cancel
Showing results for 
Search instead for 
Did you mean: 

EV11 event 41478 - user does not have permission on any archive

GertjanA
Moderator
Moderator
Partner    VIP    Accredited Certified

Hello all,

I have a few of the mentioned events in the Symantec Enterprise Vault eventlog:

User 'Domain\UserName' does not have permission on any archive.

Event 41478 - Enterprise Vault search.

User has an archive, with permissions automatically set following mailbox.

Any idea what this might indicate? I could not find anything related to this error.

Thanks!

GJ

Regards. Gertjan
1 ACCEPTED SOLUTION

Accepted Solutions

AmolB
Moderator
Moderator
Employee Accredited Certified

If the user is able to access the archive then the event logged seems to be a temporary issue. 

Monitor the event viewer for another day or so and then let me know if you again getting these events.

View solution in original post

12 REPLIES 12

AmolB
Moderator
Moderator
Employee Accredited Certified

For more information about the error check EVSearchClient log located at the below location.

C:\ProgramData\Symantec\Enterprise Vault\Search

Is the user in question able to access Enterprise Vault Search?

GertjanA
Moderator
Moderator
Partner    VIP    Accredited Certified

Hello Amol,

User can access search (EVS new search), and his own archive, without issues. I

client logfile shows as below (snip)

ThreadID DateTime LogType Message
3 03/23/2015 07:09:29.726 Info Loading client plugins.
3 03/23/2015 07:09:30.319 Info Client plugins loaded.
8 03/23/2015 07:09:38.961 Info Client Credential TypeWindows
8 03/23/2015 07:09:38.961 Info Client Credential TypeBasic
11 03/23/2015 12:13:28.711 Error Failed while getting Archive. || User: Domain\User || System.Collections.Generic.KeyNotFoundException: The given key was not present in the dictionary.
   at System.ThrowHelper.ThrowKeyNotFoundException()
   at System.Collections.Generic.Dictionary`2.get_Item(TKey key)
   at Symantec.EV.Search.Server.Business.ContentSource.<>c__DisplayClass31.<GetFolderHeirarchy>b__2e(Folder f)
   at System.Collections.Generic.List`1.ForEach(Action`1 action)
   at Symantec.EV.Search.Server.Business.ContentSource.GetFolderHeirarchy(FolderQuery query, UserPreference preference, Boolean& defaultFolderFound)
   at Symantec.EV.Search.Server.Service.ContentManagementService.GetFolderHeirarchy(FolderQuery folderQuery, UserPreference userPreference, Boolean& defaultFolderFound)
   at Symantec.EV.Search.Client.Presentation.Model.SearchModel.GetFolderHeirarchy(FolderQuery folderQuery, UserPreference userPreference, Boolean& defaultFolderFound)
   at Symantec.EV.Search.Client.Presentation.Presenters.ArchivesPresenter.LoadArchiveGroups(ArchiveQuery query, UserPreference userPreference)
   at Symantec.EV.Search.Client.Host.View.ArchivesView.OnPageLoad(EventArgs args)
11 03/23/2015 12:13:28.773 Warning User 'Domain\User' does not have permission on any archive. || User: Domain\User

 

and I also see some

9 03/24/2015 12:09:47.905 Error Enterprise Vault Search cannot perform certain operations. Check that all Enterprise Vault services are running.
9 03/24/2015 12:09:47.905 Error Inside IErrorHandler.HandleError() || System.Exception: SessionExpiredError
   at Symantec.EV.Search.Client.Host.PluginService.ClientDataService..ctor()
   at CreateSymantec.EV.Search.Client.Host.PluginService.ClientDataService()
   at System.ServiceModel.Dispatcher.InstanceBehavior.InstanceProvider.GetInstance(InstanceContext instanceContext, Message message)
   at System.ServiceModel.Dispatcher.InstanceBehavior.GetInstance(InstanceContext instanceContext, Message request)
   at System.ServiceModel.InstanceContext.GetServiceInstance(Message message)
   at System.ServiceModel.Dispatcher.ImmutableDispatchRuntime.ProcessMessage5(MessageRpc& rpc)
   at System.ServiceModel.Dispatcher.ImmutableDispatchRuntime.ProcessMessage4(MessageRpc& rpc)
   at System.ServiceModel.Dispatcher.ImmutableDispatchRuntime.ProcessMessage3(MessageRpc& rpc)
   at System.ServiceModel.Dispatcher.ImmutableDispatchRuntime.ProcessMessage2(MessageRpc& rpc)
   at System.ServiceModel.Dispatcher.ImmutableDispatchRuntime.ProcessMessage1(MessageRpc& rpc)
   at System.ServiceModel.Dispatcher.MessageRpc.Process(Boolean isOperationContextSet)
30 03/24/2015 12:16:15.603 Error Enterprise Vault Search cannot perform certain operations. Check that all Enterprise Vault services are running.
30 03/24/2015 12:16:15.603 Error Inside IErrorHandler.HandleError() || System.Exception: SessionExpiredError

