Exchange Archiving task stops after a couple of minutes

[domus]

Hi,

I encounter a problem with EV 10.0.0.4. Exchange Archiving task stops after 2 minutes 30 of processing archiving sometime 4 mails, sometime 0 email.

I try to perform a Run now check on one mailbox and archive on all items option checked and its the same.

I do not see any error on event manager, no mail in queues (MSMQ).

Do you have any idea of what can occur please ?

Thanks in advance

Philippe

[TonySterling]

What does the generated report say for the archive run?  It could be there isn't anything to process.

You could also do a dtrace of the archive task while you do the run now.

[Aziz_K]

If there are no errors in the event viewer, have you checked your mail box archive policy? Are you targeting enough data to archive?

[domus]

After another analysis, it seems the Archiving Task considers there is only one mail to archive. So that's why the task is so short. But what's surprising me is the fact mails are not archived despite of the archiving criteria are met.

Our Archiving rule archive mails older than 12 months and I have mails older that are not archived and not considered to be archived. I do not understand why.

For example, in the attached file you can see there is mails from 2011 not archived.

[TonySterling · Accepted solution]

again, I would encourage you to check the report.

Also, add the modified date column and see when those items were modified.  It could be they were restored and unless you use IgnoreEVDates registry key they will not be re-archived until the modified date reaches the criteria of the archive policy.

If the modified date is under a year you can set the IgnoreEVDates key:

Create  the REG_DWORD IgnoreEVDates in HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\KVS\Enterprise Vault\Agent. 
Set the value of IgnoreEVDates to 3 (decimal), then restart the archiving task.

How to Force archiving based on the Received Date of email after restoring messages from the archive

Article:TECH76532

|

Created: 2009-01-06

|

Updated: 2014-03-11

|

Article URL http://www.symantec.com/docs/TECH76532

If that isn't it, you need to take a look at the message class of the items and make sure they are set to be archived.

[domus]

Thank you Tony. You're right.

Displaying the modified date shows me the items have been modified (I think restored during tests several months ago). I use the IgnoreEVDates registry key and the problem is solved.

I have another question related to that, is there a way to know if an email has been restored by EVault (a field that can be viewed in the header of the mail or a field that can be accessed with MFCMAPI) ?

Thanks a lot

[TonySterling]

Glad that is sorted for you.  Yes, I believe you can use MFCMapi to view the message properties of an item and check for properties like Restored Date.

Not sure exactly of your use case, but if you have auditing enabled I believe you can track it there when items are restored.