Event ID: 6410, 3231, and 2820

[Kendall_Walley]

Our KVS Vault servers working with Exchange are throwing some error messages in the application log that we haven't been seeing before.

All are related to the Archiving Service.

Event ID: 6410 (error)
"MSMQ negative acknowlegment message(s) have been handled.
Queue:.\private$\EnterpriseVaultArchiveAgent Admin Queue
Reason: The sender does not have send access rights on the queue."


Event ID: 2820 (warning)
"A MSMQ negative acknowlegment was found to have no corresponding XACT Dead Letter Queue message, the message has been discarded."

Event ID: 3231 (error)
"Could not get a MAPI session from the session pool.
Error: ClassFactory cannot supply requested class
Service: EnterpriseVaultArchiving Service for <>
Additional Information: Whilst processing user
/O=orgname/OU=ouname/cn=Recipients/cn=username"

Have you all seen these errors/warnings before? Is there a fix for them? Are they related to one another? We are currenly running version 5 sp3 and are planning to upgrade to sp 6 very soon.
These errors flood the log within minutes which is why we need to know if they can be eliminated with a fix.
Thanks,
Kendall Walley

[Micah_Wyenn_2]

Kendall,
I've never seen those dead message queue warnings on EV6.0sp1(2) installs I've done. I think you may be hitting a bug that got fixed down the road. If you can, you might want to stress less about it until you do the upgrade.
Although, with that said, you'll want to make sure the dcom settings (permissions wise) give the VSA permissions to make those dcom sessions go.

micah

[W_Wintermute]

The 2820 and 6410 are usually the result of someone having purged items from MSMQ. (e.g. - one of the archiving or journaling queues, but not the corresponding archiving admin queue.)

I wouldn't worry about those too much.

Here's a description of the 2820:

Event ID: 2820
When an item is purged from a queue, two subsequent messages are put onto MSMQ. One onto the System Queues\Transactional dead-letter messages and another on
Enterprise Vault agent admin queue.
The messages on this latter queue contain enough information so that we can perhaps take some kind of action e.g. change the archive pending item back to a normal message.
So this error means that we found a message to process on our queue but the corresponding one was not found on the System Queue.



If you are getting the 3231 on a regular basis, you may want to go through the following KB and troubleshoot MAPI. (i.e. - make sure you have the right version of ESM loaded on your EV Server and mapisvc.inf looks ok.)

http://support.veritas.com/docs/273298

[David_Messeng1]

I'm still unconvinced about that article with V5 SP3. I'd strongly advise against FixMapi.exe.


http://www.udstech.com/whitepapers/wp.tryfirst.pdf