We are running Enterprise Vault 8.0. All file servers have the latest FSA client installed.
Placeholders are being recalled when I right-click the file to bring up the properties on our Citrix servers. I have run a DTRACE on the placeholder service and get the following:
26 15:10:27.823 [5004] (EvPlaceholderService) <5020> EV:M Filter message event signaled [WAIT_OBJECT_0 + 1]
27 15:10:27.839 [5004] (EvPlaceholderService) <5020> EV:M [EvRequestArchivedFile] Queueing placeholder request for file: C:\EVsharerootvolume\evshare\Contracts_ph\Contracts1 (15).TXT
28 15:10:27.839 [5004] (EvPlaceholderService) <5020> EV:L RequestArchivedFile::RequestArchivedFile (Entry) |
29 15:10:27.839 [5004] (EvPlaceholderService) <5020> EV:M Trying to get the .exe name for pid: 4
30 15:10:27.839 [5004] (EvPlaceholderService) <5020> EV:M Failed get the .exe name for pid: 4, error: 299
31 15:10:27.839 [5004] (EvPlaceholderService) <5020> EV:L RequestArchivedFile::RequestArchivedFile (Exit) |Success [0] |
32 15:10:27.839 [5004] (EvPlaceholderService) <5020> EV:L CQueue::EnQueue (Entry) |
33 15:10:27.839 [5004] (EvPlaceholderService) <5020> EV:M CQueue::EnQueue item enQueued
34 15:10:27.839 [5004] (EvPlaceholderService) <5076> EV:M CQueue::DeQueue item deQueued
35 15:10:27.839 [5004] (EvPlaceholderService) <5076> EV:L RequestArchivedFile::Process (Entry) |
36 15:10:27.839 [5004] (EvPlaceholderService) <5076> EV:M Processing a placeholder restore request for file:
I see PID 4 is for the System. I ran procmon while right-clicking but could not find any entry that pointed to a process other than explorer (which I tried to exclude in the registry)
ExcludedExes (SZ) EVPlaceholderService.exe;Explorer.exe;Mcshield.exe
Any tips on how to troubleshoot further would be much appreciated.
Thanks!
