Event ID 6838: Failed to recall a Saveset from its Collection

[JuanAntonio]

Hi all,

I'm getting this error (6838) from time to time:

Failed to recall a Saveset from its Collection.

Reason: Failed to extract the file from the CAB file. The file name is not in the CAB file index. For more information, see Help and Support Center at http://entced.symantec.com/entt?product=ev&language=english&version=10.0.2.0&build=10.0.2.1112&error=V-437-7135 (0xc0041bdf)

Relative Saveset Filename: 2013\12-10\9\095\9095F4BE1CF746D23BC4E535364BC181~2C~3B008BCD~00~1.DVSSP

Relative Collection Filename: 2013\12-10\9\Collection71309.cab

PartitionEntryID: 10662FA52B219AE46A0BED018C5C7B5871q10000evserver1

PartitionGUID: 0662FA52B219AE46A0BED018C5C7B587

Partition Root Path: F:\ExchangePtn1

Secondary Location:

Migrated File Id:

Reference: NSDR/LMF

Is there any way to know wich mailxbox is involve? What can I do with it? Am I loosing data? No user has called saying is having problems opening archived emails.

I'm also getting theses errors when exporting some mailbox  archives to a PST and when rebuilding indexes.

Thanks in advanced and best regards.

//Juan Antonio

[TonySterling]

First thing first, can you double click on the CAB file and open it?

Do you see many of these events?

[Manoj_Chanchawa]

Hi Juan, 

These errors can come due to multiple things. It may mean the DB entries for this CAB files are wrong (and needs update) or may be the CAB file doesnt exist at all (2013\12-10\9\Collection71309.cab). Later you can check the content of the CAB file if 9095F4BE1CF746D23BC4E535364BC181~2C~3B008BCD~00~1.DVSSP is there or not. 

Did you migrate this cab file to some secondary location? if not, then can you traverse to the location where CAB file is and see if it is still there and can be extracted manually? 

Second, its worth running EVSVR tool to verify whats the issue and later if you find anything, then use the toll to fix it. If you are not very comfortable running EVSVR, you should take technical support help. 

During rebuild of indexes, since it is failing to find the saveset file in CAB file, it will post these errros. 

[plaudone]

You can run EVSVR > Verify > ObjectInContainer to get a list of items that are not found. From the EVSVR output you can look at the ArchiveEntryId value and use that to search for the archive.  From the VAC you can hold down Ctrl + Shift then right-click on Archives and choose Find Archive or Folder.  

[JuanAntonio]

I can open de CAB file and it's true that the Relative Saveset Filenames of the errors are not there. But we have no calls from users reporting problems. We're not using a secondary location for migrating.  I'll try with EVSVR and check.

Thanks a lot.

[plaudone]

JuanAntonio,

You could also run Verify > DatabaseReferences against the partition.  This will show items that are not listed in the DB or have incorrect information in the DB.  It may be possible that the item is in another CAB file, but the DB has an incorrect identity. 

[JuanAntonio]

I have no "ObjectInContainer" as an option for the Verify Operation on EVSVR.

By the way, we're running EV 9.0.4 (just in case)

[plaudone]

Apologize...it should be Verify > ArchiveObjects > ObjectInContainer

[JuanAntonio]

Thanks, I'll try with that.

[JuanAntonio]

Hello again,

I started to run "Verify > ArchiveObjects > ObjectInContainer" 3 days ago and it's still running.

