Enterprise Vault Journal Mailbox

[pjglick]

Has anyone troubljeshot the following issue?

Messages with the IPM.Note class within the jpournal mailbox are being archived but they seem to be getting stuck in the Not.enterpriseVault.PendingArcvhive.Part class.    The numbers are rising steadily without intermittent decrease.

Any thoughts?

Thanks

Paul

[daveoflave]

Hi Pjglick,

    That's pretty common among EV Journaling issues.  If you're sure they're getting archived, the first things to check are:

-If it's EV11.0.x or after, what's going on with the StorageQueue?  Is there a backlog of batch files sitting there?

-Coupled with that, what's the SafetyCopy setting for Journals in that vault store?  This can be found on the properties of the vault store that hosts that journal archive.  Normally it's set to "immediate" for Journals, but if it's not, the items could be waiting on being secured by StorageFileWatch. 

   If it turns out they aren't really archived yet; don't worry - those are still the full messages and can be reverted to IPM.Note using either the EV Policy setting for "Cancel Pending Timeout" combined with a Report Mode Archiving run, or by a third-party converter like DocMessageClass.  Hope this helps!

[pjglick]

I tired converting them from ipm.not.enterprisevault.pendingarchive.part to ipm.note and they just wend back to the .part class.  I see standarding archiving happening but it seems that they are all just moving from ipm.not, to ipm.note.enterprisevault.pedningarchive. then to ipm.not.enterprisevault.pendingarchive.part.

Not sure why.

Paul

[GertjanA]

Hello Paul,

Is your Vault Store perhaps in backup mode?

Does the open partition has space left?

If you want to really check, do the following:

Create a new Journal Mailbox in Exchange. Add the new Journal Mailbox to EV, make sure that is archived by it's own task, into it's own archive. configure Exchange to use the new Journal Mailbox. Leave the task for the old Journal Mailbox running as normal. Verify (by using Outlook on the EV server, with VSA logged in) the new journal mailbox is being processed. Also verify the old journal mailbox is processed. Be advised it can take up to 5 minutes before an item actually disappears from the Journal Mailbox (i.e. = archived), due to EV waiting for possible identical items coming in. It is my experience that you should start worrying if the item count in the Journal Mailbox goes up only, and no items seem to be moved out. If this happens, the EV Eventlog is your first starting point to check. If you do not see movement in the OLD journal mailbox, there might be an item preventing archiving to continue (it happens..). Then set the task for this one Journal Mailbox in reportmode, let it run for a while. Monitor MSMQ to see if that drops to 0 for that task. When 0, disable the Journal Mailbox for archiving (properties of the Journal mailbox in EV). sync the Journal mailbox, restart the task (still in report mode). Then use docmessageclass to revert the messageclasses back to ipm.note). Now create a new folder in that Journal Mailbox underneath the Enterprise Vault Journaling folders, call it 'special items' or something. Move the last 50 items from the inbox to this folder. enable archivng for this mailbox again, sync the mailbox, clear reportmode, restart the task, monitor the mailbox again.

If you do not want to use docmessageclass, change your journal policy to have 'Pending shortcut time out' set to 0. Then when you run the task in report mode, EV should revert the items back to ipm.note itself. This can take a while. Wait with actioning until all items are reverted back.

If there are still items that fail to archive, you need to dtrace the archiving, but then you should contact support, so they can assist in configuring dtrace, and you can have them go through the logfile.