EV10 - The archive that you are searching is being updated

[pdalte]

Hi. It would be great if someone had a solution for this one:

- New install of EV10 with Exchange and FSA Archiving on Windows 2008R2.
- Archiving, shortcut/placeholder processing and restoring items seem to be running smoothly.
- Opening Archive Explorer or Search, returns the message "The archive that you are searching is being updated." and 0 items.
- The message appears for FSA and Mailbox archives.
- The problem is there since the install of EV10 without hotfixes.
- In the meatime the latest EV hotfixes have been applied (didn't change a thing).
- Ran the Index Verify, Synchronize, Rebuild: they all return success, although nothing seems to get indexed.

The KB article I found about this issue: http://www.symantec.com/docs/TECH49000
(doesn't seem to apply, since there are no failed indexes and already ran the rebuild option).

I ran a DTRACE, but may need some help to know what to look for - I can't see any obvious error there.
I attached the DTRACE log, but here are some entries that look relevant to me:

"Fetched attribute WorkPending=True for index volume 1. Indexing is behind storage.
Setting InSync=false, and notifiying admin that there is work to do for the volume."

and

"Index volume info: ArchiveID=1804B65985DA3E745BF09D18BBADB69031110000sev ArchiveName=test_user IndexVolumeID=1 IsFailed=False IsOffline=False IsRebuilding=False IsWorkPending=True ArchiveStatus=DV_DS_AS_AVAILABLE FirstItemSequenceNumber=1 HighestItemSequenceNumber=0 OldestArchivedDateUTC=30-12-1899 00:00:00 YoungestArchivedDateUTC=30-12-1899 00:00:00 OldestItemDateUTC=30-12-1899 00:00:00 YoungestItemDateUTC=30-12-1899 00:00:00 ArchiveType=DV_DS_VT_MB_ARCHIVE HasFolders=True IndexRootPath=I:\Enterprise Vault Indexes\index1 FolderName=1804B65985DA3E745BF09D18BBADB6903_1 IndexItemsMode=INDEX_ITEMS_IMMEDIATELY CurrentEnableFacetedResults=True MixedFacetSettings=False FailedVolumeReason=None IndexedItems=0 IsLatest=True"

and

"NotifyAdminOfPendingWork: Sent sync notification to admin
Called CollectionBrokerSearch
Velocity.CollectionBrokerSearch returned for collection 1804B65985DA3E745BF09D18BBADB6903_1.
IsCollectionEmpty: SEARCH_ENGINE_EMPTY_INDEX found in Velocity response. Collection is empty.
SearchVelocity: Collection is empty, so returning empty results"

There's a pretty similar case reported in this forum, although it does not have a solution:
https://www-secure.symantec.com/connect/forums/cannot-search-archives-enterprise-vault-10

Thanks, Pedro.

[TonySterling]

Have you created Index Server Groups? 

About Index Server groups

Article: HOWTO57696

|

Created: 2011-08-01

|

Updated: 2011-08-16

|

Article URL http://www.symantec.com/docs/HOWTO57696

Do I need to create Index Server groups?

Article: HOWTO57701

|

Created: 2011-08-01

|

Updated: 2011-08-16

|

Article URL http://www.symantec.com/docs/HOWTO57701

[pdalte]

Hi.

No, it's a single EV server environment, without the need for Index Server Groups.

Thanks, Pedro.

[pdalte · Accepted solution]

After much digging, I decided to pay attention to an isolated event that I had reported in Event Viewer from the last time the server was booted:

"DCOM got error "2147944122" from the computer myevsever.local when attempting to activate the server: {3A92686F-E5E8-4505-ABB5-49E5F725617A}"

Searching the registry showed me that "{3A92686F-E5E8-4505-ABB5-49E5F725617A}" referred to the Storage/Archive Crawler Service. Had no other hints, but I had seen a few posts regarding DCOM related problems that were fixed by re-inserting the EV service account password.

After doing that and restarting the services, I got all my archived data showing up in Archive Explorer and Search! It's just incredible that you see no errors reported anywhere... just that single isolated and apparently unimportant DCOM message.