Unable to retrieve archived item from Virtual Vault

[cmarkovits]

Hello, I have a customer who is attempting to retrieve several items from thier Virtual Vault.  Most items are returned properly, however there are also a considerable number that return the following error:

Enterprise Vault is unable to retrieve this archived item.
There was a problem opening this item. Try again later.

The first line of the email body does show up properly in the preview pane in Outlook.  However dobule clicking the message for retrieval produces the error listed above.  If the customer opens the message through the Search Vault cleint then it is returned without error so we are reasonably certain this issue is specific to this customers Virtual Vault.  The client is an XP SP3 client running Outlook 2007 SP.  The EV client is the 9.0.0.1193.0 DCOM client configured for "HTTP-only" via policy.

We turned up the EV_Cleint log to Informational (including Virtual Vault) and it appears that ther pertinent portion of the log would be as follows.  Any ideas why the customer can open some items, but not others, yet everything seems to be retrievable from the customers online vault?

 ...
17/11/2010 19:02:51.893[2524]: HDR:SCHED: Seconds to next sync:77218
17/11/2010 19:02:53.173[1168]: EVMSP: <EVMSP-20101117-190244-327> [EVMSP::MSProviderInit] mapiVer: 0x00010010
17/11/2010 19:02:53.519[5144]: EVMSP: <EVMSP-20101117-190244-327> [EVMSP::MSProviderInit] mapiVer: 0x00010010
17/11/2010 19:02:58.058[1552]: CONTENT:STORE: [Offline Config] Maximum Store Size (MB): 11264
17/11/2010 19:02:58.101[1552]: CONTENT:STORE: ERROR :- Setting status of file to INVALID
17/11/2010 19:02:58.103[1552]: CONTENT:STORE:          Filename is 'C:\Documents and Settings\USER_NAME\Local Settings\Application Data\KVS\Enterprise Vault\6E72F0963552D211933700805FA7C28E\error.db'
17/11/2010 19:02:58.107[1552]: CONTENT:STORE:          Current status of DB is '4'
17/11/2010 19:02:58.111[1552]: CONTENT:STORE: ERROR :- Setting status of file to INVALID
17/11/2010 19:02:58.113[1552]: CONTENT:STORE:          Filename is 'C:\Documents and Settings\USER_NAME\Local Settings\Application Data\KVS\Enterprise Vault\6E72F0963552D211933700805FA7C28E\error.db'
17/11/2010 19:02:58.119[1552]: CONTENT:STORE:          Current status of DB is '4'
17/11/2010 19:02:58.123[1552]: CONTENT:STORE: ERROR :- Setting status of file to INVALID
17/11/2010 19:02:58.125[1552]: CONTENT:STORE:          Filename is 'C:\Documents and Settings\USER_NAME\Local Settings\Application Data\KVS\Enterprise Vault\6E72F0963552D211933700805FA7C28E\error.db'
17/11/2010 19:02:58.129[1552]: CONTENT:STORE:          Current status of DB is '4'
17/11/2010 19:02:58.133[1552]: CONTENT:STORE: ERROR :- Setting status of file to INVALID
17/11/2010 19:02:58.135[1552]: CONTENT:STORE:          Filename is 'C:\Documents and Settings\USER_NAME\Local Settings\Application Data\KVS\Enterprise Vault\6E72F0963552D211933700805FA7C28E\error.db'
17/11/2010 19:02:58.140[1552]: CONTENT:STORE:          Current status of DB is '4'
17/11/2010 19:02:58.144[1552]: CONTENT:STORE: ERROR :- Setting status of file to INVALID
17/11/2010 19:02:58.146[1552]: CONTENT:STORE:          Filename is 'C:\Documents and Settings\USER_NAME\Local Settings\Application Data\KVS\Enterprise Vault\6E72F0963552D211933700805FA7C28E\error.db'
17/11/2010 19:02:58.150[1552]: CONTENT:STORE:          Current status of DB is '4'
17/11/2010 19:02:58.154[1552]: CONTENT:STORE: ERROR :- Setting status of file to INVALID
17/11/2010 19:02:58.157[1552]: CONTENT:STORE:          Filename is 'C:\Documents and Settings\USER_NAME\Local Settings\Application Data\KVS\Enterprise Vault\6E72F0963552D211933700805FA7C28E\error.db'
17/11/2010 19:02:58.161[1552]: CONTENT:STORE:          Current status of DB is '4'
17/11/2010 19:02:58.167[1552]: CONTENT:STORE: ERROR :- Setting status of file to INVALID
17/11/2010 19:02:58.169[1552]: CONTENT:STORE:          Filename is 'C:\Documents and Settings\USER_NAME\Local Settings\Application Data\KVS\Enterprise Vault\6E72F0963552D211933700805FA7C28E\error.db'
17/11/2010 19:02:58.173[1552]: CONTENT:STORE:          Current status of DB is '4'
17/11/2010 19:03:00.429[5448]: EVMSP: <Acrobat Special pricing for DOE thru 31 August 2010> [Common::GetLastError] Returning text: Your changes could not be saved.