These are some of the things I can see in the report that is being generated (for the moment):

---X---

2014-06-10 12:29:35          Saveset records: 4762148
2014-06-10 12:29:35 
2014-06-11 20:51:36 
2014-06-11 20:51:36          SISPart records: 2134492
2014-06-11 20:51:36 
2014-06-11 21:51:02            SISPartId: 7167F3FF729EBF257C6B36851AA2CAE1~02~7FF00B32~00~1, Archived Date: 2014-05-28 12:05:00Z

2014-06-11 21:51:02             SIS Part File not found [0x80070002], File Path: \\SVR-ARC-01\EVPartition01cbf5ef53b2d990$\2014\05-28\7\167\7167F3FF729EBF257C6B36851AA2CAE1~02~7FF00...
2014-06-11 21:51:02              FP DB Store size (B): 16929, Original item size (B): 40448

2014-06-12 08:36:28            SISPartId: 70810B2939C2C4588911CE28C9ACE1A1~25~020F21B1~00~1, Archived Date: 2012-09-12 11:02:00Z
2014-06-12 08:36:28             SIS Part File not found [0x80070002], File Path: \\SVR-ARC-01\EVPartition01cbf5ef53b2d990$\2012\09-12\7\081\70810B2939C2C4588911CE28C9ACE1A1~25~020F2...
2014-06-12 08:36:28              FP DB Store size (B): 218910, Original item size (B): 337920
2014-06-12 08:36:28             Converted Content File not found [0x80070002], File Path: \\SVR-ARC-01\EVPartition01cbf5ef53b2d990$\2012\09-12\7\081\70810B2939C2C4588911CE28C9ACE1A1~25~020F2...
2014-06-12 08:36:28              FP DB Store size (B): 910

2014-06-12 14:50:16            SISPartId: 70810B2939C2C4588911CE28C9ACE1A1~3A~A06A4F73~00~1, Archived Date: 2012-09-12 11:02:00Z
2014-06-12 14:50:16             SIS Part File not found [0x80070002], File Path: \\SVR-ARC-01\EVPartition01cbf5ef53b2d990$\2012\09-12\7\081\70810B2939C2C4588911CE28C9ACE1A1~3A~A06A4...
2014-06-12 14:50:16              FP DB Store size (B): 52531, Original item size (B): 208384
2014-06-12 14:50:16             Converted Content File not found [0x80070002], File Path: \\SVR-ARC-01\EVPartition01cbf5ef53b2d990$\2012\09-12\7\081\70810B2939C2C4588911CE28C9ACE1A1~3A~A06A4...
2014-06-12 14:50:16              FP DB Store size (B): 12850

---X---

What does it mean? Have I "lost" savesets? Is there something wrong on the DB? Can I use the EVSVR tool to fix it?

I have only 3 entries in the report related to savesets files (by now), althought I got many more when reindexing last week.

Thanks

[JuanAntonio]

Hi,

At last, EVSR finished yesterday. These are the results:

