cancel
Showing results for 
Search instead for 
Did you mean: 

Enterprise Vault 7133 event log messages

mjscreen1
Level 4

 

We are seeing Event ID 7133 = "Some files were not collected because they have not been backed up. " for a Closed partition - I am trying to 100% clear on what is happening - hence posting "my theory" for validating or dismissing.


We are backing up partitions and use trigger files - same as for the open partition.
The Collection process finishes well inside the time window allocated for collections.
I see the 7133 event message is Informational.

Example:

"Log Name:      Symantec Enterprise Vault
Source:        Enterprise Vault
Date:          18/01/2015 18:10:43
Event ID:      7133
Task Category: Storage File Watch
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      ourserver.ourdomain.com
Description:   A Partition's Collector run has finished.

Some files were not collected because they have not been backed up.

Partition Root Path: \\ourstoragedevice\nas_sata_evdata1\EVServer01\MailBoxVaultStores\MBXVS02PTN9

Archived items: 73
Files added to collections: 1122
Collections: 28 "

 

Here is my theory -

The collection process "breaks down" and  "puts together" collections - according to the archive retention policy and dealing with sparse files ( https://www-secure.symantec.com/connect/blogs/events-logged-collections ) - I believe this might leave some files out of a collection at that particular point in time.  - hence when the Collection run finishes - it is true to say some files have not been backed up.

We then later place partitions into Backup mode, backup using trigger files and then bring out of Backup mode.

As the Collection always does something ( does not run in a type of informational mode way) - it always generates the Event ID 7133 messages.

Are the words above an accurate reflection of what is happening ?
and
This informational event log message is just that ( so not problems) though does inform you to do backups.

1 ACCEPTED SOLUTION

Accepted Solutions

AndrewB
Moderator
Moderator
Partner    VIP    Accredited

it's kind of a chicken/egg type situation the way i see it and i agree that the event message is more FYI.

however:

are you running collections before you backup? might make sense to schedule them to begin after backups complete. 

does your archiving schedule overlap with your collections schedule? you want to avoid any overlap. 

are users allowed to manually archive? could be related if you're running collections during business hours when users are archiving.

there are a few things like these that you can check to reduce the likelihood of some files not being collected. but all in all it's nothing to be alarmed about

View solution in original post

12 REPLIES 12

AndrewB
Moderator
Moderator
Partner    VIP    Accredited

it's kind of a chicken/egg type situation the way i see it and i agree that the event message is more FYI.

however:

are you running collections before you backup? might make sense to schedule them to begin after backups complete. 

does your archiving schedule overlap with your collections schedule? you want to avoid any overlap. 

are users allowed to manually archive? could be related if you're running collections during business hours when users are archiving.

there are a few things like these that you can check to reduce the likelihood of some files not being collected. but all in all it's nothing to be alarmed about

mjscreen1
Level 4

Hi AndrewB, thank you for responding

We run daily backups - starting at 3 am - this finishes usually in 3 hours ( 6am ish)

The Collections are run from 6PM until 10PM - this is verified from the event logs - I believe we have no overlap - to answer the question, we run backup then collection then next days backup and next days collection etc

Users cannot manually archive

AndrewB
Moderator
Moderator
Partner    VIP    Accredited

so you have a 12 hour gap between the end of your backup and the start of collections. that's 12 hours where items (that havent been backed up) could be archived and result in the message you're getting.

and what's the schedule for your archiving tasks? might make sense to adjust collections to start closer to the end of your backup window.

mjscreen1
Level 4

Our Archiving shedule runs from 10 PM ( afer the collection finishes ) through to 3AM ( when the Backup starts)

 

AndrewB
Moderator
Moderator
Partner    VIP    Accredited

do you journal?

mjscreen1
Level 4

Hi,  - we do not journal - also re-iterating we see this for a closed partition ( not sure if relavent ) - thank you

AndrewB
Moderator
Moderator
Partner    VIP    Accredited

i must have missed it before if you said your inquiry is about a closed partition. as you may know, cab files will be extracted if/when users retrieve archived items from them or if items are exported by the admin or by an eDiscovery process (even in a closed partition including index rebuilds and other admin activity.)

bottom line, nothing really to worry about.

ManishN
Level 4
Employee Accredited

In this case i would recommend to create a trigger file for that closed partition(since you are using trigger file)  when you perform a backup for the next schedule.

mjscreen1
Level 4

Thank you ManishN -  We have tried this already - and still get the
"Some files were not collected because they have not been backed up."


 

ManishN
Level 4
Employee Accredited

I guess "Some files were not collected because they have not been backed up" is generic informational message along with the print of Event ID 7133 and not a problem.

If files are not been collected then you will see something like below

Archived items: 0 |Files added to collections: 0 |Collections: 0

If files are collected then you will see something like

Archived items: 1 |Files added to collections: 7 |Collections: 1

In your case event you see

Archived items: 73
Files added to collections: 1122
Collections: 28 "

So it looks not an issue. If the items are getting collected when run, in the end it gives you information in the Event ID 7133. However i will confirm this.

AndrewB
Moderator
Moderator
Partner    VIP    Accredited

can you check the partition properties from the vault console and see if it indicates any items that havent been backed up?

mjscreen1
Level 4

 

From the Backup Details ( I have manually type this in)

Last item secured 13/09/2011  03:15:36

last Scan:

  Scan State:    completed

  Last scan started :  03/02/2015 04:30:41 
  last Scan finished:  03/02/2015 04:30:41

Summary:

  Unsecured items   0
  secured items        0
  total items              0
 

Unsecured items:

  Unsecured items in local partition               0
  Unsecured SIS parts in local partition         0
  Unsecured SIS parts in other partitions       0
=======================================

 

 

I did a manual collection this morning ( after the over night backup which includes a trigger file) and see the following results:

 

Log Name:      Symantec Enterprise Vault
Source:        Enterprise Vault
Date:          03/02/2015 10:42:30
Event ID:      7133
Task Category: Storage File Watch
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      aserver.ourdomain.com
Description:
A Partition's Collector run has finished.

Some files were not collected because they have not been backed up.

Partition Root Path: \\abbmamnas1c2nas\nas_sata_evdata1\EVServer01\MailBoxVaultStores\MBXVS01PTN7

Archived items: 2316
Files added to collections: 17492
Collections: 311

Time taken for the run [H:M:S]: 1:06:35