11-07-2012 04:04 AM
Hi guys,
On a system running EV 10.0.2 seeing a few of these events. What if any action is required?
Any specific EVSVR option to resolve them?
>>
An invalid SIS part was encountered while doing watch file scan. Following further information is available.
Partition Name = xxx
VaultStoreEntryId = 1BE7981FBEAE73F45AD58F87D091A885E1210000KVSEV.xxx
ParentTransactionID = 802B959A2F979A17668CCE24343091D1
Invalid Reason = Verification failed for sis part when post processing Saveset with TID = [603FE5801B5FC4D43FAD6ECF88DA61A1].
Following item details are available:
Mailbox = [xxx]
Subject = [xxx]
Original Location = [Inbox]
Following sis part details are available:
FPDistinctionByte = [255]
FPHashPart1 = [-938829753]
UniqueId = [0].
<<
TIA
D
Solved! Go to Solution.
11-12-2012 06:49 AM
Hey I don't know whether you have resolved this issue or still seeing it, but check this post from Tony which mentions the issue that you might actually be seeing as a bug
https://www-secure.symantec.com/connect/forums/invalid-sis-part#comment-7862251
11-07-2012 05:42 AM
probably best to do a full verify of items on that particular date range, o close to the minute as you can.
It could just be a corrupt file or it could be something more serious such as anti virus deleting files etc
Have also seen this in environmens where the fingerprint transaction log grows to 100% and can't grow anymore and it causes lots of issues with false positive fingerprints being created
11-07-2012 05:52 AM
Hi JW,
Definitely no AV on the storage device which is a remote CIFS share.
SQL Transaction logs may well have filled at various points in the past.
Could you advise specific EVSVR repair option to resolve?
Can of course ignore them...
11-07-2012 07:25 AM
So what I would do is the following
1. Log on to the EV server
2. Open a command prompt and CD to your EV installation directory
3. Type EVSVR and press enter
4. Type Edit and press enter
5. Uncheck "Process All Vault Store Groups"
6. Uncheck "Process All Vault Stores"
7. Uncheck "Process All Vault Store Partitions"
8. Uncheck "Process All Archives"
9. In the archive box, choose the Mailbox that was reported in the event
10. Narrow down the users vault store group, vault store and the active partition
11. Set the Date Range to be as close to those events as possible
12. Change Operation to be Verify
13. Change Option to be Complete
14. Save the EVSR and then run it from the evsvr console
11-07-2012 09:04 AM
Yes, I've already run Verify option. Question is which Repair option will address this event? If Any?
NB Verify does report various "unable to complete retrieval request" events on Savesets within the date range.
11-07-2012 10:48 AM
OK so you know repair is going to remove them right?
but the option you want is Repair -> DeleteSurplusReferences.
However what i am unsure of is if it will delete an item where the DVS exists but the DVSSP is missing.
I think it will only do a delete from the database when the DVS/DVSCC/DVSPP are all missing together.
What you may end up just having to do is use the blacklist SISPart repair option
11-12-2012 06:49 AM
Hey I don't know whether you have resolved this issue or still seeing it, but check this post from Tony which mentions the issue that you might actually be seeing as a bug
https://www-secure.symantec.com/connect/forums/invalid-sis-part#comment-7862251
11-19-2012 03:39 AM
Hi JW,
Was out of the office last week.
Yes, for pre 2007 items this is the bug noted and hopefully to be fixed by 10.0.3 due shortly.
There was one date range post 2007 where inconsistencies did exist and this was resolved with EVSVER repair database linkages and other options under guidance from Symantec support.
Thanks
D