Journal Expiration not deleting Files

[ChrisATS]

Windows Server 2008 R2

EV 10.0.4.1189

When I setup Journal archiving I failed to set the expiration policy on it for 2-3 months.  I corrected the problem and now items are being expired after 1 year in accordance with the policy.  I know items are being expired because I'm getting event ID 7085 showing thousands of items deleted. However, when I browse to the journal directory (E:\EVdata\vsg1\journalvs1\ptn2\2012\10-01 through 11-07) the files remain?  Aren't these files supposed to be deleted according to the 1 year expiration policy?  We have some litigation hold going on as well.  How would one elegantly remove these files?

[Rob_Wilcox1]

Well... do you have mailbox archiving enabled too? Maybe sharing between the vault stores is keeping the items there.

[ChrisATS]

Yes, we have mailbox archiving enabled as well.  The mailbox archiving has the same expiration policy. it's a site setting.  I don't believe we are sharing between vault stores. How can I check that?  

I suspected that the directories weren't being removed from the mailbox store as well and that is in fact the case. I have a 4 months of mailbox store folders that are in the directory that should have been removed as well.

[Rob_Wilcox1]

You can check by looking at the properties of the vault store group in the VAC.

are there files in th folders, or just the folders?

what happens if you search your journal archive for items in the date range of what should have been deleted?

[ChrisATS]

Thanks for your help Rob,

I've attached a screenshot of the Vault Store Group properties.  It says "Share within group"?  The folders appear to be empty but when I check the size of all the old expired folders they are almost 2Gb in size?

Performing a DA search for dates ranging from Aug 2012 to October 2012 returned over 3,000 hits. 

I can see a call to Symantec support in my future.

[Rob_Wilcox1]

I think you should find out yourself which folders are taking up space. The folders being empty after expiry is normal. Expiry doesn't remove the folders only the items in it. Odd that you are getting hits in huge expired area, and yes, you might well need a support call after you've have worked out which folders contain items still. 3000 items doesn't seem like many though, so perhaps there is a day or less that hasn't expired.

[ChrisATS]

I think ALL the folders are taking space.  I double checked and indeed the folders aren't empty.  Silly me hadn't enabled view hidden files and folders option.  I enabled that and started checking folders and many of the expired emails folders contain the *.DVS and *.DVSSP files however it's very random and most of the files are empty and if they do contain files it only 2.  I want to believe it's working correctly but I'm blown away that 4 months of expired folders would contain 19Gb of data.  I don't have that much email on litigation hold.

[Kenneth_Adams]

Greetings, ChrisATS;

Please remember that attachments are archived along with the main message.  If an attachment is over a certain size, it does not get archived with the same compression as the main message, and can take up significant space in the vault store partition.  Please review the sizes of the DVS and DVSSP files to see if you note any very large files.  It could be you've got some huge attachments archived as DVS or DVSSP files (most likely DVSSP) that are causing the 19GB of space usage.

[Patti_Rodgers]

Perhaps what you are seeing is a mix of items that are on legal hold plus items that are not being expired due to a more recent item single-instancing against them. The amount that remains on storage may be further increased if you are running collections (an optional process that bundles the individual dvs/dvscc/etc into Windows cab files which is enabled most commonly for ease of backups).  

I was going to put some SQL statements together but really the easiest way to figure out why these files remain would be to get a dtrace of storageDelete while Expiry is processing, then sending that over to SYMC Support or pasting sanitized snippets here. If the items are not being expired due to a legal hold then it should be fairly simple to see that right in the dtrace.