Event 7110 - An invalid SIS part was encountered while doing watch file scan

[STHN]

Hi folks,

there is a known issue that should have been fixed in EV 10.0.3

We have a customer here that reports that after upgrading directly form 10.0.1 to 10.0.4, this warning event still shows up in the event logs, but less frequently.

Resources:

A 7110 warning is returned in Enterprise Vault (EV) indicating that An invalid SIS part was encountered while doing watch file scan.

Article:TECH199104

|

Created: 2012-10-29

|

Updated: 2013-06-14

|

Article URL http://www.symantec.com/docs/TECH199104

ETrack 2914202

From the release notes of EV 10.0.3:

Size of some SIS parts in collections was reported as 0 (zero) bytes [Ref 17968, E2914202]

Storage File watch sometimes reported event ID 7110 warnings when verifying some SIS parts in collections. The size of the SIS part was incorrectly reported as 0 (zero) bytes.

This has been fixed.

I have taken a deeper look into it by backtracing it. It seems to be the exact same issue.

Now before going back to Symantec Support I would like to ask whether anybody else is facing that.

Thanks in advance!

[JesusWept3]

Well the bug was that it was falsely reporting the issue
however have you made sure that you don't actually have an issue before saying its a recurrence of a bug?
i mean, have you checked that you don't have zero byte files that its discovered?

[STHN]

The warning shows somethin like this:

 ParentTransactionID = E11379619BBAA5F3028BAFCE21FA1C21
 Invalid Reason = Verification failed for sis part when post processing Saveset with TID = [E10B15388EBEDEF5F9004E557D90C0F1].

I performed a dumpsaveset on the ParentTransactionID. There have been no zero byte files been in the recombined or parts folder. It that a valid method to verify that? The customer uses collections, so I didn't look into the partiton itself.

Another interesting question would be what this TID is. I tried to find it out in my lab but every ID I ever found was a SaveSet ID which is that ParentTransactionID here.

Thanks!

[GabeV · Accepted solution]

Hello Sebaha,

I'd suggest you to open a case with support. We have seen this issue re-ocurring after upgrading to EV 10.0.3 and you might need to configure some registry keys values to optimize the savesets recall from collections. Make sure you mention the reference E2914202 when you open the case with support.

I hope this helps.

[STHN]

Hi GabeV,

good to hear that this is reported by other customers, too. Thanks! I'll go for support then.

I bet you are talking about those VerifyCollectedFiles and VerifyFilesInNewCollection keys, aren't you ;)

Let's see :)

[STHN · Accepted solution]

For our specific issue where CAB files are used and the event showed up after clear backup mode and before the start of the collector, this solved the issue once and for all:

Create following registry DWORD's on affected EV Servers.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\KVS\Enterprise Vault\Storage] "SisPartSizeCheckMaxRetryCount"
"SisPartSizeCheckRetryInterval"

Where values are: (Decimal)

SisPartSizeCheckMaxRetryCount = 10
SisPartSizeCheckRetryInterval = 2000

Restart the EV Storage service for changes to take effect. Monitor the events for couple of days and update the case with results.

[Prone2Typos]

THanks for updating the post with the solution. Can you please mark the solution then so this does not show as still requiring assistance..

Many thanks

[STHN]

"Split Solution Pending" :)

[GabeV]

Sebaha,

Do you have any updates on this thread? Do you need more assistance regarding this topic? If not, please mark the post that best solves your problem as the answer to this thread.

[STHN]

"Split Solution Pending" :)

It seems to take some time until the split solution is checked and approved.

[Prone2Typos]

Thanks for marking it... it is helpful