Issue with EV 9.01 - multiple errors logged in eventlog

[pembridged]

Hi,

We're having a bit of an issue with EV whereby multiple errors are being logged in the EventLogs and shortcuts are not being processed after a successfull back so items remain as pending.

We're getting Event IDs 4167, 8390, 2776 and others.  Restarting the EV services clears the errors but they just begin again after a short period time ... any assistance would be great.

Cheers,

[JesusWept3]

can you paste the events here please?

[pembridged]

Event Type:    Error
Event Source:    Enterprise Vault
Event Category:    Archive Task
Event ID:    8390
Date:        3/23/2011
Time:        5:54:32 PM
User:        N/A
Computer:    CDC-SEV-10
Description:
The EnterpriseVault.DirectoryConnection object reported an error.
 
Exception occurred.
 

Event Type:    Error
Event Source:    Enterprise Vault
Event Category:    Archive Task
Event ID:    4167
Date:        3/23/2011
Time:        5:54:29 PM
User:        N/A
Computer:    CDC-SEV-10
Description:
An exception has been raised.
Internal reference
CBaseDirectoryServiceWrapper::GetInterface .\DirectoryServiceWrapper.cpp [lines {653,693}], built Nov 24 00:04:09 2010
 
 
An exception is raised when a process encounters an unexpected fault.

 

Event Type:    Error
Event Source:    Enterprise Vault
Event Category:    Archive Task
Event ID:    8390
Date:        3/23/2011
Time:        5:53:57 PM
User:        N/A
Computer:    CDC-SEV-10
Description:
The EnterpriseVault.DirectoryConnection object reported an error.
 
An error getting the Dispatch interface prevented the directory machine being called.

Event Type:    Error
Event Source:    Enterprise Vault
Event Category:    Archive Task
Event ID:    2776
Date:        3/23/2011
Time:        5:53:53 PM
User:        N/A
Computer:    CDC-SEV-10
Description:
An exception occurred in routine

ObtainCharsets
EXCEPTION_ACCESS_VIOLATION @ 0x7C81BD02

Event Type:    Warning
Event Source:    Enterprise Vault
Event Category:    Archive Task
Event ID:    65535
Date:        3/23/2011
Time:        5:53:56 PM
User:        N/A
Computer:    CDC-SEV-10
Description:
The description for Event ID ( 65535 ) in Source ( Enterprise Vault  ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE= flag to retrieve this description; see Help and Support for details. The following information is part of the event: CClientRegInfoCache, LoadEntry/GetRegisteredClientDetails [CClientRegInfoCache].
Data:
0000: 41 6e 20 65 72 72 6f 72   An error
0008: 20 67 65 74 74 69 6e 67    getting
0010: 20 74 68 65 20 44 69 73    the Dis
0018: 70 61 74 63 68 20 69 6e   patch in
0020: 74 65 72 66 61 63 65 20   terface
0028: 70 72 65 76 65 6e 74 65   prevente
0030: 64 20 74 68 65 20 64 69   d the di
0038: 72 65 63 74 6f 72 79 20   rectory
0040: 6d 61 63 68 69 6e 65 20   machine
0048: 62 65 69 6e 67 20 63 61   being ca
0050: 6c 6c 65 64 2e 20 20 20   lled.   
0058: 20 20 20 5b 30 78 63 30      [0xc0
0060: 30 34 32 31 36 36 5d      042166]

Event Type:    Error
Event Source:    Enterprise Vault
Event Category:    Archive Task
Event ID:    8390
Date:        3/23/2011
Time:        5:53:58 PM
User:        N/A
Computer:    CDC-SEV-10
Description:
The EnterpriseVault.DirectoryConnection object reported an error.
 
An error getting the Dispatch interface prevented the directory machine being called.


 

[pembridged]

I've pasted a  cross section of the errors we are getting, cheers

[pembridged]

Event Type:    Error
Event Source:    Enterprise Vault
Event Category:    Archive Task
Event ID:    2776
Date:        3/23/2011
Time:        9:52:38 PM
User:        N/A
Computer:    CDC-SEV-10
Description:
An exception occurred in routine

AddAttachmentListToMsgBody
EXCEPTION_ACCESS_VIOLATION @ 0x78556DEC

For more information, see Help and Support Center at http://evevent.symantec.com/rosetta/showevent.asp

Event Type:    Error
Event Source:    Enterprise Vault
Event Category:    Archive Task
Event ID:    2776
Date:        3/23/2011
Time:        10:02:32 PM
User:        N/A
Computer:    CDC-SEV-10
Description:
An exception occurred in routine

ObtainCharsets
EXCEPTION_ACCESS_VIOLATION @ 0x  A17315

For more information, see Help and Support Center at http://evevent.symantec.com/rosetta/showevent.asp

Event Type:    Warning
Event Source:    Enterprise Vault
Event Category:    Archive Task
Event ID:    3361
Date:        3/23/2011
Time:        10:08:26 PM
User:        N/A
Computer:    CDC-SEV-10
Description:
Failed to determine the provisioning group for the mailbox /O=RCN/OU=RCN/cn=Recipients/cn=hooperr.

This mailbox cannot be processed until the Exchange provisioning task has processed the corresponding user's details. Ensure that a provisioning group includes this user and then run the provisioning task.

Error: Not enough storage is available to complete this operation.  [0x8007000e]

For more information, see Help and Support Center at http://evevent.symantec.com/rosetta/showevent.asp

[JesusWept3 · Accepted solution]

For Event ID 2776 : http://www.symantec.com/business/support/index?page=content&id=TECH67377

For the rest of the events, it looks like EV is attempting to communicate to another EV Server but can't establish the connection properly.

Are these events recurring very frequently?
May need to get a dtrace of ArchiveTask when this is happening and seeing what is occuring there

Also this bit confuses me:
"The description for Event ID ( 65535 ) in Source ( Enterprise Vault  ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE= flag to retrieve this description; see Help and Support for details. The following information is part of the event: CClientRegInfoCache, LoadEntry/GetRegisteredClientDetails [CClientRegInfoCache]."

Typically you get failures to read events when you are attempting to read an event log without the DLL files with the definitions of each event, so you would typically see this if you open the Enterprise Vault EVT logs (or evtx if you're using Windows 2008) on a client machine without having the VaultMessages.DLL registered.

Are you seeing that message in that format on the Enterprise Vault server?

[pembridged]

Just checked and it has failed again overnight, the only change I've made recently is to point EV to the whole exchange org instead of windows groups ... the errors are being reported every second.

The A1 messeage queue for the archive task is showing as having 64,000 items in there.  The issue seems to be with processing the shortcuts :(

I'll run a Dtrace and I'll chase the call I have logged with support.
 

Thanks,

[pembridged]

Weird the shortcut processing is happening now ... !?  The only thing I can think is that I added the whole exchange org to my provisioning group which has another another AD group of users as a target in there....