Enterprise Vault Store and Index has been in backup mode for months

[junecastillote]

Hi Everyone,

We are using Enterprise Vault for Mail Archiving (9.0.3.1164). Since December 2013 the Store and Index Locations were set to Backup Mode as part of a migration project.

EV Policy is set to archive emails 90 days and older, which is still happening right now, these emails are disappearing from user mailboxes but since EV is in backup mode, these archives are not indexed and cannot be found/searched.

My questions are:

1. Since the Store and Index are in backup mode and the user emails are still disappearing from the user inbox in relation to the 90-day archive policy, where do these emails go to?

2. In the event that the EV Index and Store are cleared from backup mode, will these emails then be written to the EV Store and Indexed as it normally would and resume operation normally? Or is there risk of email/data loss?

Thank you

[AndrewB]

as far as i know, archiving cant be happening if your vault stores are in backup mode. like you said, where would the data go to? so are you certain that you dont have open partitions somewhere that arent in backup mode?

i think i addressed your first question. to answer your second question, i see potential backlog for indexing to catch up but no concern for data loss.

[junecastillote]

Thank you AndrewB.

That is also what I thought which is why this is bugging me. I can confirm that all partitions in this server are in backup mode. In fact, the only open partition does not have any data in the 2014 folder at all. However, reports of emails missing from the user mailboxes coinciding with the 90-day archive policy are still coming in.

[Rob_Wilcox1]

Do you have any mailbox cleanup type stuff running in Exchange?

[GertjanA · Accepted solution]

When EV is in backup mode, there is NO archiving taking place.

what you can check to be sure is to check in SQL, for 'monthly rate'. The below query probably shows this.

In addition to this, I agree with Rob. You need to check if you do not have an Exchange policy deleting stuff, or perhaps moving that to PST files.

Query:

--Monthly Rate
select "Archived Date" = left (convert (varchar, archiveddate,20),7),"Monthly Rate" = count (*),"Size MB" = sum (itemsize)/1024
from saveset
where archiveddate > dateadd("mm", -12, getdate ())
group by left(convert (varchar, archiveddate,20),7)
order by "Archived Date" Desc

Run this against your Vault Store Database. It will show archived items from the last 12 months. if you change "mm", -12 to "mm" -6 you get the last 6 months. That should show 0 everywhere.

[junecastillote]

Thank you Rob. Nothing of that sort is configured. Sure I have existing retention policies in Exchange (2010) but are not applied to any mailboxes.

[Rob_Wilcox1]

okay, best to do the query then...

[junecastillote]

Yes. I might try that query. Thank you

[junecastillote]

Had the time to run the query this morning and yes as expected, last Archiving was on December 2013.

Thank you for this.

We'll have to continue analyzing the current situation but this already confirms that EV most probably is not at fault.

Again, thank you.