I had the EV Task Controller Service and EV Storage Service stop running due to a large e-mail stuck in the Journal mailbox that was being archived by the Journal Archive Task. The message was almost no text, but over 9 MB of JPG attachments. In the EV event log, the following error was logged:
ARCHIVE2,
4/11/2007 12:56:49 PM,
Enterprise Vault ,
Event 6197,
Type Error,
Source Enterprise Vault ,
The KB linked to this has no usable information (basically repeats the error text).
The references on the MS site to [0xc00e0027] refer only to MSMQ version 1 on Win 2000 sp3, this is version 3 on 2k3 SP1. They recommend changing the Paged Pool Size, but since this was "fixed" in 2000 sp4, and the wrong version, it does not seem like it would really be appropriate.
The EV server is running EV 6 sp 4 on Windows 2003 SP1, with 4 GB memory.
Moving the problem message out of the Journal inbox and restarting the Journal Archive Task was the eventual fix.
Any suggestions on changes to EV or MSMQ setting so that this does not occur the next time someone gets crazy sending their cruise pictures?