Storage Delete generates Event ID 6578

[giuliod]

Hi,

Each time after setting/releasing backup mode on the vault stores I see a lot of 6578 event errors:

Log Name:      Symantec Enterprise Vault

Source:        Enterprise Vault 

Date:          12/15/2011 12:35:03 PM

Event ID:      6578

Task Category: Storage Delete

Level:         Error

Keywords:      Classic

User:          N/A

Computer:      ev.domain.local

Description:

Abnormal error occurred 

Object:    CRetentionCategoryCache 

Reference: RE(1)/fe 

Log Name:      Symantec Enterprise Vault

Source:        Enterprise Vault 

Date:          12/15/2011 12:35:03 PM

Event ID:      6578

Task Category: Storage Delete

Level:         Error

Keywords:      Classic

User:          N/A

Computer:      ev.domain.local

Description:

Abnormal error occurred 

Object:    CRetentionCategoryCache 

Reference: LE/RE 

I just found this http://www.symantec.com/business/support/index?page=content&id=TECH158365 but don't think they are connected. Any ideas?

Thanks.

[JesusWept3]

Well it doesn't help that the technote gives NO details at all as to whats causing the issue.
But the reason it happens after you come out of backup mode is EV is going through and processing items that its attempting to delete  but there is an issue with the item revolving around retention categories

The issue you have and the issue in the technote are absolutely identical and its fixed in EV10.

What version are you on at the moment?
If you're on EV9 do you think you might have plans to upgrade to EV10 at any point?

To be honest you are best off contacting support, reference ET2246454 and let them see what the fix is
Find out whether its fixed in any versions of EV9 , perhaps fixed in EV9 SP3 or do you HAVE to upgrade to 10? and if you can't upgrade to 10, see if you can make the case for getting a hotfix for EV9

[giuliod]

Thanks JesusWept. It's EV9 SP2 and not planning to upgrade to 10 in the nearest future. Maybe someone else is experiencing the same issue?

Update: just double-checked and it is not fixed in SP3

http://clientui-kb.symantec.com/kb/index?page=content&id=TECH147783&actp=search&viewlocale=en_US&sea...

[JesusWept3 · Accepted solution]

You're going to have to call support and ask for the hotfix or at least a workaround

[AKL]

I was wondering if you make use of Discovery accelarator in your environment for legal holds purpose?

Also - what is the retention categories applied to user mailboxes & if it allows user for deletion of items?

[giuliod]

Hi AKL. Yes, we are using DA. The retention is 5 years and we do not allow user to delete items. Any clues? Thanks.

[AKL]

If there are any legal holds applied on items that Enterprise vault is trying to delete due to passed retention of 5 years, the error can be generated due to same.

You can check details of Legal holds using Dbo.VaultInterest table under EnterpriseVaultDirectory database. Try below query perhaps:

Use EnterpriseVaultDirectory

Select A.ArchiveName, VI.VaultEntryID, VI.ConsumerDatabase, VI.ConsumerGUID from dbo.Archive A

JOIN dbo.Root R ON A.RootEntryID = R.RootEntryID

JOIN dbo.VaultInterest VI ON VI.VaultEntryID = R.VaultEntryID

where A.ArchiveName = '<name of user>' 

-- where A.ArchiveStatus != '1' (to find entries with legal holds for archives marked for deletions)

Might want to re-check query based on environment - I just made it over the air - without my lab in front..

[JesusWept3]

For what it's worth the vault interest table just signifies that a user is being searched on, it doesn't however mean they are part of an active legal hold, for that you would have to query the users vault store database and check the HoldSaveset table Also the issue is more likely than not that the deletion request isn passing across the retention category the item belongs to, have seen similar issues in other parts of the product around exchange managed folders and the retention applied to them Hate to sound like a stuck record but you really need to call support