Enterprise Vault useful SQL queries
I have worked some time on EV and due to encountering many issues which were hidden from day to day system checks we developed some interesting and useful SQL queries which when used can keep you better informed on whats going on with your EV environment This is just a sample of some of the more useful queries we use regularly
Troubleshooting a mailbox that will not archive in Enterprise Vault
One of the most common questions asked by Enterprise Vault administrators on the Symantec Connect forums is: “Why does this mailbox not get archived?”. There are many different reasons why the mailbox may not be archiving, and in this article we'll go through several of them.
How long will my index take to rebuild?
One of the more common questions when administering Enterprise Vault and dealing with indexes, is just how long will an index take to rebuild? Unfortunately with this question, it becomes like any thing else, what are the specs of the servers? What kind of storage and network do you have?
Archiving Exchange Server 2013 with Enterprise Vault 10
Hello all, In this article I want to cover the steps of configuring Enterprise Vault for Exchange Server 2013 archiving. In fact I prepared a personal configuration guide and I want to share it. If you have any recommendation, it would be nice for me to update the guide. Anyway, let`s rock :) Firstly I want to explain my test environment.How to open an archived item
Opening an Exchange/Outlook email which has been archived by Enterprise Vault might to some people seem like the simplest of things to do in the entire universe, with Enterprise Vault. There are a number of different things at play though, so in this article I will describe several ways that archived items can be opened, and what might be 'different' in each situation/case. - Double click This is the classic way to open an archived item, provided of course the archived item in the mailbox got replaced by a shortcut. With the introduction and adoption of things like Virtual Vault it is now not 110% of the time that shortcuts get created. Needless to say double clicking on a shortcut in Outlook is quite likely to be the most natural way that people open archived items. It's not the only way that you can double click on an item though - you can do this in OWA, Windows Explorer (via searching with Windows Search), Office 2011 for Mac, and more! Double click is almost everywhere because of the different extensions, or add-ins, that Enterprise Vault provides. These add-ins and extensions intercept or enhance the functionality, and, in most cases, handle the retrieval of the 'full' item based on information in the shortcut. - Forward an archived item If you click on a shortcut, and then click on 'Forward', the Enterprise Vault Outlook Add-in will retrieve the item, and put it in the message that is being forwarded. This is important because you may be forwarding the mail to someone who is inside your organisation, but not an Enterprise Vault user, or someome outside your organisation. Like the 'double click' description above, it is also possible to invoke this type of opening of an item from other applications other than Outlook - again all made possible by add-ins and extensions which come with Enterprise Vault? - Search and open The Enterprise Vault Outlook Add-in has an 'integrated' search feature which lets end users search archived items. The result list is just a snippet of the email, and when you've located the one that you think you want to see more of, you will single click the link, and the full item will be retrieved and displayed. This, I would call, is 'Search and open'. It's quite common if you're looking for something that is old, and archived. For example if you know that everything over 6 months old is archived, then searching for something is the best way to try to find it - and it doesn't rely on the shortcut being in the mailbox, because the search takes place against the archive, on the server, with the result list returned to the end-user. - Browser Search and open Some end-users prefer to use Browser Search, perhaps because it has more powerful searching and filtering possibilities. Just like the 'integrated' search I mentioned just now when you look at the list of results, you have the option to click one of them and see them, and there is a 'view original item' link which will open the full original item for you. - Archive Explorer and open Another way that people open an archived item is to use Archive Explorer. This is an inbox/mailbox type interface in to your archived items, and, when you double click on an item in Archive Explorer it will be retrieved for the end-user. There are also options relating to the right clicking of an item, and being able to move or copy an item to a folder in the mailbox - this will also cause a retrieval. - Virtual Vault Virtual Vault is used by many people, and depending on the policy settings, opening an item from inside Virtual Vault will result in the item being retrieved and displayed to the user. If the item is already in the content cache, ie vault cache, then the item will be retrieved from vault cache, ie local disk, rather than downloading the item from the Enterprise Vault server. - Vault Cache Very similar to the above description is opening an item from Vault Cache. This doesn't have to be from inside Outlook though, it can be from the 'start' menu in Windows 7 for example. What happens with regards to Vault Cache and Virtual Vault comes about from various policy settings, which I won't get into in this article. Needless to say you'll either have 'all' the archived content, or none, or storing-opened-items. This last one is quite interesting. What it means is that initially nothing is stored locally, there is only the MDC file (the virtual vault, aka metadata cache). When an item is retrieved, it is stored locally, not thrown away. This means that if the same item is retrieved again, via another double click, even several days/weeks later, the item will then come from vault cache, rather than from the Enterprise Vault server. It's an interesting policy to consider. Many hats As you can see opening an archived email can take many many different forms. There is no 'right' or 'wrong' way in my mind, but users may or may not know about the different possibilities. In fact, you might find that users don't know about many of these different options -- perhaps you can help educate them by having training sessions highlighting some of these possibilities? These different ways of opening archived items are made possible by various 'extensions' to Enterprise Vault; either the Enterprise Vault Outlook Add-in, the OWA Add-in, Mac Add-in, and so on. If you don't have all these installed and configured then some of these options aren't going to be available to your end-users. Have you encountered an odd twist in the listed items? Have I missed any out? Let me know in the comments below...
