01-19-2015 03:43 AM
We are seeing Event ID 7133 = "Some files were not collected because they have not been backed up. " for a Closed partition - I am trying to 100% clear on what is happening - hence posting "my theory" for validating or dismissing.
We are backing up partitions and use trigger files - same as for the open partition.
The Collection process finishes well inside the time window allocated for collections.
I see the 7133 event message is Informational.
Example:
"Log Name: Symantec Enterprise Vault Source: Enterprise Vault Date: 18/01/2015 18:10:43 Event ID: 7133 Task Category: Storage File Watch Level: Information Keywords: Classic User: N/A Computer: ourserver.ourdomain.com Description: A Partition's Collector run has finished. Some files were not collected because they have not been backed up. Partition Root Path: \\ourstoragedevice\nas_sata_evdata1\EVServer01\MailBoxVaultStores\MBXVS02PTN9 Archived items: 73 Files added to collections: 1122 Collections: 28 "
Here is my theory -
The collection process "breaks down" and "puts together" collections - according to the archive retention policy and dealing with sparse files ( https://www-secure.symantec.com/connect/blogs/events-logged-collections ) - I believe this might leave some files out of a collection at that particular point in time. - hence when the Collection run finishes - it is true to say some files have not been backed up.
We then later place partitions into Backup mode, backup using trigger files and then bring out of Backup mode.
As the Collection always does something ( does not run in a type of informational mode way) - it always generates the Event ID 7133 messages.
Are the words above an accurate reflection of what is happening ?
and
This informational event log message is just that ( so not problems) though does inform you to do backups.
Solved! Go to Solution.
01-19-2015 07:52 AM
it's kind of a chicken/egg type situation the way i see it and i agree that the event message is more FYI.
however:
are you running collections before you backup? might make sense to schedule them to begin after backups complete.
does your archiving schedule overlap with your collections schedule? you want to avoid any overlap.
are users allowed to manually archive? could be related if you're running collections during business hours when users are archiving.
there are a few things like these that you can check to reduce the likelihood of some files not being collected. but all in all it's nothing to be alarmed about
01-19-2015 07:52 AM
it's kind of a chicken/egg type situation the way i see it and i agree that the event message is more FYI.
however:
are you running collections before you backup? might make sense to schedule them to begin after backups complete.
does your archiving schedule overlap with your collections schedule? you want to avoid any overlap.
are users allowed to manually archive? could be related if you're running collections during business hours when users are archiving.
there are a few things like these that you can check to reduce the likelihood of some files not being collected. but all in all it's nothing to be alarmed about
01-19-2015 08:24 AM
Hi AndrewB, thank you for responding
We run daily backups - starting at 3 am - this finishes usually in 3 hours ( 6am ish)
The Collections are run from 6PM until 10PM - this is verified from the event logs - I believe we have no overlap - to answer the question, we run backup then collection then next days backup and next days collection etc
Users cannot manually archive
01-19-2015 08:49 AM
so you have a 12 hour gap between the end of your backup and the start of collections. that's 12 hours where items (that havent been backed up) could be archived and result in the message you're getting.
and what's the schedule for your archiving tasks? might make sense to adjust collections to start closer to the end of your backup window.
01-19-2015 08:58 AM
Our Archiving shedule runs from 10 PM ( afer the collection finishes ) through to 3AM ( when the Backup starts)
01-19-2015 09:07 AM
do you journal?
01-20-2015 02:50 AM
Hi, - we do not journal - also re-iterating we see this for a closed partition ( not sure if relavent ) - thank you
01-20-2015 06:16 AM
i must have missed it before if you said your inquiry is about a closed partition. as you may know, cab files will be extracted if/when users retrieve archived items from them or if items are exported by the admin or by an eDiscovery process (even in a closed partition including index rebuilds and other admin activity.)
bottom line, nothing really to worry about.
01-21-2015 04:43 AM
In this case i would recommend to create a trigger file for that closed partition(since you are using trigger file) when you perform a backup for the next schedule.
01-23-2015 05:43 AM
Thank you ManishN - We have tried this already - and still get the
"Some files were not collected because they have not been backed up."
01-26-2015 12:51 AM
I guess "Some files were not collected because they have not been backed up" is generic informational message along with the print of Event ID 7133 and not a problem.
If files are not been collected then you will see something like below
Archived items: 0 |Files added to collections: 0 |Collections: 0
If files are collected then you will see something like
Archived items: 1 |Files added to collections: 7 |Collections: 1
In your case event you see
Archived items: 73
Files added to collections: 1122
Collections: 28 "
So it looks not an issue. If the items are getting collected when run, in the end it gives you information in the Event ID 7133. However i will confirm this.
01-26-2015 04:31 PM
can you check the partition properties from the vault console and see if it indicates any items that havent been backed up?
02-03-2015 06:39 AM
From the Backup Details ( I have manually type this in)
Last item secured 13/09/2011 03:15:36
last Scan:
Scan State: completed
Last scan started : 03/02/2015 04:30:41
last Scan finished: 03/02/2015 04:30:41
Summary:
Unsecured items 0
secured items 0
total items 0
Unsecured items:
Unsecured items in local partition 0
Unsecured SIS parts in local partition 0
Unsecured SIS parts in other partitions 0
=======================================
I did a manual collection this morning ( after the over night backup which includes a trigger file) and see the following results:
Log Name: Symantec Enterprise Vault
Source: Enterprise Vault
Date: 03/02/2015 10:42:30
Event ID: 7133
Task Category: Storage File Watch
Level: Information
Keywords: Classic
User: N/A
Computer: aserver.ourdomain.com
Description:
A Partition's Collector run has finished.
Some files were not collected because they have not been backed up.
Partition Root Path: \\abbmamnas1c2nas\nas_sata_evdata1\EVServer01\MailBoxVaultStores\MBXVS01PTN7
Archived items: 2316
Files added to collections: 17492
Collections: 311
Time taken for the run [H:M:S]: 1:06:35