Event Log clogged with Error 8390 Retrieval task Errors

[HolgerM]

Hi Folks,

our EV-Servers seem to have some Problems, the following error occurs on 1 of our servers daily at different times, and repeatedly for hours (every few seconds 1 entry in the log)

----------------------------------------------------------------------------------------------------------------------------------------------------------------
Event Type: Error
Event Source: Enterprise Vault
Event Category: Retrieval Task
Event ID: 8390
Date: 23.07.2009
Time: 15:08:38
User: N/A
Computer: APP-EVAULT02
Description:
The EnterpriseVault.DirectoryConnection object reported an error.

The RPC server is unavailable.


For more information, see Help and Support Center at http://evevent.veritas.com/rosetta/showevent.asp
----------------------------------------------------------------------------------------------------------------------------------------------------------------

Any ideas what could cause this behaviour?

Thanks in advance

Holger

[TonySterling]

What version of EV?

Is Sharepoint Services installed on the EV server?
http://seer.entsupport.symantec.com/docs/295228.htm

[HolgerM]

Hey there, wow, that was a quick answer, thanks a lot.


The EV Version is 7.0 SP3.

2 Servers, the event only occurs on one server.


No Sharepoint Archiving or any Sharepoint in the Environment.

[Paul_Grimshaw]

SOunds like this maybe users trying to restore from browser search, for example, and it is failing. Can you setup a dtrace of the following processes and attach log when the errors have been caught:-

directoryservice
retrievaltask
storagerestore
w3wp
shoppingservice

Also can you check your MSMQ's. Are there are items on the R1, R2 or Storage restore queues?

[HolgerM]

Hello There,

thanks for the Ideas, The problem is, that I have no clue on when to start the dtrace, the error occurs in no pattern, we have almost 10K archives and about 7-8K users working on the system. If I let the DTRACE run for a longer time my Harddisk will be full.

Anyways I'll try to catch a dtrace with the errors.

Regarding the Message Queues: there are messages in the R1 and R2 queue but not that often as the error occurs. So I guess they are not related, and the Retrieval Queues are emptying theirselves.

I'll report back with a dtrace

Regards

Holger

[Liam_Finn1]

 You can set a trigger on the dtrace to look for the error and only start logging once the error is identified
here is the technote on how to set triggers http://seer.entsupport.symantec.com/docs/284344.htm

This will prevent your logs flooding as it will only log once the event is found

[HolgerM]

Thanks I'll Try that!

[HolgerM]

Hello Folks,

Luckily the error occured this morning, the customer must have rebooted the server over the weekend so my Triggered Dtrace was not active any more but I have a DTRACE:

the most interesting entries are as followed:

7771 11:49:18.356 [5616] (RetrievalTask) <6928> EV:M HRXEX fn trace :|Source : .\DirectoryServiceWrapper.cpp (CBaseDirectoryServiceWrapper::GetInterface) [lines {735,775,803}] built Oct 30 21:09:57 2007|Description: Call error 0x800706ba |ref[1]: EVSITE
7774 11:49:18.356 [5616] (RetrievalTask) <6928> EV:M CClientIdentity::CheckAccess(vSIDS) (Exit) |The RPC server is unavailable. [0x800706ba] |
7775 11:49:18.356 [5616] (RetrievalTask) <6928> EV:M CCARestHelper::RMI() - Failed to retrieve the item [0x800706BA].|Mbx: /o=TOPLEVELDOMAIN/ou=DE-RBG/cn=Recipients/cn=RB_1547|Folder: ?Inbox|Title: RE: LRTB C9TP - JAP Opto
7774 11:49:18.356 [5616] (RetrievalTask) <6928> EV:M CClientIdentity::CheckAccess(vSIDS) (Exit) |The RPC server is unavailable. [0x800706ba] |


the whole log can be found here -->  http://holger.mundt-bopfingen.de/SymCase/event8390.txt

I changed the original customername in the log to "CUSTOMERNAME" and also changed the top level domainname to "TOPLEVELDOMAIN"

Thanks in advance.
---------
EDIT: for some reason my IIS didn't like the .log so i had to change it to .txt, the link should work now

[Paul_Grimshaw]

Ususally DNS. Check your DNS Settings. Do you have a CNAME?

[HolgerM]

Hey Folks,

DNS looks fine, CNAME for the EV Enviroment checked.

In the User's Mailbox I found Items that are in the restoring process, and every now and then 1 message pops up in the R2 Queue.
When I look in the Archivebrowser or Search vaults I can find the Items in Question and display the HTML Rendition.

[HolgerM · Accepted solution]

Hi Folks,

like I mentioned in my last post, there were some Items in "Pending Restore" in the user's Mailbox. I was able to successfully restore them via the Search Vaults option but I had to delete the pending restore Items from the mailbox. until now the error didn't come up. Thanks for the input on the "restoring from Browser" issue by Paul and the Triggering of a dtrace.
helped me to figure this out.

----- UPDATE ------

More Information from Customer Side: They are currently Moving from another EV Installation (that we do not service) to the one we are currently servicing.
Some Users are already located on the "New" EV Site and some are still on the "old". The Admin at the "old" EV Site gave the order to restore all Items from the Vault to Exchange, then move the Mailboxes and the activate the User on the "new" EV Site. When a user that is already in the new EVSite tries to help restoring the Archived Elements on the old EVSite the error 8390 is thrown.