Getting Events 3475 and 3177 with Retrievals

[The_Dark_Knight]

Hi,

Working on Enterprise Vault 10.0.4 in a Microsoft Clustered Environment.

There are two EV Servers in the EV Site.

On both servers getting a lot of events lately with IDs 3475 and 3177

Event ID 3475: One or more errors occurred during the creation of a profile to connect to an Exchange Server. |Targeted Exchange Server: <Name of Exchange Server>|Mailbox: SMTP:<Name of System Mailbox>|ConfigureMsgService failed with the following errors: |Out of memory error has occurred for the following connection points:|#######.internal.company.com|<Name of Exchange Server>|This indicates that the maximum number of connections has been consumed on this Enterprise Vault Server.| |(Excerpt from Dtrace)

Event ID 3177: A RetrieveMarkedItems request has failed.  Not all of the messages could be returned to a shortcut.  These messages will remain as pending retrieval in the users mailbox. |Mailbox: /o=organizationmail/ou=Exchange Administrative Group (name of the group)/cn=Recipients/cn=<username>|Folder:   |Error: Not enough storage is available to complete this operation.  (0x8007000e) |(Excerpt from Dtrace)

For Event ID 3475, I am wondering if it has to do with the Profile Expire Reg Key on the Server or not. Do I have to try manually removing the profiles created by the Archive Tasks?

For Event ID 3177, I have no idea. All I have done is taken the Dtrace of the Retrieval Task.

[AndrewB]

if EV is clustered do you in essence have 4 EV servers of which 2 are active and 2 are passive?

can you give us a breakdown of the environment? what version of Exchange, how many servers, how many mailboxes per server, and how your archiving tasks are configured?

i found a couple posts providing a possible path to resolution:

https://www.veritas.com/community/forums/event-id-3432-both-archiving-and-retrieval-out-memory-error-has-occurred-following-connection

https://www.veritas.com/community/forums/archive-task-failing

1. In Regedit,

    HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\KVS\Enterprise Vault\Agents.

2. Created a new DWORD Value RemoveEmbeddedAttachments with decimal value of 0.

3. Restart the archiving tasks.

[The_Dark_Knight]

Hello Andy,

The Environment is something like this...

There are 4 Servers out of which at any given point of time 2 will be hosting the EV Servers; EV Server 01 and EV Server 02.

Third Server is always hosting the SQL Server (with the EV Databases). While the Fourth is for Failover.

We have 10 Exchange Servers running Exchange 2010 SP1, distributed between the 2 EV Servers; 4 on EV Server 01 and 6 on EV Server 02. Each Archiving Task is configured to one Exchange Server with a System Mailbox having similar naming convention as that of the Exchange Server. That makes 10 Archiving Tasks in the EV Site.

The task settings are default with the Number of Connections set to 5 and Number of passes set to 1000. The schedules for the tasks are either as per site or as per individual tasks.

[AndrewB]

thanks for the details. i would suggest the reg key as it has worked for others with the same errors you originally posted. if it doesnt help then we'll need to dive deeper into the config.

[JimmyNeutron]

What are the advanced settings of the Storage service under Services in the VAC?  You might need to adjust those accordingly.

[The_Dark_Knight]

Hello Jimmy,

Apologies for the delay in reply.

I logged a case the next day with VERITAS Support hoping for a "quicker" solution as the weekend was approaching and I did not want to leave the environment in a dicey state.

Support did walk me through of enabling the Registry for "RemoveEmbeddedAttachments" with the value of "1". Support and I also reduced the number of concurrent connections for each task to 2.

While I am yet to confirm if that resolved the issue (after nearly 12 hrs of making that change), I am getting similar events while enabling mailboxes for archival.

I am however attaching screenshots of the Advanced Storage Setting.

[The_Dark_Knight]

To add on to the existing issue. Apart from the Events 3475 and 3177 which point to the lack of storage and/or memory after making the Registry change for the Profile Expiry and the Removing of the Embedded Attachments, I am getting a new event; Event ID 3436

Log Name:      Symantec Enterprise Vault

Source:        Enterprise Vault

Date:          3/11/2016 2:04:27 PM

Event ID:      3436

Task Category: Archive Task

Level:         Error

Keywords:      Classic

User:          N/A

Computer:      EVAPP01.internal.com

Description:

The task was unable to connect to Exchange Server.

Error: Not enough storage is available to complete this operation.  (0x8007000e)

Task: Exchange Mailbox Archiving Task for <Exchange Server>

Exchange Server: <Exchange Server>

Additional Information:

The task failed to process the item in the mailbox.

Reference: Queued process item request failed.

Item: MOM Point - <Username>

Mailbox: /o=companymail/ou=Exchange Administrative Group (Group Name)/cn=Recipients/cn=<Username>

For more information, see Help and Support Center at http://entced.symantec.com/entt?product=ev&language=english&version=10.0.4.0&build=10.0.4.1189&error...

Is there anything I am missing?