---X---

2014-06-10 12:29:25  Log file 'e:\Program Files (x86)\Enterprise Vault\Reports\EVSVR\EVSVR_20140610122925.Log' created/opened
2014-06-10 12:29:25 
2014-06-10 12:29:25  EVSVR Version (9.0.4.1097)
2014-06-10 12:29:25 
2014-06-10 12:29:25 
2014-06-10 12:29:25  Operation: Verify
2014-06-10 12:29:25  Option:    Verify Archive Objects - Verify that a file is in a CAB file, or a Saveset in a CLIP
2014-06-10 12:29:25  Data Silo:
2014-06-10 12:29:25    Site:              PharmaMarSite
2014-06-10 12:29:25                        10CD9D8841FA54D46B1B51D1F8758A5011d10000evserver1
2014-06-10 12:29:25    Vault Store Group: PharmaMarVaultStorageGroup
2014-06-10 12:29:25                        101060391A8B40046BE549404EFBB01C51013300evserver1
2014-06-10 12:29:25    Vault Store:       Exchange
2014-06-10 12:29:25                        14E4F7D9E72099E47B94BF0E9073357141210000evserver1
2014-06-10 12:29:25    Partition:         ExchangePtn1
2014-06-10 12:29:25                        10662FA52B219AE46A0BED018C5C7B5871q10000evserver1
2014-06-10 12:29:25  Date range: Start: <None>, End: <None>
2014-06-10 12:29:25  Trust CIFS Partition Created Dates: False
2014-06-10 12:29:25  Archive: <All>
2014-06-10 12:29:25  Threads: 1, Priority: Normal
2014-06-10 12:29:25  Log file: e:\Program Files (x86)\Enterprise Vault\Reports\EVSVR\
2014-06-10 12:29:25 
2014-06-10 12:29:25  Performing initial database and partition checks
2014-06-10 12:29:26 
2014-06-10 12:29:26 
2014-06-10 12:29:26  All checks were completed successfully
2014-06-10 12:29:26 
2014-06-10 12:29:26 
2014-06-10 12:29:26  Operation started
2014-06-10 12:29:26 
2014-06-10 12:29:26  Site: PharmaMarSite
2014-06-10 12:29:26 
2014-06-10 12:29:26    Vault Store Group: PharmaMarVaultStorageGroup
2014-06-10 12:29:26                       EntryId: 101060391A8B40046BE549404EFBB01C51013300evserver1, Identity: 1
2014-06-10 12:29:26 
2014-06-10 12:29:26      Vault Store: Exchange
2014-06-10 12:29:26                   EntryId: 14E4F7D9E72099E47B94BF0E9073357141210000evserver1, Identity: 1
2014-06-10 12:29:26 
2014-06-10 12:29:26        Partition: ExchangePtn1, DeviceType: CIFS, Collection Enabled
2014-06-10 12:29:26                   EntryId: 10662FA52B219AE46A0BED018C5C7B5871q10000evserver1, Identity: 0
2014-06-10 12:29:26                   Local path: F:\ExchangePtn1, Remote path: \\SVR-ARC-01\EVPartition01cbf5ef53b2d990$
2014-06-10 12:29:26 
2014-06-10 12:29:35          Saveset records: 4762148
2014-06-10 12:29:35 
2014-06-11 20:51:36 
2014-06-11 20:51:36          SISPart records: 2134492
2014-06-11 20:51:36 
2014-06-11 21:51:02            SISPartId: 7167F3FF729EBF257C6B36851AA2CAE1~02~7FF00B32~00~1, Archived Date: 2014-05-28 12:05:00Z
2014-06-11 21:51:02             SIS Part File not found [0x80070002], File Path: \\SVR-ARC-01\EVPartition01cbf5ef53b2d990$\2014\05-28\7\167\7167F3FF729EBF257C6B36851AA2CAE1~02~7FF00...
2014-06-11 21:51:02              FP DB Store size (B): 16929, Original item size (B): 40448
2014-06-11 21:51:02 
2014-06-12 08:36:28            SISPartId: 70810B2939C2C4588911CE28C9ACE1A1~25~020F21B1~00~1, Archived Date: 2012-09-12 11:02:00Z
2014-06-12 08:36:28             SIS Part File not found [0x80070002], File Path: \\SVR-ARC-01\EVPartition01cbf5ef53b2d990$\2012\09-12\7\081\70810B2939C2C4588911CE28C9ACE1A1~25~020F2...
2014-06-12 08:36:28              FP DB Store size (B): 218910, Original item size (B): 337920
2014-06-12 08:36:28             Converted Content File not found [0x80070002], File Path: \\SVR-ARC-01\EVPartition01cbf5ef53b2d990$\2012\09-12\7\081\70810B2939C2C4588911CE28C9ACE1A1~25~020F2...
2014-06-12 08:36:28              FP DB Store size (B): 910
2014-06-12 08:36:28 
