EV not archiving subfolders

[Phil_T1]

Hi,

I am running a trial of Enterprise Vault in a POC environment.  I have a problem where when I set off the archiving task, it only archives files in the top level of the share that I have configured to be archived.  The folder within the Volume is set to archive subfolders, but this setting looks like its being ignored.

Has anyone seen this behaviour before?  We don't have any support from Symantec because this is only a trial.

Any suggestions gratefully recieved.

Cheers,

Phil

[Maverik]

Hi,

Does the Vault Service account have the correct permissions to the subfolders? Are you targeting more than one volume and if so are all affected? If possible can you perform a run now via the vault admin console on the affected volume whilst dtracing the below.

 http://support.veritas.com/docs/276120         

Please Dtrace the following: EVFSAArchivingTask

In regards Symantec support if you are running a trial, you shoud be able to reach out to the technical sales team for assistance.  They then can involve Symantec Support themselves if required. 

[Phil_T1]

Hi, Many thanks for your suggestions.

The EV Services are all running as the Domain Admin (bad practice I know, but this is just a POC environment.

I have executed the DTRACE as you requested and have attached the files.  A cursory examination reveals entries such as this one:

607 12:26:19.364  [5612] (EvFsaArchivingTask) <1824> EV-H {FileSystemFolderWalker.ProcessFolder} Duplicate Archive Point detected: \\?\UNC\dc2.bellwaytest.local\Data\Barking Riverside as as the folder created date is different to that of the Archive Point information as the Archive Point folder has been copied
608 12:26:19.364  [5612] (EvFsaArchivingTask) <1824> EV~W |Event ID: 41142 Duplicate archive point: '\\?\UNC\dc2.bellwaytest.local\Data\Barking Riverside'.|The original folder and its archive point have been copied.|This folder and its subfolders will not archived until this situation is resolved.|Refer to the documentation for more information.
609 12:26:19.364  [5612] (EvFsaArchivingTask) <1824> EV-L {FileSystemArchivingCheckPoint.CheckIfVolumeFullyWalkedInLastRun} Volume \\?\UNC\dc2.bellwaytest.local\Data was partially walked/never walked in one of the last runs
 

There is one of these sets of entries for each subfolder off the root.  I am guessing that this is what's causing the problem, but don't fully understand the error, nor what I need to do to resolve the situation.

Any help gratefully recieved.

Cheers,

Phil

[TonySterling · Accepted solution]

Perhaps use the solution found here: Article URL http://www.symantec.com/docs/TECH64969

[Prone2Typos]

I think your issue is in your archive points or archive folder points or both. As this was a POC was the data coppied at all. EV FSA uses streams to note the archive points of a directory structure and creates a second, slightly less accessible point on each of the folders. From your posting. . .it seems there is a mismatch

As it is a POC you may just decide to delete the target, remove all the streams, and retarget. If this is the issue it should fix your issue. if this were prod, you would never do this as a duplicated archive will be created. You could manipulate the AP to have it reflect the orig archive ID if you wanted

[Phil_T1]

Hi Tony and Typoprone,

Many thanks for your suggestions.  Typo, when you say remove the all the streams, are you referring to alternate data streams within the NTFS file system or something else?  (I am trying to insert a Ghostbusters reference in here somewhere but have failed miserably).

Tony, thankyou for that article ID, it fits the bill exactly (and I should have done some better searching to find it myself), I have followed the article and deleted the archive points and recreated them, but still have the same problem.  Where the article says:

"run the fsautility -a -s "UNCpathname" to re-create the Archive Point with the original ArchiveID" I ran it just as it suggests, but should I be passing it the original ArchiveID and if so, where would I locate this?

I created the dataset by copying and pasting files from a production file server.  We don't run EV in production yet, but could this copying process have created data streams that EV is using somehow?

[Prone2Typos]

Hey there.

Yes I am refering to the ADS on the NTFS file system. You can view them in notepad or a much more popular and user friendly utilty to do so would be the utility Streams which will allow you to view or remove them.

The original archive ID would be on the Advanced tab of the Archive's properties in the Vault Admin Console. The ADS that we are looking for are very specifically created by EV with specific names and properties. If you targeted the prod data, but did not archive it, there are likely Archive Points and folder points you coppied over. . .and a likely root cause to your issue. So yes. . .You crossed your production streams with your POC streams. Never cross the streams.

J

[Phil_T1]

Hi Typoprone,

Got it working, thanks!  I deleted all the ADS from the directory (and subdirs), removed the archive point from the directory from within the Vault Admin console, deleted the folder and then recreated it (and the associated archive point) and re-executed the process and it's running through the files as I type this.

Thankyou both for your help. 

Cheers,

Phil