cancel
Showing results for 
Search instead for 
Did you mean: 

IIS Log Interpreter

ed300900
Level 3

We are having an issue where our fileserver becomes unresponsive for a couple of minutes intermittently. I am trying to understand what EV is doing at the point in time

 

In the IIS logs

 

2014-04-23 14:30:11 10.44.101.109 GET /EnterpriseVault/download.asp VaultID=177EA001F45146C46BC1DD3D51E735E8C1110000EVserver01&SavesetId=201302161015019~201001231726320000~Z~7126C5A3DFBACE943149EC27AE230691&Request=NativeItem&EVHeaders=1&HashName=SHA256&Segment=0 80 Vaultuser 10.44.4.14 FSA+Placeholder+Service 200 0 0 79903

 

I know the 14 FSA+Placeholder+Service 200 means success not sure what the order numbers mean after that

 

Also I need to analyse the logs into a report into what gets pulled by vault by the limit or hour by each file server 

 

Thanks In advance for all you help !!!!

1 ACCEPTED SOLUTION

Accepted Solutions

Manoj_Chanchawa
Level 3
Employee Accredited

Fileserver becomes unresponsive - There can be many reasons. Its hard to say what could be reason with this limited information. Have to migrated the data to secondary storage?

To understand the issue, you need to understand how FSA recall works. On a high level, this is what happen - when you click on any file shortcut, or via search\Archive Explorer, the call is interpreted by EV filter driver. EV Filter driver thread pass message to EV Placeholder service thread to retrieve the data and then it waits. This will call EV server to get apporiate data. Once chuncks of data start to delivere, it is passed to appication whch requested the data. With Pass-through enable, the behavior is a little different. 

Now if you see, in your case, there can be a possibility that the filter driver still awaiting to get the content from disk, or threads may be stuck in Kernel\User mode or there may be some other issue altogether.This can only be confirmed by looking at logs and if required, dumps. 

Now, we have seen some issues of this type in past. Which EV & FSA agent version you are running? In case you are on 10.0.4, few changes has been done in some 10.0.4 CHF, so install 10.0.4 CHF3. If still problem persists, then open a support case. 

View solution in original post

3 REPLIES 3

Rob_Wilcox1
Level 6
Partner

Have you seen Log Parser?

https://www-secure.symantec.com/connect/articles/using-log-parser-enterprise-vault

And the descriptions for the other column headers are:

 

a/ Right at the top of the log file

b/ Described on the Microsoft Site:

http://www.microsoft.com/technet/prodtechnol/WindowsServer2003/Library/IIS/676400bc-8969-4aa7-851a-9319490a9bbb.mspx?mfr=true

http://technet.microsoft.com/en-us/library/cc754702(v=WS.10).aspx

 

Working for cloudficient.com

VirgilDobos
Moderator
Moderator
Partner    VIP    Accredited Certified

Hello there, Are you still facing this issue?

I've seen this problem with EV 8.0.3 but I assume you are running a later version?

--Virgil

Manoj_Chanchawa
Level 3
Employee Accredited

Fileserver becomes unresponsive - There can be many reasons. Its hard to say what could be reason with this limited information. Have to migrated the data to secondary storage?

To understand the issue, you need to understand how FSA recall works. On a high level, this is what happen - when you click on any file shortcut, or via search\Archive Explorer, the call is interpreted by EV filter driver. EV Filter driver thread pass message to EV Placeholder service thread to retrieve the data and then it waits. This will call EV server to get apporiate data. Once chuncks of data start to delivere, it is passed to appication whch requested the data. With Pass-through enable, the behavior is a little different. 

Now if you see, in your case, there can be a possibility that the filter driver still awaiting to get the content from disk, or threads may be stuck in Kernel\User mode or there may be some other issue altogether.This can only be confirmed by looking at logs and if required, dumps. 

Now, we have seen some issues of this type in past. Which EV & FSA agent version you are running? In case you are on 10.0.4, few changes has been done in some 10.0.4 CHF, so install 10.0.4 CHF3. If still problem persists, then open a support case.