You cannot modify the properties of items within your Virtual Vault.
17/11/2010 19:03:06.406[5448]: EVMSP: <Adobe Reader, versions> [Common::GetLastError] Returning text: Your changes could not be saved.

You cannot modify the properties of items within your Virtual Vault.
17/11/2010 19:03:07.437[5692]: A COM error occurred: 0x80040201
17/11/2010 19:03:07.439[5448]: EVMSP: <Adobe> [Common::GetFullItem] Failed to obtain message from the CC: A COM error exception has been caught:80040201
17/11/2010 19:03:07.443[5448]: EVMSP: <Adobe> [Common::GetFullItem] Reason for stub: 3
17/11/2010 19:03:07.455[5448]: EVMSP: <Adobe purchases> [Common::GetLastError] Returning text: Your changes could not be saved.

You cannot modify the properties of items within your Virtual Vault.
17/11/2010 19:03:07.578[5692]: A COM error occurred: 0x80040201
17/11/2010 19:03:07.579[5448]: EVMSP: <MSLogon> [Common::GetFullItem] Failed to obtain message from the CC: A COM error exception has been caught:80040201
17/11/2010 19:03:07.583[5448]: EVMSP: <MSLogon> [Common::GetFullItem] Reason for stub: 3
17/11/2010 19:03:07.588[5448]: EVMSP: <Adobe purchases> [Common::GetLastError] Returning text: Your changes could not be saved.

You cannot modify the properties of items within your Virtual Vault.
17/11/2010 19:03:07.593[5448]: EVMSP: <Adobe purchases> [Common::GetLastError] Last error was NoAccess which can have multiple reasons many of which are quite normal for the EVMSP ranging from policy denying writable operations to the fact that archived items cannot be modified. If necessary, check more detailed EVMSP logging for the actual reason that the error was returned to the caller.
17/11/2010 19:03:07.602[5448]: EVMSP: <Adobe purchases> [Common::GetLastError] Returning text: You do not have permission to perform this Enterprise Vault operation.
17/11/2010 19:03:07.622[5692]: A COM error occurred: 0x80040201
17/11/2010 19:03:07.624[5448]: EVMSP: <MSLogon> [Common::GetFullItem] Failed to obtain message from the CC: A COM error exception has been caught:80040201
17/11/2010 19:03:07.628[5448]: EVMSP: <MSLogon> [Common::GetFullItem] Reason for stub: 3
17/11/2010 19:03:07.633[5448]: EVMSP: <Adobe purchases> [Common::GetLastError] Returning text: Your changes could not be saved.

You cannot modify the properties of items within your Virtual Vault.
17/11/2010 19:03:07.638[5448]: EVMSP: <Adobe purchases> [Common::GetLastError] Last error was NoAccess which can have multiple reasons many of which are quite normal for the EVMSP ranging from policy denying writable operations to the fact that archived items cannot be modified. If necessary, check more detailed EVMSP logging for the actual reason that the error was returned to the caller.
17/11/2010 19:03:07.647[5448]: EVMSP: <Adobe purchases> [Common::GetLastError] Returning text: You do not have permission to perform this Enterprise Vault operation.
17/11/2010 19:03:07.667[5692]: A COM error occurred: 0x80040201
17/11/2010 19:03:07.669[5448]: EVMSP: <MSLogon> [Common::GetFullItem] Failed to obtain message from the CC: A COM error exception has been caught:80040201
17/11/2010 19:03:07.673[5448]: EVMSP: <MSLogon> [Common::GetFullItem] Reason for stub: 3
17/11/2010 19:03:07.679[5448]: EVMSP: <Adobe purchases> [Common::GetLastError] Returning text: Your changes could not be saved.

