SEV 8.0 SP2 Errors on Journalling Task, EventID: 2245, 2270 and 2850

[marccrowther]

Hi all,

Since fixing a Journal Task related issue in a previous thread (www-secure.symantec.com/connect/forums/event-id-6502-and-2856-after-upgrading-sev-2007-sp4-sev-2008-...) I now get these three errors when the Journal Task is in a running state. MSMQ also generates thousands of messages that look to be the exact same size. It almost looks like the system is in some form of loop. The normal mailbox archiving is still functioning perfectly.

EVENT 2850

Whilst post processing a message an error occurred in CArchivingAgent::PostProcessArchivedItem() whilst calling CExchangeShortcutAccessor::BuildFromSessionAndLocation().

Error returned from BuildFromSessionAndLocation(): 80040107 

EVENT 2270
 

A queued operation exceeded the retry count and has been discarded

m_pIArchivingAgentUpdate->PostProcessArchivedItem(OriginatingAgent = "183F9B771772A63499141899CABAE7CFB1011y00vault.rennies.co.za",
m_pIShortcutAccessor,
m_pILocation,
SavesetID = "962000000000000~200807040811510000~1~4FA12577BD1E42E8AD38B632C08EFAE",
VaultID = "1FD7810AD51B50A4D8E11618B596350B21110000vault.rennies.co.za",
nRetryCount = 3,

NULL);
HRESULT: 0x80040107 

EVENT 2245

An error occurred whilst post processing a message and it could not be changed back from the Archive Pending state.


Error that caused the message to be changed back: 80040107

Error when trying to change the message back: c0040899

Any help would be welcomed :)

 

[Maverik]

I would say that you have some messages that are stuck in Journal Mailbox that EV is struggling to deal with. 

How about stopping the Journal Task.  Remove any pending messages to another folder for the moment, then start Journaling.  Do the errors still occur?

If not we can then deal with the messages having issues being ingested into archive.

[Mojorsn]

We have seen these errors before, and you can find the message EV is choking on if you run a DTrace.  The DTrace should be on the Storage service, so start the DTrace with logging then re-start the storage service.  Give the DTrace a few minutes to run and verify the errors are appearing in the log.  Then stop the log and look through it for 2270.  When you see that in the log the subject of the email that is causing problems should be found within a couple lines of the 2270. 

Hope this helps.

[marccrowther]

When you say remove pending messages, you mean from the Journal Mailbox on Exchange itself, or are there SEV folders I should be looking at? IE: MSMQ? I've deleted the thousands of duplicate files from the MSMQ queue, but will move all mail out of the Journal on the Exchange Server if you think that may be the root of all evil. :)

[MarkBarefoot]

It's the pending items in the Journal mailbox itself. How many are there and what are the figures on the MSMQ looking like?

[MarkBarefoot]

NOTE on MAPI Error 80040107: Every folder with in an Exchange database has an EntryID. MAPI clients such as OABgen.dll and Outlook will call OpenEntry() and use the EntryID given to gain access to folders in the Exchange Information Store. In this case the EntryID that is being referenced is to the OAB system folder. This error is returned because the folder in the information store does not exist.

I would get a DTRACE of the JournalTask and the StorageFileWatch process to see if a particular folder or item is causing this