Unexpected behavior while archiving exchange-emails

[armacoma]

We are testing exchange-archiving on an Enterprisevault 10 Server and we are experiencing unexpected behavior with this.

Our mailbox-policy uses the archiving strategy "Based on age" and the strategy value (Archive items when they are older than) is set to one month.

After archiving, there are some mails moved to the archive, but others which meet the archive credentials are left by Enterprisevault.
There is no consistency of the kind of messages not beeing archived. It's like a coincidence what's done with the mails in the box.

Unfortunately there are no messages in the eventlog indicating a problem.

Can anyone help us out?

[Percy_Vere]

I suggest you perform a dtrace of the archive tasjk fior one mailbox and that will tell you message by message why the item is not archived. To do the Dtrace:

Select to highlight the required EV Server in the left pane
From the top level menu, select Tool \ Advanced Features, this will allow you to view the 'Traces' option under the EV server
Right click Traces and select New - Trace to begin the wizard.
Select the relevant Category of Trace (Mailbox Archiving Issues - Exchange) and complete wizard to enable trace logging.

http://support.veritas.com/docs/276120 - Dtrace Guidelines

Post here if you like.

[MarkBarefoot]

Are these emails all "original"? As in never been archived before, subsequently restored etc, as that can have a bearing.

Worth doing what Percy says, it will at least tell you the eligibilty testing.

[armacoma]

Thank you for the reply. I'll trace it using dtrace as mentioned.

I'll let you know the result.

Andy

[JesusWept3]

Also is this from scheduled archiving or on Run Nows? It could be the Messages Per Pass which is set by default So when the arching schedule first kicks off, it pushes every enabled user in to the exchange archiving tasks A5 queue, the task then goes through (usually 5 at a time by default) and connects to each mailbox and finds messages to archive, moved shortcuts and such To keep things moving there is a Messages per pass setting, so by default it's set to 1000 email, after archiving 1000 email it then moves on to the next mailbox and so on and so forth until the A5 queue is cleared or until the archiving schedule ends, if it is clear and time is left in the schedule, it will requeue users who still had items to archive, and it will keep requesting users until its all complete or the Schedule runs out So it could be something like schedule is too short, messages per pass too high, too many users on the exchange server, or as suggested it could be that items not being archived were previously restored in which case EV will not rearchive them until certain time has passed Other than that could be something like the wrong message class, read vs unread, do not archive has been set on an item etc, but only the DTrace will tell you that for definite

[armacoma]

This is a test phase. The schedule is stopped and we are archiving manually: "RUN NOW" in normal mode. At this time, we are archiving 3 small mailboxes, that's all. In this case, the queue should be able to process all items. But for instance, we are unsure if actually archived items are from a previous archiving run. In between the customer did changes to the configuration... It's quite possibe, that items do not archive "anymore"... to check this out, we are attaching another mailbox and try it with the new one...

The dtrace has listed all allready archived items (Shortcutcreation), but failed items are not listed in the (verbose) log. There could be another issue (error message) in the log, but i didn't find it until now.

Andy

[Maverik]

http://www.symantec.com/docs/HOWTO42224

Does this technote assist with understanding the logic?  You can use tools like Outlook Spy and MFCMAPI to view message MAPI attributes that are mentioned in the article.  

If you see in the dtrace that the item is ineligable for archiving this is usually the reason why. 

[Prone2Typos · Accepted solution]

The DTrace should help a lot.

It may also be worth your while to run a report prior to the archive run and after the archive run to compare the results and see if what was archived was expected. There is a great TN on how to read the not-too-intuitive archive report that is generated.

Also do you have a backlog in your queues at all? For a run now you should see entries when you select to archive against all users . KeyPlayers recommendation to use Outlook Spy is helpful but you did mention that you are not seeing references to the problematic messages at all....so that would make me think it is not yet hitting them .

I would also check your Exchange Event logs.  A lot of times I see issues on Exchange that are not obvious at any other time until EV is implemented. 9646 events come to mind when considering this . . .but there are others as well.

Hope this helps.

J