Large chunks of emails not put in Journal

Hi Garrison,

Could you sort the Journal Mailbox's Inbox in the Outlook Client by type and collapse all groups.

Is the message class, "Message" item count growing or falling?

Are the item counts of "EnterpriseVault.PendingArchive" and/or "EnterpriseVault.PendingArchivePart" growing/shrinking?

If only the Message Class: Message is growing and you can see no other movement, I would suggest restarting the Task Controller, running a DTrace against the JournalTask and monitoring the Event Viewer for any errors.

Cheers

Chay

If i could add some extra info having looked at few more bits.

We have multiple databases acorss 3 mailbox servers, ive discovered this is very strange indeed!

I have an item that is still sitting in the journal mailbox to a user, ive searched the journal for it and its not there, however other users received the email from the same person, lots in fact and i ca see all of those in the journal but not for the user who still has the item in the mailbox still.

This users mailbox is even on the same database as those who have had it archived...

So this rules out the database, the journal mailbox as its journalled the same message for others on her database.

Any ideas?

Hi Garrison,

Can you also check on the Journal Archiving task, synchronize, select Journal Mailbox, then select all Journal Mailboxes, then sync.

I've seen sometimes that the mailbox cannot be synced.

I've resolved that by removing the Journal Mailbox from Enterprise Vault (which does NOT remove it from Exchange), and then re-adding it (with the same information as it now has, like archive etc).

As Chay says, tracing the Journal Task probably gives a hint.

Hi Chay,

Ive since updated my second post since your message, however i can confirm all of the items that are stuck are "IPM.Note.EnterpriseVault.PendingArchive"

These are theones not clearing, all else is coming in and going quickly.

Ill do a dtrace in a bit and let you know.

Are you saying that there is a large number of the same item in the Journal Mailbox?

I have seen the Journal get stuck on something similar before, can you drag all versions of this email to a separate mailbox and see if the Journal archive clears?

Cheers

Chay

Hi Chay,

Not of hte same item, just a huge chunk of emails that came in during 5 hour window. Internal and external emails.

If i move the emails out to a pst and back in it makes no difference, howeve rif i drag the message (thats the attachment) back into the inbox of the journal that same message then gets journal and disappears. Which proves the message is fine.

Its as though the task just thinks its already do it so disregards it..

Will get dtrace results up asap.

Ok, lots of these (not sure where the loop starts and finishes, not great at reading these logs)

156779 12:28:05.448  [2664] (JournalTask) <11572> EV:L {CStorageArchive::QueueSaveset:#924} Setting user id []
156780 12:28:05.448  [2664] (JournalTask) <11572> EV:L {CSaveset2::put_UserSID} (Entry)
156781 12:28:05.448  [2664] (JournalTask) <11572> EV:H {CSaveset2::put_UserSID:#3775} _com_error exception: [The parameter is incorrect.  (0x80070057)]
156782 12:28:05.448  [2664] (JournalTask) <11572> EV:H {CSaveset2::put_UserSID} (Exit) Status: [The parameter is incorrect.  (0x80070057)]
156783 12:28:05.448  [2664] (JournalTask) <11572> EV:L {CSaveset2::put_ArchivedDate} (Entry)
156784 12:28:05.448  [2664] (JournalTask) <11572> EV:L {CDocumentSaveset::PutArchivedDate} (Entry)
156785 12:28:05.448  [2664] (JournalTask) <11572> EV:L {CSavesetOnIStg2::CommitAll} (Entry)
156786 12:28:05.448  [2664] (JournalTask) <11572> EV:L {CSavesetOnIStg::CommitAll} (Entry)
156787 12:28:05.448  [2664] (JournalTask) <11572> EV:L {CSavesetOnIStg::CommitAll} (Exit) Status: [Success]
156788 12:28:05.448  [2664] (JournalTask) <11572> EV:L {CSavesetOnIStg2::CommitAll} (Exit) Status: [Success]
156789 12:28:05.448  [2664] (JournalTask) <11572> EV:L {CSavesetRoot::CreateSavesetObject} (Entry)
156790 12:28:05.448  [2664] (JournalTask) <11572> EV:L {CSavesetOnIStg::ReadStreamedPropertyBin:#483} (Entry)
156791 12:28:05.448  [2664] (JournalTask) <11572> EV:M {CSavesetOnIStg::ReadStreamedPropertyBin:#518} (Exit) Property [CHGuid] not found.
156792 12:28:05.448  [2664] (JournalTask) <11572> EV:L {CSavesetOnIStg2::OpenSharableContent} (Entry)
156793 12:28:05.448  [2664] (JournalTask) <11572> EV:L {CSavesetOnIStg2::OpenSharableContent} (Exit) Status: [Success]
156794 12:28:05.448  [2664] (JournalTask) <11572> EV:L {CSavesetOnIStg::ReadStreamedPropertyBin:#483} (Entry)
156795 12:28:05.448  [2664] (JournalTask) <11572> EV:M {CSavesetOnIStg::ReadStreamedPropertyBin:#518} (Exit) Property [CHGuid] not found.
156796 12:28:05.448  [2664] (JournalTask) <11572> EV:H {CSavesetOnIStg2::ReadContentHandlingGuidProperty} Status: [%1 could not be found.  (0x80030002)]
156797 12:28:05.448  [2664] (JournalTask) <11572> EV:L {CSaveset2::get_FileExtension} (Entry)

Hi Garrison,

You might want to use 'docmessageclass' to convert the messageclass back to IPM.Note.

Or, verify in your jounrlaing policy what your setting is for 'pending shortcut timeout'. if it is 0, set the journal task to reportmode, restart the task. verify in the journal mailbox items are being converted back to ipm.note.

When all converted, set to normal mode again, restart task, monitor mailbox for items being processed

For some reason my previous post with the small dump from the dtrace hasnt appeared.

Ive opened up the Journal Mailbox under my outlok profile where i have the EV addin (as i understand you cant install the addon on the server)

Ive highlighted 10 or so items and did a "cancel operation" so they went back to normal messages.

On the next pass they went back to pending, took a few mins and they have gone.

So this looks to be sorting it... Bug?

156781 12:28:05.448  [2664] (JournalTask) <11572> EV:H {CSaveset2::put_UserSID:#3775} _com_error exception: [The parameter is incorrect.  (0x80070057)]

Suggests there is a misconfiguration somewhere...

• Is the Journal Task pointing to the correct System Mailbox?
• Can you connect and Send As from this system mailbox?
• Are you using a GC / DS Server? Is this set to the correct server?

Cheers

Chay
https://www.mirrorsphere.com/enterprise-vault-services/