Event ID 8390 flood

[dchinon]

Hi,

Little history first: We got exported mailboxes and associated vaults from a third party. We created the new users, and imported the vaults first. Afterwards we imported the mailbox in exchange.

The event viewer is flooded with event id 8390, stating that the RPC serv is unavailable.
The Message Queue A6 has alot of items. And it looks like the archiving is not working because of this error.

 Event Type:    Error
Event Source:    Enterprise Vault
Event Category:    Archive Task
Event ID:    8390
Date:        10/11/2011
Time:        8:26:52 AM
User:        N/A
Computer:    DBBHSV58
Description:
The EnterpriseVault.DirectoryConnection object reported an error.
 
The RPC server is unavailable.

Internal references:
Error 0x800706ba
CDirectoryConnectionObject::GetArchiveFolder .\DirectoryConnectionObject.cpp [lines {3567,3574}], built Nov 24 00:04:09 2010

I have done a dtrace and found a possible error, but i'm not sure.
But I have no clue how to fix it. It seems the shortcuts are trying to connect to EV001 which is the EV server of the third party. Is there a proper fix for this?

 29944726    15:46:14.392     [11892]    (ArchiveTask)    <2848>    EV:M    CArchivingAgent::ProcessShortcutItem - Expiry Basis on Retention Category: [INHERIT FROM SITE]
29944727    15:46:14.392     [11892]    (ArchiveTask)    <10932>    EV:L    :CArchivingAgent::IsEligibleForArchive(/o=INGCarlease/ou=Breda/cn=Recipients/cn=ioo001db) |The message titled: RE: Hoe is het ? will not be archived as its inactivity period has not expired  |
29944728    15:46:14.392     [7116]    (ArchiveTask)    <14128>    EV:M    CArchivingAgent::GetParentArchiveId - COM Error The RPC server is unavailable. 0x800706BA|
29944729    15:46:14.392     [11892]    (ArchiveTask)    <4620>    EV:M    CArchivingAgent::ProcessShortcutItem - Expiry Basis on Site: [Archive Date]
29944730    15:46:14.392     [11892]    (ArchiveTask)    <7864>    EV:M    CArchivingAgent::ProcessShortcutItem - Expiry Basis on Site: [Archive Date]
29944731    15:46:14.392     [11892]    (ArchiveTask)    <2848>    EV:M    CArchivingAgent::ProcessShortcutItem - Expiry Basis on Site: [Archive Date]

29944695    15:46:14.392     [11892]    (ArchiveTask)    <4620>    EV:H    :ProcessChunkOfShortcuts() |Exiting routine |
29944696    15:46:14.392     [7116]    (ArchiveTask)    <14128>    EV:H    VaultCoCreateInstanceEx: An error occurred - RequestedServerName = [EV001], UsedServerName = [EV001], hrCCI = [0x800706BA], hrResultsQI = [0x80004005], NumTried = [6], bLocalMachine = [False]
29944697    15:46:14.392     [7116]    (ArchiveTask)    <14128>    EV:M    CBaseDirectoryServiceWrapper::CreateDirectoryService() failed.|Hr: 0x800706ba|Retries: 6|TryLocal: false|Directory Name: EV001|
29944698    15:46:14.392     [11892]    (ArchiveTask)    <7864>    EV:H    :ProcessChunkOfShortcuts() |Exiting routine |
29944699    15:46:14.392     [7116]    (ArchiveTask)    <14128>    EV:H    CBaseDirectoryServiceWrapper::GetInterface - HRXEX fn trace : Error 0x800706ba ref[1]: EV001, .\DirectoryServiceWrapper.cpp [lines {653,693,719}], built Nov 24 00:04:09 2010.
29944700    15:46:14.392     [11892]    (ArchiveTask)    <10932>    EV:H    :CArchivingAgent::IsEligibleForArchive() |Entering routine  |It looks like a the shortcuts in outlook are looking for 

Please advice!

- Darrell

[Bruce_Cranksh1]

I have seen a similar issue to this on some customer environments . Is the A6 queue got a large number of items in it that aren't going down ?

What I have seen is at customers that  have shortcuts that reference EV sites the current EV site can't access and the Update Moved Items is enabled you get this error all the time ,well you actually get it when the Mailbox Archive task runs and finds these shortcuts

If this is the issue you need to delete the problematic shortcuts or disable the Update Move Items .

Hope this helps

[-Maurice · Accepted solution]

HKEY_LOCAL_MACHINE\SOFTWARE\KVS\Enterprise Vault

Create a new Dword Entry with name 'UseLocalDirectory' and value is 1.

Instructs Enterprise Vault in how to proceed when trying to retrieve a shortcut whose archive ID property contains an external vault site alias. By default, excessive delays can occur if there are a large number of external site aliases existing on shortcuts.

If you set this registry value to 1 then, when Enterprise Vault encounters a remote or unavailable site alias on a shortcut, it connects to the Directory Service on the local machine instead of trying to connect to the nominated vault site. This eliminates the delay that results from trying to connect to a remote or unavailable site, but the shortcut still cannot be retrieved.

We had a similar issue with an legacy EV site which is no longer available. Symantec did advised the customer to set the this registry key. After this, the archivetask did not try to connect the legacy EV site.

This will may help you with that issue.

cheers Maurice

[Bruce_Cranksh1]

Good tip Maurice ,nice one :)

But  would you still get  that annoying error 8390 ?

[Simon_B_]

No these events should be gone as the EV server is not longer trying to connect to a remote server.

[dchinon]

I have added the key in the registry. It works like a charm.

No more eventid 8390 and the qeueue A6 is being processed.

Thanks for the tip!