Large chunks of emails not put in Journal

[EVGarrison]

Hi,

Ive checked the journal Mailbox today and noticed there was 13000 items that where just sitting in the inbox.

About 4000 are from a 2 day period in the end of June and another 3-4000 from a day in july and the rest from early september.

Ive checked this "Do Not Journal" mapi property using mfcmapi and this was not the cause, ive tried moving them out into pst and poutting them back in and restarted the journal task thoughout but nothing is triggering the Journal task to sweep them up.

Please note journalling is wokring fine, just these few windows it seemed to not want to take these items.

Has anyone got an idea on how i can get these picked up?

Thanks

[ChayDouglas]

Hi Garrison,

Could you sort the Journal Mailbox's Inbox in the Outlook Client by type and collapse all groups.

Is the message class, "Message" item count growing or falling?

Are the item counts of "EnterpriseVault.PendingArchive" and/or "EnterpriseVault.PendingArchivePart" growing/shrinking?

If only the Message Class: Message is growing and you can see no other movement, I would suggest restarting the Task Controller, running a DTrace against the JournalTask and monitoring the Event Viewer for any errors.

Cheers

Chay

[EVGarrison]

If i could add some extra info having looked at few more bits.

We have multiple databases acorss 3 mailbox servers, ive discovered this is very strange indeed!

I have an item that is still sitting in the journal mailbox to a user, ive searched the journal for it and its not there, however other users received the email from the same person, lots in fact and i ca see all of those in the journal but not for the user who still has the item in the mailbox still.

This users mailbox is even on the same database as those who have had it archived...

So this rules out the database, the journal mailbox as its journalled the same message for others on her database.

Any ideas?

[GertjanA]

Hi Garrison,

Can you also check on the Journal Archiving task, synchronize, select Journal Mailbox, then select all Journal Mailboxes, then sync.

I've seen sometimes that the mailbox cannot be synced.

I've resolved that by removing the Journal Mailbox from Enterprise Vault (which does NOT remove it from Exchange), and then re-adding it (with the same information as it now has, like archive etc).

As Chay says, tracing the Journal Task probably gives a hint.

[EVGarrison]

Hi Chay,

Ive since updated my second post since your message, however i can confirm all of the items that are stuck are "IPM.Note.EnterpriseVault.PendingArchive"

These are theones not clearing, all else is coming in and going quickly.

Ill do a dtrace in a bit and let you know.

[ChayDouglas]

Are you saying that there is a large number of the same item in the Journal Mailbox?

I have seen the Journal get stuck on something similar before, can you drag all versions of this email to a separate mailbox and see if the Journal archive clears?

Cheers

Chay

[EVGarrison]

Hi Chay,

Not of hte same item, just a huge chunk of emails that came in during 5 hour window. Internal and external emails.

If i move the emails out to a pst and back in it makes no difference, howeve rif i drag the message (thats the attachment) back into the inbox of the journal that same message then gets journal and disappears. Which proves the message is fine.

Its as though the task just thinks its already do it so disregards it..

Will get dtrace results up asap.

[EVGarrison]

Ok, lots of these (not sure where the loop starts and finishes, not great at reading these logs)