services are running.

Should I perhaps restart indexing service?

Thx./

Regards. Gertjan

AmolB
Moderator
Moderator
Employee Accredited Certified

If the user is able to access the archive then the event logged seems to be a temporary issue. 

Monitor the event viewer for another day or so and then let me know if you again getting these events.

GertjanA
Moderator
Moderator
Partner    VIP    Accredited Certified

Hello AmolB,

I've seen these events before, they do disappear after a few hours. I'll monitor for them to re-occurr within a reasonable timeframe.

I'll close this question. If it pops up again, I'll raise a case.

 

Regards. Gertjan

GertjanA
Moderator
Moderator
Partner    VIP    Accredited Certified

AmolB,

same happend today (25-03-2015) with some users, not all.

I opened case 08481332.

Uploading symhelp file as we write. Logfiles from report folder are attached to case.

Regards. Gertjan

AmolB
Moderator
Moderator
Employee Accredited Certified

I will sync up with the support engineer.

GertjanA
Moderator
Moderator
Partner    VIP    Accredited Certified

Not sure you're getting these, but we have more than 10 users reporting this now. There is a case. Cannot get the number now. I believe it has to do with messy permissions on archive.

One user we investigated showed in that search logfile with more archives than when running Get-Evarchive.

I verified all archives user was reported for in the search logfile, and zapped the archives user should not have permissions on anymore. (one only had 2 account unknown ones, weird), but that did not help.

I am reluctant to zap permissions on the other archives, as most are functional mailboxes, and zapping means removing permissions for many users..

I'll liase with support again tomorrow.

Regards. Gertjan

MassimoVagli
Level 4
Employee Accredited Certified

Hello GertjanA, 

We have seen this issue occurring when the binary value for the Preferences column in the OWS_UserPreferences table gets corrupted.

The OWS_UserPreferences table since 11.0.1 stores each user EV Search preferences (such as where to open the search each time).

The short term workaround would be to actually delete the row corresponding to the affected user from the table, a new record will be created once the user will re-open the EV search.

Long term solution would be to understand what exactly is causing the binary data to be stored corrupted, I would check if the TCP Chimney is turned off http://www.symantec.com/business/support/index?page=content&id=TECH56172

Please let me know (even privately) the case number, so I can take a look.

Massimo

 

 

GertjanA
Moderator
Moderator
Partner    VIP    Accredited Certified

Removing the affected rows from the table has fixed the issue for users. Working with Symantec to get a grip on the cause.

 

Regards. Gertjan

GertjanA
Moderator
Moderator
Partner    VIP    Accredited Certified

Update on 'fix'.

If a user reports he gets that error – (event 41478 in eventlog), I find the SID belonging to the user reported, and then delete the row from the table OWS_UserPreferences, then ask the user to try again. It then works.

 

The next day, sometimes the user gets the same error again. I've cleared the rows for users again today. If it happens tomorrow again, I will rerun a trace.

 

Case will / is updated

Regards. Gertjan

Marcde
Moderator
Moderator
Partner    VIP    Accredited

Hello Gertjan, 

are there any news on this case? A customer is facing the same issues and deleting the entry solves the problem temporary. 

PMCS GmbH & Co. KG - A Serviceware Company
www.serviceware.de

GertjanA
Moderator
Moderator
Partner    VIP    Accredited Certified

Hello Marc,

There is no news yet. You might want to raise a case also, and refer to mine:

Case 08481332

I have only a few users having this, but it is very annoying.

GJ

Regards. Gertjan