2014-06-12 14:50:16            SISPartId: 70810B2939C2C4588911CE28C9ACE1A1~3A~A06A4F73~00~1, Archived Date: 2012-09-12 11:02:00Z
2014-06-12 14:50:16             SIS Part File not found [0x80070002], File Path: \\SVR-ARC-01\EVPartition01cbf5ef53b2d990$\2012\09-12\7\081\70810B2939C2C4588911CE28C9ACE1A1~3A~A06A4...
2014-06-12 14:50:16              FP DB Store size (B): 52531, Original item size (B): 208384
2014-06-12 14:50:16             Converted Content File not found [0x80070002], File Path: \\SVR-ARC-01\EVPartition01cbf5ef53b2d990$\2012\09-12\7\081\70810B2939C2C4588911CE28C9ACE1A1~3A~A06A4...
2014-06-12 14:50:16              FP DB Store size (B): 12850
2014-06-12 14:50:16 
2014-06-13 16:02:26            SISPartId: 70810B2939C2C4588911CE28C9ACE1A1~8F~82860AC4~00~1, Archived Date: 2012-09-12 11:02:00Z
2014-06-13 16:02:26             SIS Part File not found [0x80070002], File Path: \\SVR-ARC-01\EVPartition01cbf5ef53b2d990$\2012\09-12\7\081\70810B2939C2C4588911CE28C9ACE1A1~8F~82860...
2014-06-13 16:02:26              FP DB Store size (B): 532101, Original item size (B): 642560
2014-06-13 16:02:26             Converted Content File not found [0x80070002], File Path: \\SVR-ARC-01\EVPartition01cbf5ef53b2d990$\2012\09-12\7\081\70810B2939C2C4588911CE28C9ACE1A1~8F~82860...
2014-06-13 16:02:26              FP DB Store size (B): 2730
2014-06-13 16:02:26 
2014-06-14 17:41:18            SISPartId: 70810B2939C2C4588911CE28C9ACE1A1~E0~025D261C~00~1, Archived Date: 2012-09-12 11:02:00Z
2014-06-14 17:41:18             SIS Part File not found [0x80070002], File Path: \\SVR-ARC-01\EVPartition01cbf5ef53b2d990$\2012\09-12\7\081\70810B2939C2C4588911CE28C9ACE1A1~E0~025D2...
2014-06-14 17:41:18              FP DB Store size (B): 14476, Original item size (B): 52224
2014-06-14 17:41:18 
2014-06-15 05:02:35 
2014-06-15 05:02:35          SISPartCC files processed: 503239
2014-06-15 05:02:35 
2014-06-15 05:02:35 
2014-06-15 05:02:35          Verify failed count: 8
2014-06-15 05:02:35          Verify succeeded count: 7399871
2014-06-15 05:02:35 
2014-06-15 05:02:35        Items Processed in Partition 'ExchangePtn1': 7399879
2014-06-15 05:02:35 
2014-06-15 05:02:35      Items Processed in Vault Store 'Exchange': 7399879
2014-06-15 05:02:35 
2014-06-15 05:02:35    Items Processed in Vault Store Group 'PharmaMarVaultStorageGroup': 7399879
2014-06-15 05:02:35 
2014-06-15 05:02:35  Items Processed in Site 'PharmaMarSite': 7399879
2014-06-15 05:02:35 
2014-06-15 05:02:35  Vault Store Groups: 1
2014-06-15 05:02:35  Vault Stores:       1
2014-06-15 05:02:35  Partitions:         1
2014-06-15 05:02:35 
2014-06-15 05:02:35  Processing rate: 65746 Items/hour
2014-06-15 05:02:35  Elapsed time:    4 days, 16 hours, 33 minutes, 9 seconds
2014-06-15 05:02:35 
2014-06-15 05:02:35  Operation completed
2014-06-15 05:02:35 
2014-06-15 05:02:35  Log file closed
2014-06-15 05:02:35 

---X--- 

A few errors if we compare with the huge amount of errors I get when I do an export or a reindex of some mailboxes.

Is there anything I can do? Any kind of "repair"?

Thanks in advanced.

//JA

[JuanAntonio]

I'm getting this kind of error averyday during the archiving process too. Among 10 or 15 errors.

[plaudone · Accepted solution]

This could mean that the data is missing or it is not in the location we currently have in the DB.   Most of the files look to be in the same path.  If a DVSSP file is missing all of the items pointing to the part will not be able to be recombined properly.  The item should get blacklisted so that a new version of the part can be archived again once the same fingerprint is found.  

I would say you should open a case so a closer look at these items can be performed.  

[JuanAntonio]

Thanks plaudone!

Regards.