156779 12:28:05.448  [2664] (JournalTask) <11572> EV:L {CStorageArchive::QueueSaveset:#924} Setting user id []
156780 12:28:05.448  [2664] (JournalTask) <11572> EV:L {CSaveset2::put_UserSID} (Entry)
156781 12:28:05.448  [2664] (JournalTask) <11572> EV:H {CSaveset2::put_UserSID:#3775} _com_error exception: [The parameter is incorrect.  (0x80070057)]
156782 12:28:05.448  [2664] (JournalTask) <11572> EV:H {CSaveset2::put_UserSID} (Exit) Status: [The parameter is incorrect.  (0x80070057)]
156783 12:28:05.448  [2664] (JournalTask) <11572> EV:L {CSaveset2::put_ArchivedDate} (Entry)
156784 12:28:05.448  [2664] (JournalTask) <11572> EV:L {CDocumentSaveset::PutArchivedDate} (Entry)
156785 12:28:05.448  [2664] (JournalTask) <11572> EV:L {CSavesetOnIStg2::CommitAll} (Entry)
156786 12:28:05.448  [2664] (JournalTask) <11572> EV:L {CSavesetOnIStg::CommitAll} (Entry)
156787 12:28:05.448  [2664] (JournalTask) <11572> EV:L {CSavesetOnIStg::CommitAll} (Exit) Status: [Success]
156788 12:28:05.448  [2664] (JournalTask) <11572> EV:L {CSavesetOnIStg2::CommitAll} (Exit) Status: [Success]
156789 12:28:05.448  [2664] (JournalTask) <11572> EV:L {CSavesetRoot::CreateSavesetObject} (Entry)
156790 12:28:05.448  [2664] (JournalTask) <11572> EV:L {CSavesetOnIStg::ReadStreamedPropertyBin:#483} (Entry)
156791 12:28:05.448  [2664] (JournalTask) <11572> EV:M {CSavesetOnIStg::ReadStreamedPropertyBin:#518} (Exit) Property [CHGuid] not found.
156792 12:28:05.448  [2664] (JournalTask) <11572> EV:L {CSavesetOnIStg2::OpenSharableContent} (Entry)
156793 12:28:05.448  [2664] (JournalTask) <11572> EV:L {CSavesetOnIStg2::OpenSharableContent} (Exit) Status: [Success]
156794 12:28:05.448  [2664] (JournalTask) <11572> EV:L {CSavesetOnIStg::ReadStreamedPropertyBin:#483} (Entry)
156795 12:28:05.448  [2664] (JournalTask) <11572> EV:M {CSavesetOnIStg::ReadStreamedPropertyBin:#518} (Exit) Property [CHGuid] not found.
156796 12:28:05.448  [2664] (JournalTask) <11572> EV:H {CSavesetOnIStg2::ReadContentHandlingGuidProperty} Status: [%1 could not be found.  (0x80030002)]
156797 12:28:05.448  [2664] (JournalTask) <11572> EV:L {CSaveset2::get_FileExtension} (Entry)

[GertjanA]

Hi Garrison,

You might want to use 'docmessageclass' to convert the messageclass back to IPM.Note.

Or, verify in your jounrlaing policy what your setting is for 'pending shortcut timeout'. if it is 0, set the journal task to reportmode, restart the task. verify in the journal mailbox items are being converted back to ipm.note.

When all converted, set to normal mode again, restart task, monitor mailbox for items being processed

[EVGarrison]

For some reason my previous post with the small dump from the dtrace hasnt appeared.

Ive opened up the Journal Mailbox under my outlok profile where i have the EV addin (as i understand you cant install the addon on the server)

Ive highlighted 10 or so items and did a "cancel operation" so they went back to normal messages.

On the next pass they went back to pending, took a few mins and they have gone.

So this looks to be sorting it... Bug?

[ChayDouglas]

156781 12:28:05.448  [2664] (JournalTask) <11572> EV:H {CSaveset2::put_UserSID:#3775} _com_error exception: [The parameter is incorrect.  (0x80070057)]

Suggests there is a misconfiguration somewhere...

• Is the Journal Task pointing to the correct System Mailbox?
• Can you connect and Send As from this system mailbox?
• Are you using a GC / DS Server? Is this set to the correct server?

Cheers

Chay
https://www.mirrorsphere.com/enterprise-vault-services/

[WiTSend · Accepted solution]

I've seen this behaviour many times.  Anything can happen in the archive process, loss of connectivity to Storage, loss of connectivity to Exchange, etc...  and you'll have items stuck in Pending mode.  Your method of just canceling them is the quickest and most efficient way to get the to archive.  Occassionally this will cause some duplication in the archive, but that's a minimal effect.  You have stumbled on the best solution.  Trying to track down "why" can be very time consuming and often cannot be found since it happened in the past.  Transient errors are generrally responsible.

[EVGarrison]

Chay,

The Task is set to use the VSA, but as its actually currently working i didnt think it was a config problem.

WiTSend - im glad im not th eonly one to have seen this!

Guys, thanks for your time on this matter, its much appreciated. On a side note am i ok putting office 2010 on the EV server? Currently its 2007 and would like updated.

(Server 2008R2, EV 11.0.1)

Thanks all!

[AndrewB]

Office 2010 is not supported on the EV server (for any version of EV.)

Office 2013 SP1 32bit is supported with EV 11.0.1 as long as you're not archiving from Exchange 2003.