Index locations

[Rob_dos_Ramos]

Hi all,

We have a client that is currently journaling and everything is working correctly as far as archiving the item and removing the item from the journal mailbox.

But the strange part is that if you do a search in the journal archive we cannot search past the year 2008. the stranger part is that if you look at the indexes in the archive propertise it only goes up to 2008. Now the client is writing to a Data Domain directly, so it is not writing to a attached disk and then migrating it to the Data Domain. 

The version of EV is 8.0.3

Server 2003 r2 SP2

[GabeV]

Hi Rob,

I will definitely look into the journal archive indexes and confirm the ranges on the volumes. I will also look for any failed volumes as well. If you have storage expiry enabled, you might need to review the retention category applied to the journal mailbox. For instance, if the retention is 5 years, all the archived data older than 5 years should be already deleted by storage expiry.

Hope this help !!

[Rob_dos_Ramos]

Hi Gabe,

 Thanks for the reply. OK the problem is that I can search for information from 2000 to 2008. So from 2008 onwards we cannot search.

No indexes have failed or offline. Storage expiry is not enabled. I have never seen this happen before so I am totally puzzled by this.

There is a warning that their are indexes waiting to be replicated or backed up but it is not enough items to explain why year 2009 to 2013 are missing.

[GabeV]

Rob,

How many journal mailboxes do you have? Is there any chance that a new journal archive or mailbox was created back on 2008 on Enterprise Vault? Based on what you are saying, it appears that Enterprise Vault is storing the emails from the journal mailbox in a different archive.

[Rob_dos_Ramos]

Hi Gabe,

I also thought that might be the case. Currently they have two journal mailboxes. If I check the settings under targets->domain->exchange->journal they are poitning to the correct archive. 

Not sure when it was created

[TonySterling]

Hi Rob,

Can you post screen shots of the index volumes tab from the properities of the archives?

Thanks

[Rob_dos_Ramos]

Hi Tony,

here you go. 

[TonySterling]

Can you look on the properties of the Index Service at the index locations?  Make sure there are open locations.

[Rob_dos_Ramos]

Hi Tony,

All the locations are open.

[GabeV]

Rob,

Look at the journal archive properties > advanced tab. What's the value for Youngest and Oldest archived item?

[Rob_dos_Ramos]

Oldest item is 1980 and the youngest is 18/05/2008

[GabeV]

If the youngest item archived date is 18/05/2008, EV is not archiving any new data on that archive which might explain why you cannot search past the year 2008.

You mentioned that this customer has two journal mailboxes. Could you please post screenshots of the journal mailboxes properties and the journal archives under Archives > Exchange Journal?

[GertjanA]

Hello, can you find the data you expect on the Data Domain? Are you absolutely sure that the journalmailbox targeted is the one needed to be targeted, and do you see items going in going out? What you might want to test is the following: Change to Journal Partiton to remove the shortcut after backup. Open the journal mailbox, verify you get pending items. select a pending item, press CTRL+SHIFT, click an EV-icon in outlook. In popup, select VaultInformation. somewhere down is a header called 'selected item' (or something). Look for the ARCHIVEID. (copy to clipboard, past in notepad). Copy archiveid. In EV console, press CTRL+SHIFT, rightclick on Archives. Select find Archive/folder (this is a hidden gem!) past the ArchiveId. Press find. Which archive does it show? Is that the archive you think it is? Change setting back to 'no shortcut' :)

[Rob_dos_Ramos]

Hi Gertjan,

Tried that but when I open up the journal mailbox non of te EV buttons appear and if I try and open it on a users machine it points to the users archive.I did confirm that it is pointing to the correct archive by running a dtrace against it. 

From the Dtrace I pickup streaming errors to the Fingerprint and SIS. We checked the SQL and the databases indexes have not had mainteace done to it for a very long time. The task kept failing. so we are kicking of the reindexing of the databases this weekend. Could this be the problem?

What I did do was create a new archive for the journaling and pointed the new data to it. Once it started archiving i could see the new dates in the inedexes. but when I go back to the older archive the indexes are still missing. I kicked of a repair on the old indexes but I dont think it is going to resolve the problem. 

Any other ideas you guys can think of?