EV6 vs EV9 troubleshooting

[AB_5356]

Hi,

as we are currently migrating some of our users from our EV6 envirnonment to EV9, I have noticed that some events or errors aren't logged anymore in the event viewer.

For example : in EV6, when a user tried to open a shorctut to an archive where he doesn't have the rights, a beautiful error message was created in the event viewer. 

In version 9 it seems to have dissapeared... Is there any other way to verify this or are these attempts logged somewhere else ?

Thanks in advance

Andres

[Mohawk_Marvin]

Those events are still logged in v9.

[AB_5356]

When I check in EV6 , I can see an EVENT 6941 :

Client request refused due to insufficient privileges, user domain\user1 attempted to access the Archive Folder:

Archive name: xxx

Archive folder path: \xxx

I tested it with a mail in EV9 and on that exact moment I also see an event 8391 :

The EnterpriseVault.DirectoryService object reported an error.
 
Unspecified error
 
For more information, see Help and Support Center at http://evevent.symantec.com/rosetta/showevent.asp

[Mohawk_Marvin · Accepted solution]

So ok then you have a problem in the environment from that error, as v9 still logs that 6941 event. You are probably going to need to run a dtrace on the directory service im afraid, or log a call it to SYMC Support

[AB_5356]

I already runned a dtrace on the directory service :

1.766 07:46:07.324 [10.300] (w3wp) <7568> EV~W Event ID: 6287 Unable to fetch item from "evault1.domain.net".
Reason: Access denied      [0xc0041801]
Saveset Id: 201107281851952~201106280739520000~Z~70C4E50B81F59C33DD0D22FDD5FCAD01
Archive Name: name

Archive Folder Path: ?Inbox
Reference: [GOAFS]

This gets me a bit further, but here I still can't find out who tries to access the archive...

Do you have activated something on the server ( auditing or something ) for the 6941 events to be logged ?

Thanks in advance