β02-08-2013 02:56 AM
Hi.
Since a few weeks we've been having problem with 1 specific mailbox.
See below for all the generated event logs about this problem.
We've tried lots of solutions provided by Symantec Forum but unfortenately that didn't lead to a solution in our case.
There are error messages implying we don't have enough memory available, even though the server is running with 12GB of mem this has never been a problem. Also there are messages about diskspace, I can assure you we have plenty of diskspace free.
Also tried to put the whole archive offline, rename the folder of the specific archive folder and let is rebuild completely.
Then after a while the same error messages as below show up in the Event Viewer.
After trying to find a solution for 2 weeks i'm hoping you could point me in the right direction.
Thanks in advance.
Log Name: Symantec Enterprise Vault
Source: Enterprise Vault
Date: 08.02.2013 10:43:30
Event ID: 7235
Task Category: Index Server
Level: Error
Keywords: Classic
User: N/A
Computer: <servername.domain>
Description:
A low level indexing operation has failed
Error: Filter error [AV:24]
Index Id: 1FF4B881ADC47464EB39DE2B8534C43861110000vie-eu-archiv/Volume:32 (<name of user>)
For more information, see Help and Support Center at http://evevent.symantec.com/rosetta/showevent.asp?EvtID=7235
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Enterprise Vault " />
<EventID Qualifiers="49156">7235</EventID>
<Level>2</Level>
<Task>25</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2013-02-08T09:43:30.000Z" />
<EventRecordID>2505554</EventRecordID>
<Channel>Symantec Enterprise Vault</Channel>
<Computer><servername.domain></Computer>
<Security />
</System>
<EventData>
<Data>Filter error [AV:24]</Data>
<Data>1FF4B881ADC47464EB39DE2B8534C43861110000vie-eu-archiv/Volume:32 (<name of user>)</Data>
</EventData>
</Event>
Log Name: Symantec Enterprise Vault
Source: Enterprise Vault
Date: 08.02.2013 10:43:57
Event ID: 7187
Task Category: Index Server
Level: Error
Keywords: Classic
User: N/A
Computer: <servername.domain>
Description:
Could not add Indexable Item and Per-user data to Index: Unspecified error (0x80004005)
Internal reference: 1FF4B881ADC47464EB39DE2B8534C43861110000vie-eu-archiv/Volume:32 (<name of user>)
Additional Info: AltaVista error
For more information, see Help and Support Center at http://evevent.symantec.com/rosetta/showevent.asp?EvtID=7187
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Enterprise Vault " />
<EventID Qualifiers="49156">7187</EventID>
<Level>2</Level>
<Task>25</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2013-02-08T09:43:57.000Z" />
<EventRecordID>2505559</EventRecordID>
<Channel>Symantec Enterprise Vault</Channel>
<Computer><servername.domain></Computer>
<Security />
</System>
<EventData>
<Data>Unspecified error (0x80004005)</Data>
<Data>1FF4B881ADC47464EB39DE2B8534C43861110000vie-eu-archiv/Volume:32 (<name of user>)</Data>
<Data>AltaVista error</Data>
</EventData>
</Event>
Log Name: Symantec Enterprise Vault
Source: Enterprise Vault
Date: 08.02.2013 10:48:17
Event ID: 7235
Task Category: Index Server
Level: Error
Keywords: Classic
User: N/A
Computer: <servername.domain>
Description:
A low level indexing operation has failed
Error: can't allocate memory [AV:1]
Index Id: 1FF4B881ADC47464EB39DE2B8534C43861110000vie-eu-archiv/Volume:32 (<name of user>)
For more information, see Help and Support Center at http://evevent.symantec.com/rosetta/showevent.asp?EvtID=7235
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Enterprise Vault " />
<EventID Qualifiers="49156">7235</EventID>
<Level>2</Level>
<Task>25</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2013-02-08T09:48:17.000Z" />
<EventRecordID>2505560</EventRecordID>
<Channel>Symantec Enterprise Vault</Channel>
<Computer><servername.domain></Computer>
<Security />
</System>
<EventData>
<Data>can't allocate memory [AV:1]</Data>
<Data>1FF4B881ADC47464EB39DE2B8534C43861110000vie-eu-archiv/Volume:32 (<name of user>)</Data>
</EventData>
</Event>
Log Name: Symantec Enterprise Vault
Source: Enterprise Vault
Date: 08.02.2013 10:48:17
Event ID: 7313
Task Category: Index Server
Level: Error
Keywords: Classic
User: N/A
Computer: <servername.domain>
Description:
Failed to commit Index updates to disk.
