Index says normal and 98,000 items, search bring back 8 items

[CariesP]

My issue is that i don't believe EV anymore.

It said for this one user (and there have been many more) that it's INDEX was NORMAL and it had 98,000 items. when i did a search on the Enterprise Vault Directory (ArchiveView and IndexVolume tables) it said both had 98,000(ish) items for this one user.

but when the user did a search in outlook, it came up with 8 items ONLY.

We did the outlook search on multiple platforms (win 7, XP, Citrix), different versions of outlook (2010, 2007) and different EV clients (V9, V10) and still only 8 items.

we are currently running EV 9.0.0.1193.

my question is this, If the index says normal, the sql script says the correct amount of items, but the user is seeing the wrong amount, how can i trust that EV is correct??? when it obviously isn't...

In this case the user who had been here for 10 years noticed that 8 items was a little low and contacted us. BUT what happens if the user saw 80,000 items and thought that looked ok? how would we as the IT professionals be able to tell that the index is broken and needed to be rebuilt, when everything was saying NORMAL? do i really have to run the SEARCH for ALL USERS to check that the total of their search is the same amount of items as what the index says there is? SERIOUSLY, for EVERY USER? that is unacceptable.

does anyone have any ideas on what i can check to make sure my INDEX server is alive and happy and not deep down corrupt somewhere??  I have open a call with symantec and have escalated it a consultant\engineer as there has to be something broken deep down. otherwise i have lost my faith that EV works.

[AndrewB]

what does it say for the number of items if you pull up the vault store usage report and drill down to the particular archive in question?

[CariesP]

97542 items. about the same as the database and the index.

[GertjanA]

Hello,

To clarify, what exactly do you mean with : "but when the user did a search in outlook"

Do you mean he searched for archived items? Do you mean he did a search with Search Safe?

Have you tried to clear IE history and tempfiles etc?

[CariesP]

Search in outlook. in outlook, click on enterprise vault icon that says SEARCH VAULTS, use the drop down option to pick the vault for the user with the issue and putting NOTHING in the search option and clicking SEARCH. he did a search of his whoile vault for every email. and all that came back was 8 results. when i do the search on my account i get 100,891 items. we did this on multiple platforms (win 7, XP, citrix), multiple outlook versions (2010, 2007), multiple EV clients 9EV9, EV10), with clean IE caches.

[GertjanA]

It might be a corruption in the index that is not catched by EV? Have you tried rebuilding the index?

What I find when there are issues with number of items, is to find the indexlocation for that specific archive, stop indexing-service, delete (or move) the files from the indexlocation, start indexservice, then do a rebuild on the index. (to find location, first check the location under the indextab of the user, add the vaultid (on the advanced tab) as foldername.)

An initial check might be also to export his archive to PST. Do you then also get 98000 items?

I assume there are no errors in the eventlog for this user? Have the indexlocations perhaps been scanned by AntiVirus programm? Have you perhaps had an issue with disks, causing chkdsk to be run ( I had that happen a while ago, not funny!)  Any other events in Application/System eventlog indicating possible issues?

[Rob_Wilcox1]

I'd suggest something along the lines of what Gertjan says .. try exporting the archive to PST.

Also remember that if it says 80,000 items, then doesn't mean 80,000 emails.

[CariesP]

GertjanA - yes by rebuilding the index the issue is resolved. my concern is that there are others out there that do a search and it says 80,000 items to search from, they think that is ok BUT their index says they have 130,000 items. if that person is not aware of an issue then they won't call us to fix it, so how can i CHECK that the indexes are good and normal?

when exporting it exported the full 98,00 items. all good.

no AV on that server at all.

my issue is i don't believe that EV is saying the correct information. how can i force the index server/service to run a more thorough check on each index and find all the corrupt / broken ones? whatever it is doing now, is not right as i am finding index saying that they are normal but are in fact CORRUPT/BROKEN. this is what i need guidance/assistance on.

[AndrewB · Accepted solution]

have you seen this article?

How to verify the integrity of indexes with the IndexCheck utility when using Enterprise Vault (EV).

Article:TECH45546

|

Created: 2005-01-11

|

Updated: 2011-05-16

|

Article URL http://www.symantec.com/docs/TECH45546