Event Ids for Archiving Tasks in EV 8.0

[Sangwan]

Hi Team,

Could anybody suggest me those two Event Id's which can tell:

Archiving Task Started - 

Archiving Task Completed - 

Archiving Task Stopped - 

Thanks | Pravin Sanwagn | Email:pravinsangwan@gmail.com

[Mohawk_Marvin]

Archiving Task Started - 3298

Archiving Task Completed - Dont think there is one?

Archiving Task Stopped - 3295

[MichelZ]

Or do you want to know when the task starts processing?

That would be 3156

[Sangwan]

Hi Marvin & Michelz,

I am seeing 3156 right-on where my Archiving window is schedule. I wanted to confirm whether I am looking at the correct event Id or not. Thanks for confirming it.

Now I have a archiving window which start everyday at 21:00 till 02:00 hrs.

I just want to now how long my archiving task actually run during this window. So that I can administer whether my archiving window is sufficient or not for awaiting archiving items on the server.

Is there any event Id which can tell me this? I can't see one!!!

Moreover I am also getting thousands of 3250 for corrupt items during this windows, is there any way I can resolve it?

Thanks for your help -

Thanks | Pravin Sanwagn | Email:pravinsangwan@gmail.com

[JesusWept3]

The task completes when the scheduling stops really.
As for the errors that you're getting, paste a couple of sample 3250's and we'll see what pointers we can give

[Paul_Grimshaw]

Regarding finding out if your schedule is long enough there are a couple of ways for starters:-

1. Check the A5 MSMQ after your schedule has completed. If this has any items in it then that means that it did not complete archiving of all eligible items in thise particular mailboxes and so indicates that your schedule is not suffice.

2. To see when your last item was archived you can run a SQL command against the Saveset table which resides in the Vault Store Database and use the archiveddate column

[Sangwan]

No Response guys....???????????????

[Sangwan]

Thanks JesusWept2 & Paul Grimshaw,

JesusWept2 - You have mentioned that archiving task completes when scheduling stops, so is there any particular event I can look for?

And please find the details of the Event 3250: If you can advice some action to avoid this, please?

Log Name:      Symantec Enterprise Vault

Source:        Enterprise Vault 

Date:          12/26/2010 9:02:08 PM

Event ID:      3250

Task Category: Archive Task

Level:         Warning

Keywords:      Classic

User:          N/A

Computer:      --------

Description:

The following message could not be archived as it may be corrupt. 

Title: RE: Test phase : Security Alert - August 2010 

Mailbox: /O=Star/OU=starL/cn=Recipients/cn=awadhe 

For more information, see Help and Support Center at http://evevent.symantec.com/rosetta/showevent.asp

Event Xml:

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

  <System>

    <Provider Name="Enterprise Vault " />

    <EventID Qualifiers="32772">3250</EventID>

    <Level>3</Level>

    <Task>19</Task>

    <Keywords>0x80000000000000</Keywords>

    <TimeCreated SystemTime="2010-12-26T18:02:08.000Z" />

    <EventRecordID>86235</EventRecordID>

    <Channel>Symantec Enterprise Vault</Channel>

    <Computer>Sstar.Starstar.star.COM</Computer>

    <Security />

  </System>

  <EventData>

    <Data>RE: Test phase : Security Alert - August 2010</Data>

    <Data>/O=star/OU=SSL/cn=Recipients/cn=awadhe</Data>

  </EventData>

</Event>

Paul,

I do check EV usage report for awaiting items, no. of items archived and all different stuff.

But is there's any straight forward way to know how long archiving task run during this schedule window, different that running some SQL command, it would be nice.

It would be great help - Thanks.

[Paul_Grimshaw · Accepted solution]

No there is not as far as I am aware. The SQL command is the only way I can think of to tell you the time the last item was archived. Also this would not be entirely accurate either if you have given users the ability to manually archive and you have users online and possibly doing this whilst your EV archiving is in schedule.

Regarding advice about the corrupt item there is not really much that can be done. The only real thing is to get a copy of the message and see how corrupt it is. For example, can you even open it? If not then not much that can be done from an EV perspective.

Alternatively there maybe some MAPI property etc that we do not like or is missing but without looking at the message then it is impossible to tell. You have stated that you are getting thousands of these errors so what I would suggest is getting a handful of these messages and opening aupport case so analysis can be done.

Mabe there is something that can be done from an EV perspective so that we can actually archive these messages or maybe they are so corrupt that it would be useless archiving them anyway. If that is the case then EV is doing its job properly by not archiving them and informing you of the mails corruption.

[Sangwan]

Hi Paul,

Thank you very much, I appreciate you effort. Its very helpful.

Thanks for your help -

Thanks | Pravin Sanwagn | Email:pravinsangwan@gmail.com