Reason: Not enough storage is available to complete this operation. (0x8007000e)
Index Id: 1FF4B881ADC47464EB39DE2B8534C43861110000vie-eu-archiv/Volume:32 (<name of user>)
Index Path: D:\IndexD\index8\1FF4B881ADC47464EB39DE2B8534C43861110000vie-eu-archiv
Available Disk Space: 86331652 KB(86331652 KB)
Number of Items added: 8834
Number of Items deleted: 0
Number of Items updated: 0
Number of new words: 1246398
Additional Info: Makestable
Vers:-1 Mem Load:1 (Max:1310720) KB
For more information, see Help and Support Center at http://evevent.symantec.com/rosetta/showevent.asp?EvtID=7313
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Enterprise Vault " />
<EventID Qualifiers="49156">7313</EventID>
<Level>2</Level>
<Task>25</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2013-02-08T09:48:17.000Z" />
<EventRecordID>2505561</EventRecordID>
<Channel>Symantec Enterprise Vault</Channel>
<Computer><servername.domain></Computer>
<Security />
</System>
<EventData>
<Data>Not enough storage is available to complete this operation. (0x8007000e)</Data>
<Data>1FF4B881ADC47464EB39DE2B8534C43861110000vie-eu-archiv/Volume:32 (<name of user>)</Data>
<Data>D:\IndexD\index8\1FF4B881ADC47464EB39DE2B8534C43861110000vie-eu-archiv</Data>
<Data>86331652 KB(86331652 KB)</Data>
<Data>8834</Data>
<Data>0</Data>
<Data>0</Data>
<Data>1246398</Data>
<Data>Makestable</Data>
<Data>Vers:-1 Mem Load:1 (Max:1310720) KB</Data>
</EventData>
</Event>
Log Name: Symantec Enterprise Vault
Source: Enterprise Vault
Date: 08.02.2013 10:48:27
Event ID: 7235
Task Category: Index Server
Level: Error
Keywords: Classic
User: N/A
Computer: <servername.domain>
Description:
A low level indexing operation has failed
Error: a severe error occurred; cannot continue [AV:63]
Index Id: 1FF4B881ADC47464EB39DE2B8534C43861110000vie-eu-archiv/Volume:32 (<name of user>)
For more information, see Help and Support Center at http://evevent.symantec.com/rosetta/showevent.asp?EvtID=7235
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Enterprise Vault " />
<EventID Qualifiers="49156">7235</EventID>
<Level>2</Level>
<Task>25</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2013-02-08T09:48:27.000Z" />
<EventRecordID>2505562</EventRecordID>
<Channel>Symantec Enterprise Vault</Channel>
<Computer><servername.domain></Computer>
<Security />
</System>
<EventData>
<Data>a severe error occurred; cannot continue [AV:63]</Data>
<Data>1FF4B881ADC47464EB39DE2B8534C43861110000vie-eu-archiv/Volume:32 (<name of user>)</Data>
</EventData>
</Event>
Log Name: Symantec Enterprise Vault
Source: Enterprise Vault
Date: 08.02.2013 10:48:27
Event ID: 7235
Task Category: Index Server
Level: Error
Keywords: Classic
User: N/A
Computer: <servername.domain>
Description:
A low level indexing operation has failed
Error: a severe error occurred; cannot continue [AV:63]
Index Id: 1FF4B881ADC47464EB39DE2B8534C43861110000vie-eu-archiv/Volume:32 (<name of user>)
For more information, see Help and Support Center at http://evevent.symantec.com/rosetta/showevent.asp?EvtID=7235
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Enterprise Vault " />
<EventID Qualifiers="49156">7235</EventID>
<Level>2</Level>
<Task>25</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2013-02-08T09:48:27.000Z" />
<EventRecordID>2505564</EventRecordID>
<Channel>Symantec Enterprise Vault</Channel>
<Computer><servername.domain></Computer>
<Security />
</System>
<EventData>
<Data>a severe error occurred; cannot continue [AV:63]</Data>
<Data>1FF4B881ADC47464EB39DE2B8534C43861110000vie-eu-archiv/Volume:32 (<name of user>)</Data>
</EventData>
</Event>
Solved! Go to Solution.
β02-08-2013 06:29 AM
Quick question
Do you have AntiVirus scanning the location? (not just full scan but on access scanning as well?)
Also where are these indexes located?
SAN? NAS? NetApp? Network share? local drive?
Maybe worth disabling Opportunistic locking as i've seen that as well cause issues like this
Also the archive, is it just a regular user mailbox? a journal mailbox? FSA share? sharepoint etc?
β02-08-2013 03:39 AM
you may try creating the following DWord registry key
HKLM\Software\WOW6432NODE\KVS\Enterprise Vault\Indexing
NumWordsToWrite
and set the vaule as 50000 decimal and restart indexing service
β02-08-2013 03:49 AM
β02-08-2013 05:39 AM
Thanks for the quick response, i've set the value to 50000 decimal and restarted the indexing service.
After this i reinitiated the rebuild of te specific enterprise vault archive and gave it some time.
After a while the same event messages appear in the event log. Did I do something wrong when applying this solution?
Kind regards,
Phyrax
β02-08-2013 06:29 AM
Quick question
Do you have AntiVirus scanning the location? (not just full scan but on access scanning as well?)
Also where are these indexes located?
SAN? NAS? NetApp? Network share? local drive?
Maybe worth disabling Opportunistic locking as i've seen that as well cause issues like this
Also the archive, is it just a regular user mailbox? a journal mailbox? FSA share? sharepoint etc?
β02-12-2013 05:53 AM
Hi,
Antivirus was not skipping these folder in both cases, configured it correct now.
The archives are located in a SAN, oppurtunistic locking has already been disabled.
This was conserning a regular user mailbox.
Right now the issue seems to be resolved as the archive is fully operational and I am not getting 50 messages per day regarding this specific user in my event log. I think it was the combination between the Anti Virus full/access scanning and setting NumWordsToWrite to 50000
Thanks for your quick answers!
Kind regards,
Phyrax