When Enterprise Vault encounters a corrupt message during an archive run a 3288 event is logged and archiving stops.

[jpergola329]

hello,

im getting alot of corrupt messages not sure yet whats causing it.

i found this article on the issue, is this a good solution, has anyone else ran into this? any other ideas or fixes i can do?

thanks

http://www.symantec.com/business/support/index?page=content&id=TECH78546

[TonySterling]

What version EV?

Setting the registry key seems the easiest fix.

Solution 1: This is the default behavior and prior to Enterprise Vault version 8.0 the only workaround was to "Set Failed message to 'Do Not Archive'" in the Exchange Mailbox Policy (see Related Articles).

From version 8.0, Enterprise Vault can be configured to continue the current archive run when a corrupt message is encountered by implementing a registry key.

1.  Open REGEDIT and browse to the following location:

HKEY_LOCAL_MACHINE\SOFTWARE\KVS\Enterprise Vault\Agents  ( 32 bit)

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\KVS\Enterprise Vault\Agents  (64 bit)

2.  Click Edit - New - DWORD Value

3.  Rename the new value ContinueOnMissingItemErrors.

4.  Set the value data to a non-zero value.

5.  Restart the Enterprise Vault services.

Do the corrupted messages have anything in common?  Can you drag it from Outlook to the Desktop?

[jpergola329]

ev 8 sp3

nothing in common with the messages, all different users, different content.

[TonySterling · Accepted solution]

So this article suggest it could be caused by filtering software.  Do you use something like that?

Items indicated in the Event ID 3250 and/or Event ID 3288 cannot be archived because the item is corrupt in some form. This is typically due to NULL terminated strings in the PGP signature. This is usually caused by some type of filtering software (spam, antivirus, etc.).

Event ID: 3250 and/or 3288 The following message could not be archived as it may be corrupt.

Article:TECH57396

|

Created: 2008-01-06

|

Updated: 2014-02-27

|

Article URL http://www.symantec.com/docs/TECH57396

 Also, any reason you haven't upgraded to at least EV 9?

[jpergola329]

tony,

do you mean AV running on the EV Server? yes we do.

spam, we use the cisco ironports in the dmz? locally we do not have an additional spam filtering running.

upgrading??

thats been the ? for a while, the EV product is not well liked in the enviromnet. i dont think it was implimented correctly and not managed correctly, and i just took it over so my lack of knowledge of the product is frustrating too.

were not sure if we are going to keep it or not.

if anything well go up to the lates service pack for EV8 which i beleiev is sp5.

thanks

[TonySterling]

That can be a struggle to take over an environment that a.) wasn't well planned and b.) wasn't upkept.  If you want I can point you to a few partners that might be able to get you a health check and knowledge transfer to help you along the way.

EV may not be well liked but not taking care of it will only make it worse.