watch
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      sfrvmsev.littler.com
Description:
Failed to inform the Archiving Service of successful storage of a Saveset in a Vault Store.
Reason: <0xc00e0003>

For more information, see Help and Support Center at http://evevent.symantec.com/rosetta/showevent.asp
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Enterprise Vault " />
    <EventID Qualifiers="49156">6273</EventID>
    <Level>2</Level>
    <Task>43</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2011-01-29T03:43:31.000000000Z" />
    <EventRecordID>823</EventRecordID>
    <Channel>Symantec Enterprise Vault</Channel>
    <Computer>sfrvmsev.littler.com</Computer>
    <Security />
  </System>
  <EventData>
    <Data>&lt;0xc00e0003&gt;</Data>
    <Data>Archiving</Data>
  </EventData>
</Event>

1 Reply
Highlighted

I have seen that before when

I have seen that before when someone deleted the archiving task that the item belongs to thats been backed up.

So the way it works (if the vault store is set to After Backup)

1. Item is picked up by the archiving task and put in to pending in to an A2 queue
2. It then goes from the A2 queue to the Storage Archive queue
3. Once the item is stored as a DVS file it has several entries in the Saveset table, JournalArchive table and the WatchFile table in the Vault Store database
4. The JournalArchive table has a column for each item called BackupComplete and is set to 0
5. The WatchFile table is the full path to where the DVS file is stored
6. Every so often, the StorageFileWatch process reads the WatchFile table and scans each DVS file to see if it has been backed up (checking to see if the Archive Bit has been removed from the physical DVS file)
7. If it has been, it will then remove the WatchFile entry and then set BackupComplete to 1 in the JournalArchive table
8. Once the item has been set to BackupComplete, it will then go to the A1 queue of that archiving task to tell it to turn the item from a Pending item in to a full post processed Shortcut

However if the Archiving Task no longer exists, there is nothing for the StorageFileWatch process to tell it which archiving task looks after this item to post process it

I also believe that 0xc00e0003 relates to the MSMQ path not existing as well

 

https://www.linkedin.com/in/alex-allen-turl-07370146