Event 7109 StorageFileWatch After Relocating Vault Store to New Drive

[Chad_I]

Hello,

I am running EV 8 on a virtual Windows 2003 Server.   I have 2 drives that hold all the emails, F Drive and H Drive.

F Drive is a 2TB drive and was at 99% capacity (it shut all services down as well)

H Drive is a 2TB drive and holds around 200GB

I am using HP Data Protector for back-ups and have the data being backed up to disk (I have not been able to successfully complete this)

My back up job keeps timing out and failing on the F Drive.  So my thought process was that if it maybe had more available resources that I may be able to successfully back up the drive.

I watched "How to Move a Vault Store Partition" video

after moving the data and restarting services, I had no issues.  Everything looked fine

I moved the old data to a separate server (until I confirmed success) and since then  I have been noticing the StorageFileWatch event being logged into the event viewer.  It is looking for the data from the old partiton I moved even though I repointed the vault store in the SQL Database.

It appears that there is something else pointing to the data?  Any thoughts?

Also anyonehave any success using HP Data Protector?  My back up job last night made it to F Drive and just never finished.  Basically locks up and says it is still running. 

Any help would be appreciated.  Thanks.

[TonySterling]

Can you post the full text of the Event?  It can vary a bit.

[Chad_I]

Event Type: Warning
Event Source: Enterprise Vault
Event Category: Storage File Watch
Event ID: 7109
Date:  9/29/2014
Time:  8:03:31 AM
User:  N/A
Computer: VAULTE
Description:
An invalid saveset was encountered while doing watch file scan. This archive operation will be attempted to be cancelled. Following further information is available.
 Partition Name = SJXX Ptn2
 VaultStoreEntryId = 1C3C92E309083164BBCA58B4DC8D2A9111210000alvaulte
 TransactionID = D0F7CB98BE73E47F2604235AFE9FBCD1
 Invalid Reason = File 'F:\Enterprise Vault\Vault Stores\VaultE\Mail\SJXX\VSP02\2014\04-17\D\0F7\D0F7CB98BE73E47F2604235AFE9FBCD1.DVS' not found for SavesetIdentity = [8930180]

For more information, see Help and Support Center at http://evevent.symantec.com/rosetta/showevent.asp

[TonySterling · Accepted solution]

Ok, no I got what you are saying.  This issue is that the path is stored in the WatchFile table and what you are seeing is similiar to this issue:

Event ID 6510: "Archive operation canceled because Saveset file is missing" is reported after an Enterprise Vault (EV) Vault Store Partition location has been changed and Saveset files have been moved to the new location.

Article:TECH68204

|

Created: 2009-01-25

|

Updated: 2014-04-01

|

Article URL http://www.symantec.com/docs/TECH68204

How soon until you move everything back or will the data stay where you moved it?

[Chad_I]

Thanks Tony. 

I was wanting to keep it where it is while I troubleshoot my back up of the data which is a whole other issue.

[TonySterling]

Ok so if you go back to the Technote:

How to Move a Vault Store Partition or Vault Store

Article:TECH35742

|

Created: 2004-01-25

|

Updated: 2014-07-16

|

Article URL http://www.symantec.com/docs/TECH35742

Step 1 talks about this:

Step 1

Confirm all archived items have been backed up (SQL Server)
 

1. Open SQL Server Enterprise Manager (SQL 2000) or SQL Server Management Studio (SQL 2005, 2008 2012)
    
2. Run the following query: 
   
   
           USE [Vault Store Database Name]
           SELECT COUNT(*)
           FROM WatchFile
   
    
3. If the count is 0, proceed to step 2. If the count is greater than 0, there are items left waiting either backup or indexing.

Note: For Enterprise Vault versions 9.0 (Base) and below refer to TECH68204 to update the item location, for versions 9.0.1 and above the Itemname field is a relative path and does not need to be updated.

So you will want to refer to the Technote referenced, http://www.symantec.com/docs/TECH68204, to update the Path for those items. 

What is the count in the WatchFile table?  If you have a SQL Admin you should engage them.  Also, make sure the EV Services are in backup mode or stopped and be sure to back up the database before attempting to update. 

[Chad_I]

I had my DBA run the query

EVVSJXX_5

        SELECT COUNT(*)

        FROM WatchFile

Count results 8787688

[TonySterling]

So just a few, eh?

Based on that it would seem the backups weren't working correctly for quite a while then?

[Chad_I]

Pretty much not at all.  We had quite a bit of legacy data stored that had been manually migrated in for fast searching and archiving.  I have since turned on archiving of the journals and it continues to grow.

My back up job goes through most of the media agents.

Once it reaches Drive F it either fails due to "inactivity timeout" or it just stalls and appears to be running on Drive F but isnt. 

I have been able to complete a full back up on 3/6 vault store groups (small size)

The other 3 fail.  For the most part they are located on Drive F.