Index Volume Rollover

[awf]

(Enterprise Vault 7.5)

I am currently in the process of importing PSTs that contain journaled mail from our old Legato system into a shared archive. I'm concerned about the index for the shared archive rolling over if it becomes to large. I've been told that the way to avoid this automatic rollover (which can complicate later searching) is to manually create archives based on date range. However, the PSTs are user-based, so I can't use dates.

My question is: when exaclty does an index become full and rollover? Is it based on the actual number of messages that have been indexed and stored in the archive or some other type of item/object? I've seen the term 'locations' referrred to in regard to the registry key AVSMaxLoc, which I know limits the size of the index, but haven't been able to find a good explination of what that means.

[Philip_Hagan]

This link might help.

http://www.symantec.com/content/en/us/enterprise/media/stn/pdfs/Articles/enterprise-vault-7-and-ente...

Phil

[TonySterling]

awf,

AVSMaxLoc refers to the maximum number of locations contained in an index.  I am not sure what your concern is regarding the rolling over of the index volumes, you will just have to select one archive to search in Discovery Accelerator or Compliance Accelerator and it will search all the associated volumes automatically.

If you don't use AVSMaxLoc your indexes will end up around 20GB+.  You do not want that...

[awf]

Tony,

We do not own Discovery Accelerator or Compliance Accelerator so if the index rolls over, we would have to select each index individually when we do a search. The more indexes there are, the more tedious the searching becomes. By breaking up the archives into logical groups (i.e. date ranges or alphabetical groups) we can limit the archives that would need to be searched.

Are the 'number of locations' the only thing that affect index rollover? If so, what are "locations" and is there any way to equate that to message count? Basically, I want to make sure that my indexes aren't going to get too big (to avoid both size issues and rollover) but also that I am not breaking the archives up into too small of groups. And I'd also like to understand how it works for my own knowledge. Thanks.

[Maverik]

Hello, I can assure you that if the index rolls over you will not have to search multiple indexes, but rather a single archive. This is true with or without CA and DA and using the plain search.asp or search02k.asp.  

If you use http://EVservername/enterprisevault/search.asp you will note that the selection is via archive not index and if you have one index or 2 you still search against the one archive. You can have multiple indexes for a single archive.  Going back to bersion EV5 etc this was a one one one relationship.  One archive per index.  Now you can have multiple indexes on a single archive and the search will span them all.   

In the Doc from previous poster it has a good explanation of the AVSMAxLoc reg Key that I think answers your query. My undertanding of locations is the amount of items that have been indexed.  By default 2 Billion.

AVSMaxLoc

Mailbox archive indexes rarely grow that large, however Journal archive indexes will grow until the reach the default maximum number of locations, which by default is 2 Billion in EV 6 sp1 and above. Leaving the default setting will result in Index Volumes over 15 GB’s in size! Such large indexes being searched by CA or DA can result in out of memory issues and slow search performance and lead to the index volumes being marked as Failed.

For this reason it is Best Practice to set the AVSMaxLoc registry key to keep the index volumes from becoming unmanageable. Setting this key will cause your index volumes to automatically roll over sooner. If you already have large index volumes in your environment you will need to rebuild them using the IndexVolumeReplay utility.

We have found that setting this key will allow CA and DA searches perform better and additionally,

[awf]

Genie,

Thanks for the info. However, the Enterprise Vault 2007 Admin Guide states on page 62: "If an archive has more than one index volume, the initial search is performed against the current index volume, which contains the most recently-archived items. To view search results from earlier index volumes, you must choose a date range from a list. The date ranges correspond to the archived date range of items in the index volumes."

While I have not been able to test this, it seems from the above information that you do indeed have to select a date range that corresponds to the index. So, if I am doing a search on Mike Jones in an archive that has 5 indexes, I will first do the search against the current index, and then have to do 4 subsequent searches - each time selecting a date range that corresponds to each of the other 4 indexes.

I know that there is an option to turn on federated searching, which I believe will allow you to search against multiple indexes, but I am concerned about how this will effect performance - I have one EV server that handles all roles and that users will be interfacing with to open shortcuts and search their personal archives. In the end, I am back to needing to know how to size my archives so that not only do I avoid rollover, but also keep my indexes from growing to large and hindering search performance.

Message Edited by awf on 02-05-2008 10:59 AM

Message Edited by awf on 02-05-2008 10:59 AM

[John_Chisari]

Rollover and Federated searching is actually a good thing to happen.  Federated searching will only search 1 Index volume at a time - but will search across all Index volumes and give you 1 result set.

If you were to not to use Federated Search and you have 5 Index volumes - you would need to search 5 times and you will receive 5 different result sets - This would also be the same if you manually created new archives.

FYI, AVSMAXLOC has been changed in EV2007 SP2 and the default is now 1 billion locations.

What you have to remember about search performance is how many search terms you are using and how big the archives are.

[awf]

Thanks John, that makes sense. I was wondering if you would mind giving me a brief explanation of a "location", just so I have a better understanding of how the indexing works. Thanks. 

[awf]

One other thing... is federated searching turned on by default in EV 2007 or do I need to create the WebApp.ini file?

[MarkBarefoot]

The AVSMaxLoc key refers to the maximum number of elements within a single index. An element is an entry in the index and unfortunately there, I believe, is no public literature defining exactly what it is. I attended a workshop run by the Director of Engineering in Symantec about Indexing, and the term elements was used there. This kinda pointed to words, or groups of words etc but not to be thought of as a 16 bit word. It is really governed by the AltaVista engine. By decreasing the the value you will simply have more frequent index rollovers.

For the Federated Searching, you are right in thinking about the performance hit on your Enterprise Vault server. Obviously configuring the search to trawl more indexes and also the possibility of more people doing it, may impede your performance. You are able to seperate the core services like Indexing etc onto seperate servers which would improve the performance, but this will also cost more etc. You will need to create the file, follow this Technote link for more info - http://support.veritas.com/docs/292820

Regards,

Mark

[awf]

Thanks Mark. I had seen the KB article, but wasn't sure because it says: "These settings alter the Archive Explorer search page. ***Warning*** These ArchiveExplorer settings are not supported in EV versions 7.0 and above. For more details please refer to the EV 7.0 Release Notes:"

Plus, the admin guide says that federated searching is turned on by default.  But you're saying that I need to create the WebApp.ini file?

Thanks.

[DimaV]

Dear Tony Sterling, please assist.

Here is the scenario: EV2007 SP2

Journal Archive has 2 index folders

index folder1  - size 20GB
index folder2 rolled over from index folder 1  - size 1 gb

I would like to keep indexes not more than 4gb in size going forward. If I set AVSMaxLoc key to 500 million locations, will the current index folder 2 take this setting or will it rollover at 20gb, just liek index folder1?

If AVSMacLoc is set, assuming I am not able to rebuild any current large indexes, does this new setting will only apply to newly created journal archives or current archives as well?

Thank You

[TonySterling · Accepted solution]

Yes, once you set AVSMaxLoc your new index volumes will rollover around the 4GB, give or take.  It will apply to all current and new index volumes, meaning if there is a current index volume over the 500 million location it will immediately roll over.

If you do not rebuild the 20GB index volume it will not change, it will remaing 20 GB.

Regards,

[TonySterling]

I should point out that the new Default with EV 8 is 1 Billion.  EV 8 also contains all the previously discussed best practices built into it.

Regards,