You cannot modify the properties of items within your Virtual Vault.
17/11/2010 19:03:07.683[5448]: EVMSP: <Adobe purchases> [Common::GetLastError] Last error was NoAccess which can have multiple reasons many of which are quite normal for the EVMSP ranging from policy denying writable operations to the fact that archived items cannot be modified. If necessary, check more detailed EVMSP logging for the actual reason that the error was returned to the caller.
17/11/2010 19:03:07.692[5448]: EVMSP: <Adobe purchases> [Common::GetLastError] Returning text: You do not have permission to perform this Enterprise Vault operation.
17/11/2010 19:03:09.761[ 920]:
17/11/2010 19:03:14.083[5692]: A COM error occurred: 0x80040201
17/11/2010 19:03:14.085[5448]: EVMSP: <MSLogon> [Common::GetFullItem] Failed to obtain message from the CC: A COM error exception has been caught:80040201
17/11/2010 19:03:14.089[5448]: EVMSP: <MSLogon> [Common::GetFullItem] Reason for stub: 3
17/11/2010 19:03:14.094[5448]: EVMSP: <Adobe purchases> [Common::GetLastError] Returning text: Your changes could not be saved.

You cannot modify the properties of items within your Virtual Vault.
17/11/2010 19:03:14.099[5448]: EVMSP: <Adobe purchases> [Common::GetLastError] Last error was NoAccess which can have multiple reasons many of which are quite normal for the EVMSP ranging from policy denying writable operations to the fact that archived items cannot be modified. If necessary, check more detailed EVMSP logging for the actual reason that the error was returned to the caller.
17/11/2010 19:03:14.108[5448]: EVMSP: <Adobe purchases> [Common::GetLastError] Returning text: You do not have permission to perform this Enterprise Vault operation.
17/11/2010 19:03:14.131[5692]: A COM error occurred: 0x80040201
17/11/2010 19:03:14.132[5448]: EVMSP: <MSLogon> [Common::GetFullItem] Failed to obtain message from the CC: A COM error exception has been caught:80040201
17/11/2010 19:03:14.136[5448]: EVMSP: <MSLogon> [Common::GetFullItem] Reason for stub: 3
17/11/2010 19:03:14.141[5448]: EVMSP: <Adobe purchases> [Common::GetLastError] Returning text: Your changes could not be saved.

You cannot modify the properties of items within your Virtual Vault.
17/11/2010 19:03:14.146[5448]: EVMSP: <Adobe purchases> [Common::GetLastError] Last error was NoAccess which can have multiple reasons many of which are quite normal for the EVMSP ranging from policy denying writable operations to the fact that archived items cannot be modified. If necessary, check more detailed EVMSP logging for the actual reason that the error was returned to the caller.
17/11/2010 19:03:14.155[5448]: EVMSP: <Adobe purchases> [Common::GetLastError] Returning text: You do not have permission to perform this Enterprise Vault operation.
17/11/2010 19:03:14.177[5692]: A COM error occurred: 0x80040201
17/11/2010 19:03:14.179[5448]: EVMSP: <MSLogon> [Common::GetFullItem] Failed to obtain message from the CC: A COM error exception has been caught:80040201
17/11/2010 19:03:14.183[5448]: EVMSP: <MSLogon> [Common::GetFullItem] Reason for stub: 3
17/11/2010 19:03:14.188[5448]: EVMSP: <Adobe purchases> [Common::GetLastError] Returning text: Your changes could not be saved.

