Since upgrading to 10.0.4 EV is archiving tons of items!!!!

[Gavin_Palmer1]

Hi Guys,

I'm hoping someone can help me here.  I have a problem currently which I raised as a priority 1 which the engineer could not work out to a certain extent. He did help me with a workaround to which I am greatful.

We recently upgraded to EV 10.0.4 and for some strange reason had 1000's of items archiving each day out of the blue.  While we were running 10.0.3 the EV server reported that we were up to date.  This issue was crippling our exchange system and in the end we have had to throttle down what EV was doing to 1 exchange connection and 200 items per pass.  

What I would like to know is, how can I find out what EV is archiving all of a sudden to make the workload go through the roof?  We are archiving exactly the same message classes as before so I dont see what it could be?  My fear is that it is re archiving everything for some reason.  This is very scary!!!!

Any help would be appreciated.

Thanks 

Gavin

[Rob_Wilcox1]

Look at the Exchange Mailbox Archiving Reports.

https://www-secure.symantec.com/connect/videos/enterprise-vault-1002-mailbox-archiving-report

[TonySterling]

As Rob said, you can view the archiving reports.  What you need to do is look at mailboxes to make sure everything being archived should be.  Take a look at all the message classes being archived now.

It is possible there was something the previous versions were missing and now you are getting caught up.

[WiTSend]

The first thing that I would look at is whether or not you are archiving deleted items.  We had to make a change and began archiving deleted items and discovered that users were storing a lot of data there.  Also, it is not possible for EV to rearchive since the data isn't there anymore.

I would also randomly check various mailboxes to see if the archiving in those mailboxes is what I would expect to see.

[GertjanA]

If the Archiving report does not show info, run the task in report mode.

That might clarify what is being done

[Gavin_Palmer1]

Thanks to all for the comments on my issue.  I will try the Run Now in report mode and see what happens.  What I'm looking for really is a way to see what message classes are being archived after an archive run.  I know I can check the message classes that WILL be archived but it just doesnt make sense.

I have a colleague who has been monitoring their mailbox and archiving for 2 days.  The report from this morning says it archived 400 items yesterday.  Yet his Vault cache has only gone up by 78 items.  He has also checked all his folders in his mailbox and it is not recent items.  So it must be archiving items from alot older.  We just dont know what its archiving exactly.  The reporting and even certain SQL scripts I have only tell you volumes not types of items.

Thanks

[Rob_Wilcox1]

Gavin, you can of course do the report mode run, but your archiving reports will be already there, and will cover several days of running. They will show you most of the detail you require, I think.

[Gavin_Palmer1]

Hi Rob,

The reports are good for item counts and statistics, but do not cover actual message classes archived.  We need to see what types of message classes were archived in an archive run so we can identify what these unknown items are that have caused our Enterprise Vault to have such large volumes.

Thanks

[Gavin_Palmer1]

Ok now I am worried.  As a test I did a Run Now on a users mailbox in report mode.  The report came back and said it had archived 1048 items and that it had completed.

So I figured I run it in archiving and shortcut processing mode.  It is still running even after 3.5hrs!!  And whats worse is the task is reporting thus far it has archived 21200 items.  This user doesnt even have that many items in exchange.  How is this possible???

Something is scarily wrong in 10.0.4.  The whole system was running fine until we upgraded.  The user is also reporting that there is negligble.  The only change from an exchange mailbox perspective is that the calendar items have gone up from 227 to 627.

I need some assistance please.  I had this case raised as a priority 1 but was changed due to the engineer saying that the system just has to catch up.  Please see my screenshots attached covering this issue.

Thanks

[WiTSend]

It appears that it is possibly trying to archive the shortcuts.  This would account for the size, based on your report (~11KB) and the total number.  It would also account for why a significantly lower number was actually added to the vault from what it said it archived.  Can you provide screenshots of your archiving policy, and message types? 

[JesusWept3]

Any chance of seeing a dtrace of ArchiveTask with a run now of EV?
I would highly doubt that shortcuts are being archived unless something is removing the ArchivedDate and Transaction ID MAPI Properties

[rick_krieger]

Hello Gavin,

If all you have done is just upgraded from 10.0.3 to 10.0.4 and not made any policy changes or other changes to your enviornment then you should contact support (sounds like the case is still open) and raise these new concerns.

One thing to consider, is it possible that your archiving task was off for a while leading up to the upgrade and your system literally is just needing to catch up?

[Gavin_Palmer1]

Hi guys,

I have reopened this case and it is currently being worked on a a priority 1.  I have never come acros such a strange issue in the 5 years I have used Enterprise Vault.  The Engineer has done dtraces and is currently analysing them.  We have performed anoter run now to see how far it gets.  This was the engineers instruction.  To be honest he is as much stumped as I am.  In a dtrace log of ArchivingTask there are many lines concerning items that are "indicitive of a domino item.  We have never had Domino.

