Invalid SIS part

[Sortid]

Hi, I'm using EV10 SP1, Exch2010.  On both EV servers (mailbox and journal) I am getting a few of the below warnings. 

Log Name:      Symantec Enterprise Vault
Source:        Enterprise Vault
Date:          10/19/2012 9:27:51 AM
Event ID:      7110
Task Category: Storage File Watch
Level:         Warning
Keywords:      Classic
User:          N/A
Computer:      server.domain
Description:
An invalid SIS part was encountered while doing watch file scan. Following further information is available.
 Partition Name = Journal Vault Store 01 Ptn01
 VaultStoreEntryId = 13E47CC3616170F46A80FAB9A914FD1991210000SVR01
 ParentTransactionID = E09F7A90495C0F383D6C19C77EE10561
 Invalid Reason = Verification failed for sis part when post processing Saveset with TID = [E0F727A7B3E8178299B5F849323CDA71].
Following sis part details are available:
  FPDistinctionByte = [35]
  FPHashPart1 = [-984110173]
  UniqueId = [0].

Ran a dtrace of storagefilewatch, storagemanagement which couldnt capture all the info as it was running over the buffer (ran for 3 mins captured 100MB), but it did get:

StorageFileWatch) <4208> EV:H {CSisPartVerifierExistence::VerifySISPart:#358} _com_error exception: [SIS part validation failed. The stored SIS part size is different to the size expected.      (0x80041bc2)] 

Anyone seen this before?

Thanks,

[TonySterling · Accepted solution]

There is a bug floating around and you might be seeing it.  Please log a call with Symantec and refer to Etrack – 2914202 to verify. 

From what they can tell EV appears to be failing to read the size attribute of a SIS part during post processing which results in an Invalid SIS part error being encountered. There is no evidence of data loss and from the tests that have been done -  dump saveset retruns the item in its entirety.

[Sortid]

Thanks Tony.