03-24-2015 05:04 AM
Hello all,
I have a few of the mentioned events in the Symantec Enterprise Vault eventlog:
User 'Domain\UserName' does not have permission on any archive.
Event 41478 - Enterprise Vault search.
User has an archive, with permissions automatically set following mailbox.
Any idea what this might indicate? I could not find anything related to this error.
Thanks!
GJ
Solved! Go to Solution.
03-24-2015 06:37 AM
If the user is able to access the archive then the event logged seems to be a temporary issue.
Monitor the event viewer for another day or so and then let me know if you again getting these events.
03-24-2015 05:16 AM
For more information about the error check EVSearchClient log located at the below location.
C:\ProgramData\Symantec\Enterprise Vault\Search
Is the user in question able to access Enterprise Vault Search?
03-24-2015 06:18 AM
Hello Amol,
User can access search (EVS new search), and his own archive, without issues. I
client logfile shows as below (snip)
ThreadID DateTime LogType Message
3 03/23/2015 07:09:29.726 Info Loading client plugins.
3 03/23/2015 07:09:30.319 Info Client plugins loaded.
8 03/23/2015 07:09:38.961 Info Client Credential TypeWindows
8 03/23/2015 07:09:38.961 Info Client Credential TypeBasic
11 03/23/2015 12:13:28.711 Error Failed while getting Archive. || User: Domain\User || System.Collections.Generic.KeyNotFoundException: The given key was not present in the dictionary.
at System.ThrowHelper.ThrowKeyNotFoundException()
at System.Collections.Generic.Dictionary`2.get_Item(TKey key)
at Symantec.EV.Search.Server.Business.ContentSource.<>c__DisplayClass31.<GetFolderHeirarchy>b__2e(Folder f)
at System.Collections.Generic.List`1.ForEach(Action`1 action)
at Symantec.EV.Search.Server.Business.ContentSource.GetFolderHeirarchy(FolderQuery query, UserPreference preference, Boolean& defaultFolderFound)
at Symantec.EV.Search.Server.Service.ContentManagementService.GetFolderHeirarchy(FolderQuery folderQuery, UserPreference userPreference, Boolean& defaultFolderFound)
at Symantec.EV.Search.Client.Presentation.Model.SearchModel.GetFolderHeirarchy(FolderQuery folderQuery, UserPreference userPreference, Boolean& defaultFolderFound)
at Symantec.EV.Search.Client.Presentation.Presenters.ArchivesPresenter.LoadArchiveGroups(ArchiveQuery query, UserPreference userPreference)
at Symantec.EV.Search.Client.Host.View.ArchivesView.OnPageLoad(EventArgs args)
11 03/23/2015 12:13:28.773 Warning User 'Domain\User' does not have permission on any archive. || User: Domain\User
and I also see some
9 03/24/2015 12:09:47.905 Error Enterprise Vault Search cannot perform certain operations. Check that all Enterprise Vault services are running.
9 03/24/2015 12:09:47.905 Error Inside IErrorHandler.HandleError() || System.Exception: SessionExpiredError
at Symantec.EV.Search.Client.Host.PluginService.ClientDataService..ctor()
at CreateSymantec.EV.Search.Client.Host.PluginService.ClientDataService()
at System.ServiceModel.Dispatcher.InstanceBehavior.InstanceProvider.GetInstance(InstanceContext instanceContext, Message message)
at System.ServiceModel.Dispatcher.InstanceBehavior.GetInstance(InstanceContext instanceContext, Message request)
at System.ServiceModel.InstanceContext.GetServiceInstance(Message message)
at System.ServiceModel.Dispatcher.ImmutableDispatchRuntime.ProcessMessage5(MessageRpc& rpc)
at System.ServiceModel.Dispatcher.ImmutableDispatchRuntime.ProcessMessage4(MessageRpc& rpc)
at System.ServiceModel.Dispatcher.ImmutableDispatchRuntime.ProcessMessage3(MessageRpc& rpc)
at System.ServiceModel.Dispatcher.ImmutableDispatchRuntime.ProcessMessage2(MessageRpc& rpc)
at System.ServiceModel.Dispatcher.ImmutableDispatchRuntime.ProcessMessage1(MessageRpc& rpc)
at System.ServiceModel.Dispatcher.MessageRpc.Process(Boolean isOperationContextSet)
30 03/24/2015 12:16:15.603 Error Enterprise Vault Search cannot perform certain operations. Check that all Enterprise Vault services are running.
30 03/24/2015 12:16:15.603 Error Inside IErrorHandler.HandleError() || System.Exception: SessionExpiredError
services are running.
Should I perhaps restart indexing service?
Thx./
03-24-2015 06:37 AM
If the user is able to access the archive then the event logged seems to be a temporary issue.
Monitor the event viewer for another day or so and then let me know if you again getting these events.
03-24-2015 07:19 AM
Hello AmolB,
I've seen these events before, they do disappear after a few hours. I'll monitor for them to re-occurr within a reasonable timeframe.
I'll close this question. If it pops up again, I'll raise a case.
03-25-2015 04:15 AM
AmolB,
same happend today (25-03-2015) with some users, not all.
I opened case 08481332.
Uploading symhelp file as we write. Logfiles from report folder are attached to case.
03-25-2015 05:16 AM
I will sync up with the support engineer.
04-02-2015 12:40 PM
Not sure you're getting these, but we have more than 10 users reporting this now. There is a case. Cannot get the number now. I believe it has to do with messy permissions on archive.
One user we investigated showed in that search logfile with more archives than when running Get-Evarchive.
I verified all archives user was reported for in the search logfile, and zapped the archives user should not have permissions on anymore. (one only had 2 account unknown ones, weird), but that did not help.
I am reluctant to zap permissions on the other archives, as most are functional mailboxes, and zapping means removing permissions for many users..
I'll liase with support again tomorrow.
04-03-2015 02:41 AM
Hello GertjanA,
We have seen this issue occurring when the binary value for the Preferences column in the OWS_UserPreferences table gets corrupted.
The OWS_UserPreferences table since 11.0.1 stores each user EV Search preferences (such as where to open the search each time).
The short term workaround would be to actually delete the row corresponding to the affected user from the table, a new record will be created once the user will re-open the EV search.
Long term solution would be to understand what exactly is causing the binary data to be stored corrupted, I would check if the TCP Chimney is turned off http://www.symantec.com/business/support/index?page=content&id=TECH56172
Please let me know (even privately) the case number, so I can take a look.
Massimo
04-07-2015 03:52 AM
Removing the affected rows from the table has fixed the issue for users. Working with Symantec to get a grip on the cause.
04-09-2015 04:23 AM
Update on 'fix'.
If a user reports he gets that error – (event 41478 in eventlog), I find the SID belonging to the user reported, and then delete the row from the table OWS_UserPreferences, then ask the user to try again. It then works.
The next day, sometimes the user gets the same error again. I've cleared the rows for users again today. If it happens tomorrow again, I will rerun a trace.
Case will / is updated
04-15-2015 08:14 AM
Hello Gertjan,
are there any news on this case? A customer is facing the same issues and deleting the entry solves the problem temporary.
04-15-2015 11:13 PM
Hello Marc,
There is no news yet. You might want to raise a case also, and refer to mine:
Case 08481332
I have only a few users having this, but it is very annoying.
GJ