Event 41022 Due to deleted Archives

[Mark_Solutions]

Hi All

On site with a customer looking at their install and would like to clear up an error they have had for a long time - so any help appreciated

EV 9.0 (just patched to 9.0.2) On Windows 2003 Std SP2

Single EV Server doing mailbox and journal archiving from Exchange 2003

The 41022 usually is the SQL compatibility mode but that has been done without fixing it - i have the "There are 38373 items that have been deleted from Vault Store 'MailboxVS' but have not yet been deleted from the indexes."

I have done some digging and discovered that all of these entires (in the mailbox store db.JournalDelete table) relate to a date in March 2009 - all the same date.

More digging shows that on that date a number of users (and hence archives) were deleted from EV along with the AD and Exchange accounts - general tidying up of users that had left - 117 users in the JournalDelete table.

This cleanup is standard proceedure and does not cause issues so something obviously went wrong on that one day.

So what is the best way to deal with this to remove this error - clear the tables? work through indexes? etc.

Thanks for any thoughts and advice

[TonySterling]

Are these the steps you followed:

Items remain in the index after being deleted or expired from the archive

Article: TECH51290

|

Created: 2007-01-16

|

Updated: 2010-01-25

|

Article URL http://www.symantec.com/docs/TECH51290

[Mark_Solutions]

Tony

Thanks - yes that is the one that has been tried with no effect.

These just relate to a single day when something obviously went astray - just need to know what to do with them

[TonySterling]

hmm, so I take it this event has been occurring a while?

Maybe use this article to find the relevant Index Volume and do an update on it?

Article URL http://www.symantec.com/docs/TECH51095

edit--Oh, are there any failed index volumes?

[Mark_Solutions]

Tony

Thanks for that

There aren't any failed indexes

This event has appeared during the daily monitoring run each day (shows in the Status section of the admin console as Critical) since the archives were deleted in March 2009

Doesnt seem to have had any effect on EV itself and i can see all of the entries in the dbo.JournalDelete database table.

The 38373 items relate to 117 vault id's / 17 archive id's according to the tables - so i guess this relates to how many users were deleted that day.

Just need to know how to tidy it up - dtrace of the index broker shows nothing being deleted

Thanks

[TonySterling]

One last thing,

What is the DeletionStatus and DeletionReason for these items?

I absolutely loathe removing items from SQL tables without being directed to by support so I try to exhaust every effort to resolve issues without doing so. 

[Mark_Solutions]

Tony

The IndexComitted column all says "false"

Deletion Status is "1" (been there a long time!)

Deletion Reason is "255" - which i believe is unknown!

Doesn't look very helpful! - Any thoughts?

[Mark_Solutions]

Any ideas anyone?

Thanks

[JesusWept3]

If the archive has been deleted and the indexes are gone then really you dont have much choice but to do it manually, unless you have event logs or transaction logs dating back to that time, you're not really going to figure out what happened.

[Mark_Solutions]

I take it that if i check one of the items listed in the tables I need to then cross check that the index has actually been deleted adn if so i can just clear the entries from the SQL Tables?

Thanks

[JesusWept3]

Just as a matter of interest, what count does this query return?

USE yourVaultStore
SELECT COUNT(IndexCommitted) AS "Items Awaiting Deletion"
FROM JournalDelete
WHERE ArchiveID NOT IN (SELECT FolderName FROM EnterpriseVaultDirectory.dbo.IndexVolume)

[Mark_Solutions]

That comes back as:

EVMailboxVS Items Awaiting Deletion = 38362

[Mark_Solutions]

I guess this means that 38362 of the indexes have been deleted but i may have 11 that have not?

I am getting them to pipe out the 11 that do have index entroes so we can look into those.

Just wondering if it is possible to change the DeletionStatus or DeletionReason to another value to allow the system to re-process the list

Or do we just delete the 38362 rows from the table then look deeper into the other 11?

Thanks

[Mark_Solutions]

OK - quick update ...

Did some SQL queries and found that no many users were involved in these entries but that 2 of them did still exist in EV

As time has moved on the system has been upgraded to EV10 so we migrated those 2 to 64 bit indexes and this has cleared their entries out of the SQL database.

So we now have 38362 entries in the JournalDelete table for users that do not exist

Can i just delete those rows now based on this?

[JesusWept3 · Accepted solution]

That would be my suggestion, just a modification of the first query i gave you.
As always, backup your databases right before you do this and monitor closely etc

 

USE yourVaultStore
DELETE FROM JournalDelete WHERE ArchiveID NOT IN (SELECT FolderName FROM EnterpriseVaultDirectory.dbo.IndexVolume)

[Mark_Solutions]

Thanks - will do and update next week