I have below a snippet of the log of the dtrace for anyone to analyse.  There are no errors in the event log and as far a the engineer is concrned here seems to be nothing wrong from a functional point of view.

Please see below:

1101780 15:53:26.497 [2632] (ArchiveTask) <2372> EV:M {CArchivingAgent::CheckIgnoreEVDatesSetting:#4769} Ignoring archived date and post-processed date on message

1101781 15:53:26.497 [2632] (ArchiveTask) <2372> EV:M {CArchivingAgent::CheckIgnoreEVDatesSetting:#4774} Ignoring restored date on message

1101782 15:53:26.497 [2632] (ArchiveTask) <2372> EV:L {GetCalculatedModifiedDate:#1172} Calculated date (dd/mm/yyyy): [16/09/2013 14:54.04] [PR_MESSAGE_DELIVERY_TIME]

1101783 15:53:26.497 [2632] (ArchiveTask) <2372> EV:L :CArchivingAgent::IsEligibleForArchive(/o=CDCGlobeleq/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Recipients/cn=Gary.Mitchem) |The message titled: RE: Server Not accessible after SSL  #751659 will not be archived as its inactivity period has not expired  |

1101784 15:53:26.497 [2632] (ArchiveTask) <2372> EV:M :CArchivingAgent::IsEligibleForArchive() |Exiting routine |

1101785 15:53:26.497 [2632] (ArchiveTask) <2372> EV:M :CArchivingAgent::IsEligibleForArchive() |Entering routine  |

1101786 15:53:26.497 [2632] (ArchiveTask) <2372> EV:L {MigratedDominoItems::IsMigratedDominoShortcut} (Entry)

1101787 15:53:26.497 [2632] (ArchiveTask) <2372> EV:L {PropsItem::HasShortcutProps:#149} Shortcut properties are not present (incorrect MAPI type; expecting PT_STRING8).

1101788 15:53:26.497 [2632] (ArchiveTask) <2372> EV:L {MigratedDominoItems::IsMigratedDominoShortcut:#198} Missing shortcut properties that are indicative of a migrated Domino shortcut.

1101789 15:53:26.497 [2632] (ArchiveTask) <2372> EV:L {MigratedDominoItems::IsMigratedDominoShortcut} (Exit) Status: [Success]

1101790 15:53:26.497 [2632] (ArchiveTask) <2372> EV:M {CArchivingAgent::CheckIgnoreEVDatesSetting:#4769} Ignoring archived date and post-processed date on message

1101791 15:53:26.497 [2632] (ArchiveTask) <2372> EV:M {CArchivingAgent::CheckIgnoreEVDatesSetting:#4774} Ignoring restored date on message

1101792 15:53:26.497 [2632] (ArchiveTask) <2372> EV:L {GetCalculatedModifiedDate:#1172} Calculated date (dd/mm/yyyy): [16/09/2013 14:47.24] [PR_MESSAGE_DELIVERY_TIME]

1101793 15:53:26.497 [2632] (ArchiveTask) <2372> EV:L :CArchivingAgent::IsEligibleForArchive(/o=CDCGlobeleq/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Recipients/cn=Gary.Mitchem) |The message titled: Re: U drive will not be archived as its inactivity period has not expired  |

1101794 15:53:26.497 [2632] (ArchiveTask) <2372> EV:M :CArchivingAgent::IsEligibleForArchive() |Exiting routine |

1101795 15:53:26.497 [2632] (ArchiveTask) <2372> EV:M :CArchivingAgent::IsEligibleForArchive() |Entering routine  |

1101796 15:53:26.497 [2632] (ArchiveTask) <2372> EV:L {MigratedDominoItems::IsMigratedDominoShortcut} (Entry)

[JesusWept3 · Accepted solution]

ah do you have IgnoreEVDates registry key per chance?

http://www.symantec.com/business/support/index?page=content&id=TECH76532

If so, set it to 0 or delete the key

[Rob_Wilcox1]

Those items in that snippet said they will not be archived... So were they?

[GertjanA]

Could it be the EV-shortcut(s) are somehow corrupted?

{MigratedDominoItems::IsMigratedDominoShortcut:#198} Missing shortcut properties that are indicative of a migrated Domino shortcut.

Missing shortcut properties would lead to some sort of troubleshooting in that way?

[Gavin_Palmer1]

JesusWept3,

I did in fact have this reg setting set to 3.  I had forgotten about this.  This was set in the beginning while I was doing the initial migration from Exchange 2007 and EV8 to Exchange 2010 and EV 10.0.3.  It hasnt impacted us thus far.  Do you perhaps know why this would be causing an issue now?

[Gavin_Palmer1]

JesusWept3, I have completed the test and it seems to have worked.  The users archiving job completed successfully.  This setting must have been making EV try and archive all the items even though they were shortcuts.  hence the error about DominoShortcut.  Thanks alot you are a legend JesusWept3!!!!!  I will continue testing with other users now, but I'm pretty sure this is now solved.

Cant believe it was something as simple as a character in regedit.

Cheers