cancel
Showing results for 
Search instead for 
Did you mean: 

Journal items - 3071 - Do Not Archive

GertjanA
Moderator
Moderator
Partner    VIP    Accredited Certified

Hello all,

Running EV11.0.1 CHF3, 12 EV servers, Exchange 2013. Only performing Journal Archiving.

We have many Journal Mailboxes which contain a backlog of several million of items. These Journal Mailboxes are static (i.e. no new additions), but need to be archived until they are empty. We also have active Journal Mailboxes.

Some of the static mailboxes, when archived, give error-event 3071:

The following message could not be archived by the Journaling Service as it may be corrupt.

Title: Title of Message
Mailbox: Journal Mailbox

An error occurred whilst moving the message to the 'Enterprise Vault Journaling Service\Failed to copy' folder.
The message has been marked as "Do Not Archive", and no further attempts will be made to archive this message.

These messages seem to keep the ' pending archiving'  messageclass, but remain in the inbox. I'd like these messages to be retried, but it seems that as they are in the inbox, they cannot be returned from the ' failed to xxx' folders.

I know there are 2 registrykeys I might need to set. One is ClearDoNotArchive, the other ClearDoNotJournal.

Does anyone know if I can/need to use above key? How I can reset the ' do not archive' easily, or at least verify per Journal Mailbox how many of those items I have, and what items they are?

Thanks for the assistance,

Gertjan.

 

Regards. Gertjan
1 ACCEPTED SOLUTION

Accepted Solutions

GertjanA
Moderator
Moderator
Partner    VIP    Accredited Certified

Update

Using registry key "ClearDoNotJournal" has most items archived. There are items which are corrupt. This has been verified by trying to export these items to PST, trying to drag them to the desktop, or forwarding them. All actions give an 'unspecified error'. The item (in the mailbox) can be opened, the embedded message can be opened and the attachments (PDF) can be opened. Any other action is giving errors.

A case will be opened with MS to see if they can explain, and resolve.

Regards. Gertjan

View solution in original post

8 REPLIES 8

JesusWept3
Level 6
Partner Accredited Certified

In the mailbox, you can add a column under All Mail Fields "Do Not AutoArchive"
You could probably also sort by date as they would now be the oldest, the fact is though they're probably corrupt.

Im sure theres a way you could script it via Redemption or just regular mapi to logon to each mailbox and look at the Flags set on the message
 

https://www.linkedin.com/in/alex-allen-turl-07370146

AndrewB
Moderator
Moderator
Partner    VIP    Accredited

have you checked your "pending shortcut timeout" and "return failed items to inbox" settings in the EV Exchange Journaling policy?

JimmyNeutron
Level 6
Partner Accredited

You'll have to do some work on these mailboxes to retry these items. You can also reset their message classes back to IPM.Note. 

 

JesusWept3
Level 6
Partner Accredited Certified

Well the issue seems to be that if EV can't move the items, it may not be able to edit or change the items, hence saying they may be corrupt.
In fact, they may not even be able to get the Do Not AutoArchive flag set correctly.

Have seen it before where if you can find and identify the items (via DTrace of JournalTask), if you move the item out of the mailbox on to the Desktop, and then back in to the mailbox, that item will archive because MAPI 'fixes' up the message as it saves it out

https://www.linkedin.com/in/alex-allen-turl-07370146

JimmyNeutron
Level 6
Partner Accredited

But all in all you will have to work these messages to get them retried by EV. I normally use the Docmessageclass app or the MFCMAPI to investigate deaper. I've gotten mailboxes that have items above the 10millions archived and brought them down to the hundreds which were all NDR's and not actual important emails. Send me a message, maybe we can help you out

 

 

 

GertjanA
Moderator
Moderator
Partner    VIP    Accredited Certified

They seem to be items that are known to cause issues. There are several not having a To: filled., there are several that seem to be corrupt (they show in the inbox as being 2MB, when dragged out to desktop they are 8MB, dragged back in they are again 2 MB.

Policy settings are adjusted (Pending Shortcut timeout = 31, return items to inbox is on). Due to running several journal tasks on the ev-servers, dtrace fills up pretty quick. We monitor both mailbox count and archiving rate, and determine from there what needs to be investigated. We have removed several Journal Mailboxes from tasks already (where those had less than 1000 item in them, all seem to have some sort of issue). We'll wait for the majority of the mailboxes to empty, then investigate the erroneous ones. We had the 'restartallmapirelatedtasks' regkey set to 1440 (once a day), but removed that. Now also watching msmq, if it is not moving for >10 minutes, tasks is restarted.

Now working on journalmailboxes reported as 'not being scanned since', and 'not being archived since'.

We'll get there eventually....

 

Regards. Gertjan

AndrewB
Moderator
Moderator
Partner    VIP    Accredited

you have Pending Shortcut timeout set to 31? default is 3. what i was thinking might help would be to set it to 0, run a sync, and then set it back to what you had before.

GertjanA
Moderator
Moderator
Partner    VIP    Accredited Certified

Update

Using registry key "ClearDoNotJournal" has most items archived. There are items which are corrupt. This has been verified by trying to export these items to PST, trying to drag them to the desktop, or forwarding them. All actions give an 'unspecified error'. The item (in the mailbox) can be opened, the embedded message can be opened and the attachments (PDF) can be opened. Any other action is giving errors.

A case will be opened with MS to see if they can explain, and resolve.

Regards. Gertjan