cancel
Showing results for 
Search instead for 
Did you mean: 

How do you find what objects have been retrieved from the Archive in the last 48 hours?

SheltonS
Level 3

I'm new to EV (inherited it last month) and we just had an issue where an FSA protected volume suddenly lost 250GB of space over the weekend.  We show that no one added that much data to the volume so the only explination we can come up with is someone or something triggered a restore from archive for the 250 GB.  Being new to EV, however, I can't figure out how to prove this or find what person or process casued it assuming it was EV.  I've looked at the reports and they seem weak on this type of need and I found out we do not have auditing turned on.

Can anyone help?

 

Thanks,

Shelton

1 ACCEPTED SOLUTION

Accepted Solutions

TonySterling
Moderator
Moderator
Partner    VIP    Accredited Certified

So there is one caveat, do you use Last access time for your rules?

The following TN has this:

A file that is recalled to the file server replaces the placeholder shortcut.

  • If the recalled file remains unmodified, then Enterprise Vault converts the file back to a placeholder on the next archiving service run. The only exception is if the archiving policy's shortcut creation rules are based on the last access time. In that case, Enterprise Vault reverts the file only when the shortcut creation rules are met.

  • If the recalled file becomes modified, then Enterprise Vault converts the file back to a placeholder according to the archiving policy's shortcut creation rules.

About placeholder shortcuts

Article:HOWTO57685  |  Created: 2011-08-01  |  Updated: 2012-09-23  |  Article URL http://www.symantec.com/docs/HOWTO57685

 

View solution in original post

4 REPLIES 4

TonySterling
Moderator
Moderator
Partner    VIP    Accredited Certified

without auditing it will be a bit difficult to know for sure.

One thing to note, even if some recalled a lot of items the next time the FSA archive task ran it would normally convert them back to placeholders, unless you set a registry key to prevent it.

SheltonS
Level 3

I was afraid that not having auditing was going to limit the information.  I have since activated it.

 

As for the other comment, won't the files need to re-age again before they will be converted back to placeholders?

TonySterling
Moderator
Moderator
Partner    VIP    Accredited Certified

No, FSA is a bit different than Mailbox shortcuts.  When you view a placeholder it only temporarily restores the item to the file server.  Some times the item reverts to placeholder before the archive task runs but if it hasn't yet reverted the file will be turned back into a placeholder with the task runs.

 

TonySterling
Moderator
Moderator
Partner    VIP    Accredited Certified

So there is one caveat, do you use Last access time for your rules?

The following TN has this:

A file that is recalled to the file server replaces the placeholder shortcut.

  • If the recalled file remains unmodified, then Enterprise Vault converts the file back to a placeholder on the next archiving service run. The only exception is if the archiving policy's shortcut creation rules are based on the last access time. In that case, Enterprise Vault reverts the file only when the shortcut creation rules are met.

  • If the recalled file becomes modified, then Enterprise Vault converts the file back to a placeholder according to the archiving policy's shortcut creation rules.

About placeholder shortcuts

Article:HOWTO57685  |  Created: 2011-08-01  |  Updated: 2012-09-23  |  Article URL http://www.symantec.com/docs/HOWTO57685