cancel
Showing results for 
Search instead for 
Did you mean: 

User says they have missing items - how to prove or disprove?

Rem_y
Level 4

Hi folks, I have a user that claims they have missing items in their Archive Explorer. They have indicated to me there should be a folder (several actually) that can be seen in Outlook but which do not appear in AE. I've resync'd their index and checked SQL for items Awaiting Indexing - all looks good. I've checked the EV policies and it appears they don't have rights to delete items and there is no storage expiry set. Also, you can't delete folders from AE either. Does anyne have any advcie on how I could start troubleshooting this one?

6 REPLIES 6

nnguyen1
Level 3
Employee

What is your archiving policy set to?  Are you archiving after a period of time, say 6 months?  If so was this folder created before any items would be archived?  

You could run the following query on SQL against the vaultstore database.  You would need to set the ArchivePointID =  to the users archive id.  This will give you an output of all the folders and count of items archived per folder for that archive.  Do you see that folder in the output?

DECLARE @ArchivePointID Nvarchar(55)
SET @ArchivePointID = 'users archive'

SELECT
AP.ArchivePointId,
AP.ArchivePointIdentity,
Archive.ArchiveName,
ArchiveFolder.FolderName,
COUNT(*) as CountByFolder,
Vault.VaultID,
Vault.VaultIdentity,

Vault.ArchivedItems as VaultArchivedItems,
AP.ArchivedItems as APArchivedItems

FROM
EnterpriseVaultDirectory.dbo.root r1
LEFT JOIN EnterpriseVaultDirectory.dbo.Root r2 on r1.RootIdentity = r2.ContainerRootIdentity
JOIN EnterpriseVaultDirectory.dbo.Archive on r1.RootIdentity = archive.RootIdentity
LEFT JOIN EnterpriseVaultDirectory.dbo.ArchiveFolder on r2.RootIdentity = ArchiveFolder.RootIdentity
RIGHT JOIN Vault on r2.VaultEntryId = Vault.Vaultid
JOIN ArchivePoint AP on Vault.ArchivePointIdentity = AP.ArchivePointIdentity
JOIN Saveset on Vault.VaultIdentity = Saveset.VaultIdentity
WHERE
ArchivePointID = @ArchivePointID

GROUP BY
AP.ArchivePointId,
Archive.ArchiveName,
ArchiveFolder.FolderName,
AP.ArchivePointIdentity,
Vault.Vaultid,
Vault.VaultIdentity,
Vault.ArchivedItems,
AP.ArchivedItems

GertjanA
Moderator
Moderator
Partner    VIP    Accredited Certified

Hi, I recall having had something similar in a grey past. It turned out those folders were not your default Outlook folders, but (if I recall correct) something like 'shared folder'. The actual folder itself did not exist in the users mailbox, only a 'link' to the folder which reside somewhere else. Ask user for a screenshot of the folders he has in Outlook, and you should be able to see a different kind of foldericon. also,the query nnguen1 posted should assist in proving the folder is not in the archive. In addition to this, if the folder in the users Outlook contains shortcuts, you should be able to determine which archive these shortcuts sit in.

In Outlook, browse to that folder, select 1 archived item. Just select, do not open. Select the Enterprise Vault tab in Outlook. Press CTRL+SHIFT, keep pressed, click an Enterprise Vault icon (archive explorer as example) in the EV Tab. This pops up a window. Select something like item properties (not sure of naming anymore). this pops up a txt file with properties of the selected item. somewhere in there is a section called 'selected item properties'. Look for the ArchiveID field. Copy that. Open EV console, press CTRL+SHIFT again, RIGHTCLICK on Archives section. select 'find Archive/Folder'. Paste copied value. That should give the archive where the item sits. Verify it is not users archive.

Regards. Gertjan

CConsult
Moderator
Moderator
Partner    VIP   

Have you also checked the index for any missing items?

If there are no missing items and no items in queue its the mailserver most of the times,

or as gertjan said any special folders.

When do you archive the messages?

Could it be that mails are deleted/moved in the mailbox?

dcVAST
Level 5
Partner Accredited

Anything in JournalDelete? You could get Vault Information on some items in Outlook and then perform a dumpsaveset to see if they pull. Also search for them via Search.asp to see if they show up in the archive.

AlanBilham
Level 3
Partner

I once had a customer who complained about similar issues.  It turned out that they were carefully moving all their shortcuts to a local PST and then filing them into folders.  

Well that one took a bit of figuring out, so worth checking

Rem_y
Level 4

Thanks for the replies all -

Regards indexing - sync hasn't resolved anything, and I've checked SQL for Items Waiting Index backlog but nothing. I am going to do a rebuild as well but I think the indexing side is ok. The user has 3 archives logging on as one account and reports items missing in another archive, so there is potential for this being a PEBCAC. I've further checked SQL for the Archive Folder View is NULL. Have yet to try NNGuyen's query

"What is your archiving policy set to?  Are you archiving after a period of time, say 6 months?  If so was this folder created before any items would be archived?"

This user was part of a PST migration recently so we can still look at legacy PSTs for evidence of the content, so I'll update this post once I know more.

"Anything in JournalDelete? You could get Vault Information on some items in Outlook and then perform a dumpsaveset to see if they pull. Also search for them via Search.asp to see if they show up in the archive"

I checked the config for the possability of deletions or expiry as a problem source, but the policy is No User Deletes, so I think that either the fodlers didn't get to Ev in the first place for the index is at fault, which the subsequent Rebuild should rule out

"I once had a customer who complained about similar issues.  It turned out that they were carefully moving all their shortcuts to a local PST and then filing them into folders"

Good point, although I should still be able to se the folder/s they are referring to even if the items were missing from the folders because of this or another user action

Thanks for the help, and I'll update the post again once I have more information or the solution