You cannot modify the properties of items within your Virtual Vault.
17/11/2010 19:03:14.193[5448]: EVMSP: <Adobe purchases> [Common::GetLastError] Last error was NoAccess which can have multiple reasons many of which are quite normal for the EVMSP ranging from policy denying writable operations to the fact that archived items cannot be modified. If necessary, check more detailed EVMSP logging for the actual reason that the error was returned to the caller.
17/11/2010 19:03:14.203[5448]: EVMSP: <Adobe purchases> [Common::GetLastError] Returning text: You do not have permission to perform this Enterprise Vault operation.
17/11/2010 19:03:15.991[5448]: Exchange connection state: 1  

Corey

[JesusWept3]

OK So the error is 0x80040201 (MAPI_E_UNKNOWN_ENTRYID)

however is error.db correct or did you rename that?
It sounds like either the DB is corrupt, or cannot be found/doesn't exist

 

[cmarkovits]

No, the error.db was not renamed - that is verbatium from the log.  I did rename the username (as I am sure you realized) to sanitize the log somewhat.

I did see the error.db / corrupt entry, but had a hard time believing it was really corrupt becasue if that was the case then how come almost all of the items come back just fine, but only a handful don't?

Is performing  a Partial or Full Reset of the client cache the best way to go, and if so, which one would you recommend?  Thanks!

Corey

[cmarkovits]

Qucik question that just occurect to me, is this an file that possibly we should be specifically excluding from Anti-Virus clients?  I know that there are best-practice recommendations for what not to scan on the servers side, but I am not aware of any recommendations of what not to scan on the client side...

[JesusWept3]

well this is the thing, the Vault Cache and Virtual Vault are actually made up of multiple PST files. the main one is the *.MDC file which has the directory structure and preview of the items that populate the view in Outlook

Then after that you have multiple DB files split out by date range, for instance i have about 20 of them so if you retrieve multiple items its possible that each one restores from a completely different DB or PST file.

What i find odd (or to be fair i just havent seen it before) is a DB File called "Error.db" but eitherway the logging is pretty much telling you its corrupt, to which the reset should resolve the issue

Maybe RichardG or Rob Wilcox can shed some light on the error.db but this is the first i've heard of it

[JesusWept3]

i would actually recommend disabling the virus scanner from scanning it, but it shouldnt really make that much of a difference since the PST files come down in chunks from the EV Server

it can't hurt to try though

[cmarkovits]

OK, we will try a Partial reset first, followed by a Full reset if the Partial doesn't work and then follow up on this thread with the results.  As for the AV, I'd like to hear what Rob Wilcox or RichardG have to offer (presuming they see / opt to this thread).  If I don't hear back, I'll look in to opening a support case and see if I can get an offical recommendation.  Thanks JesusWept2!

[Rob_Wilcox1]

From a *brief* look at our internal systems the problem may like with the databaselist.ini file, and it might be corrupt/unreadable... or basically bad.  That means that instead of listing the "real" .db filename the default of "error" is used -- I have no idea why the default is error, I've not looked at the code (yet).

So...  I would ensure that the folder is excluded from antivirus scanning (on demand and scheduled) and in addition if the antivirus is Outlook-aware, try also turning that off (temporarily) so that when Outlook / EV Addin opens the .db file, the antivirus engine doesn't try to scan the .db file, and possibly corrupting it.

After you've sorted out the antivirus .. do a full reset, and wait a while.

Once it's all done, check on disk .. what files do you have?  You should a bunch of .db files, an .mdc file and a databaselist.ini file at least.

If possible at this point, restart Outlook, and test.. and post a full client log.

I would be 98.4% sure it's something environmental.. and antivirus seems like a likely candidate to "blame" for the moment :)

[cmarkovits · Accepted solution]

All, we actually tried a partial reset, however that didn't work so we initiated a Full Reset before we had seen Rob Wilcox's response above, so we obviously weren't able to try that path of advice.  Regardless, the customer is reporting that a partial reset did apparently resolve the issue.

With regards to the recommendation to exclude the certain folders from scanning, I did some digging and found the following article which has some recommendations on what should be excluded from scanning.

http://www.symantec.com/business/support/index?page=content&id=TECH48856&actp=search&viewlocale=en_U...

Thanks!

Corey