cancel
Showing results for 
Search instead for 
Did you mean: 

EV Search issue

Vipul_Desai
Level 4
Partner Accredited

Hi All,

We are facing issue with the enterprise vault search.

Kindly find the attached screenshot of the same.

We are getting this issue frequently after 2-3 days, can anyone suggest the solution for the same.

 

Regards,

Vipul

10 REPLIES 10

GertjanA
Moderator
Moderator
Partner    VIP    Accredited Certified

HI Vipul,

If you verify the Enterprise Vault server, in the eventlog for EV, do you see errors/warnings?

I had this too (not as frequent), and decided to restart the indexing service only on the EV server daily at 06:00. that has stopped this from occurring.

Regards. Gertjan

Vipul_Desai
Level 4
Partner Accredited

Hi Gertjan,

 

Thanks for your comment.

When we reset the indexing engine, it starts working and then again after 2-3 days facing same issue.

Event id 7182, 41315 and 41329  in the eventlog.

 

Regards,

Vipul

Manideep_Neeli
Level 4
Employee

Hello Vipul,

 

Could you please give the description of Event ID 41315, 7182 and 41329 as same event id has different descriptions.

 

Is there any anitvirus sofware on EV server? if so, please share the details.

 

Thanks.

Vipul_Desai
Level 4
Partner Accredited

Hi Manideep,

Thanks for your comment.

Yes, Symantec Antivirus is installed on the EV server.

Kindly find the details of the Event ID.

Event id - 41315 - Index query server

A search failed with error "Search engine fault: Unrecognised".

Archive: Priyadarshan
Archive ID: 12C8C4DE8BC0620449C25DC14649BA0781110000EVSERVER
Index volume ID: 290
User: ----\----
Maximum results: 100
Timeout (seconds): 600
Sort order: -date 

For more information, see Help and Support Center at http://entced.symantec.com/entt?product=ev&language=english&version=11.0.1.0&build=11.0.1.3474&error=V-437-41315

 

Event id 7182 - Web application

Index Search failed: Index Search failed:     Index:    Internal reference:       (0xc0041c0e)  
Index: 1FB6C5744B4519F44A13701DEF89FAA561110000EVSERVER/VolumeSet:615 
Internal reference: SRCI 

For more information, see Help and Support Center at http://entced.symantec.com/entt?product=ev&language=english&version=11.0.1.0&build=11.0.1.3474&error=V-437-7182

 

Event id 41329 - Index Volume processor

Index volume is marked as failed.

Archive Name: Payel 
Index Volume ID: 1C150EE4F3BA6A9498129FB6F24355A971110000EVSERVER_626
Reason: IndexingEngineError
Error Type: CriticalError

Description: Indexing engine exception 

For more information, see Help and Support Center at http://entced.symantec.com/entt?product=ev&language=english&version=11.0.1.0&build=11.0.1.3474&error=V-437-41329

 

Vipul_Desai
Level 4
Partner Accredited

Hi Manideep,

Thanks for your comment.

Yes, Symantec Antivirus is installed on the EV server.

Kindly find the details of the Event ID.

Event id - 41315 - Index query server

A search failed with error "Search engine fault: Unrecognised".

Archive: Priyadarshan
Archive ID: 12C8C4DE8BC0620449C25DC14649BA0781110000EVSERVER
Index volume ID: 290
User: ----\----
Maximum results: 100
Timeout (seconds): 600
Sort order: -date 

For more information, see Help and Support Center at http://entced.symantec.com/entt?product=ev&language=english&version=11.0.1.0&build=11.0.1.3474&error=V-437-41315

 

Event id 7182 - Web application

Index Search failed: Index Search failed:     Index:    Internal reference:       (0xc0041c0e)  
Index: 1FB6C5744B4519F44A13701DEF89FAA561110000EVSERVER/VolumeSet:615 
Internal reference: SRCI 

For more information, see Help and Support Center at http://entced.symantec.com/entt?product=ev&language=english&version=11.0.1.0&build=11.0.1.3474&error=V-437-7182

 

Event id 41329 - Index Volume processor

Index volume is marked as failed.

Archive Name: Payel 
Index Volume ID: 1C150EE4F3BA6A9498129FB6F24355A971110000EVSERVER_626
Reason: IndexingEngineError
Error Type: CriticalError

Description: Indexing engine exception 

For more information, see Help and Support Center at http://entced.symantec.com/entt?product=ev&language=english&version=11.0.1.0&build=11.0.1.3474&error=V-437-41329

 

JimmyNeutron
Level 6
Partner Accredited

you can dtrace the w3wp service and it should log the process. Also the index is marked as failed so will want to fix that first.

 

Then make sure you apply Recommended list of antivirus exclusions for Symantec Enterprise Vault:

https://support.symantec.com/en_US/article.TECH48856.html

 

 

 

Katie_K
Level 2

Hi we are having the same issue and have to restart the EV Indexing service every morning.  I have a call logged with Symantec for this but wondered if you have a found a solution yet?

 

Ben_Watts
Level 6
Employee Accredited
Hi Katie, The issue seen in this post is, 9 times out of 10, down to AV scanning any of the locations used by Indexes/Indexing. What usually happens is AV will find a file/s which it suspects, then quarantine it, you will then need to restart Indexing which will either recreate this file and/or re-sync it (depending on which file is being quarantined/deleted). Have a look at the below technote for AV Exclusions, I am sure this has been passed onto you already, just make sure that you have ALL of the locations below fully excluded from all scans. http://www.symantec.com/docs/TECH48856 And some Indexing specific exclusions:- https://support.symantec.com/en_US/article.TECH48856.html#Version 10 and greater There are also some AV software which uses shortname convention for directory paths, McAfee being one, so sometimes the full length pathname will need to be shorted for the AV scanner to pick up on what it should not be scanning. Some AV solutions also need processes to be excluded, again McAfee has been seen to hit our TaskController.exe as well as other processes which cause lots of issues with Indexing therefore these will need to be investigated within the AV logs, then excluded. I personally would use the Eicar file found below for location based exclusions, place it in all the Indexing locations which you believe you have excluded, then run a scan against those locations, if the file is picked up by AV then the location is not excluded and you will need to look into it a bit more. http://www.symantec.com/security_response/attacksignatures/detail.jsp?asid=24461

JesusWept3
Level 6
Partner Accredited Certified

are there any plans to get Vivisimo to not create its files in C:\Windows\Temp as excluding the C:\Windows\Temp is so so so bad, even goes against Symantec's best practices

https://www.linkedin.com/in/alex-allen-turl-07370146

Ben_Watts
Level 6
Employee Accredited

I would love to say yes but to be honest it is down to the developers of Vivisimo and not us unfortunately so our hands are kind of tied at the same time.