Selective Journaling with Enterprise Vault
Introduction Message journaling is a crucial aspect of Enterprise Vault. It builds on top of Microsoft Exchange’s journaling features and effectively means that all items to/from your organisation end up in a journal archive for retention, and discovery. But… There is a but!How to remove an EV Server from your site
How to remove an EV Server from your site There may come a time where you want to decommission or remove an EV Server from your environment. This has come up a few times on the Forum so I decided to document the steps to help you avoid the pitfalls of not doing it correctly. Before doing anything BACKUP ALL EV DATABASES!!How collections and sparse collections work
One feature of Enterprise Vault is the use of Collections, where Enterprise Vault will collect multiple items into a Collection which is a Microsoft Cabinet (CAB) file. The main use for doing this is to help with backup times. For instance if you have 1 x 10MB cab file, this will backup quicker than say 100 x 10KB files, one thing to note however, is that the CAB files are not compressed, meaning that if you extract a 10MB CAB file, it will result in 10MB of DVS Files. The reason for this is that DVS files are already highly compressed, and when you attempt to compress something that’s already compressed, it results in a bigger file. Enterprise Vault Collections are configured on the Collections tab, where you can figure when the collections run, how big the CAB files can be, and how old the items have to be before they can be collected in to a CAB file. Note that when you enable Collections, you cannot disable them. The best you can do is either make the age of the files to collect so old that nothing would get archived, or you can limit the amount of time that the collections process can run (i.e setting the start AND end time to be at 11:00AM). A word of caution on the second method though, when an item is retrieved from a CAB file, it is put in its original location and named as an ARCHDVS (or ARCHDVSSP, ARCHDVSCC etc on EV8(, those files are not automatically deleted after the user has finished reading the email. Instead, it is the Collections process itself that goes behind and deletes the ARCHDVSxx files after a certain period of time, if the collections period is set too short or has 0 seconds to run, then then archdvs files cannot be cleaned up and you will end up duplicating space unnecessarily. Where are CAB Files stored? Collections themselves are stored in different places dependent on your version of Enterprise Vault. Enterprise Vault 2007 and below: The following folder structure is used to store DVS files, and the Collections are placed in the “Day” folder. Files are stored in a yyyy\mm\dd\hh format. For example E:\Enterprise Vault Stores\Journal Vault\ptn1\2010\01\30\17\<saveset>.dvs The above would symbolize an item archived at 5pm on 30 th January 2010 The CAB files are stored in the \dd\ section..so it may look like E:\Enterprise Vault Stores\Journal Vault\ptn1\2010\01\30\Collection12345.cab In Enterprise Vault 8 however, the locations are stored in a little different format. it stores it in \yyyy\mm-dd\LETTER Example: E:\Enterprise Vault Stores\Journal Vault\2010\01-11\A\074\<saveset>.dvs The above would suggest an item is archived on 11 th January 2010. However rather than storing in an additional hour folder as it used to in EV2007, it now uses parts of the file name of the DVS. In this example we have a file name called A07465CEEC2320A040210B08E3549781.DVS, the name is based on the Transaction ID assigned to the item, it takes the first letter of the transaction ID (A) and then creates folders that use the next three numbers or letters of the transaction ID. Another example, if an item called 107DC3824ADB33CDABCE5C15B7B46BD1.DVS and it was archived on January 11 th 2010, it would be located in the following location: E:\Enterprise Vault Stores\Journal Vault\2010\01-11\1\07D On Enterprise Vault collection files are stored in the first letter of the transaction id’s location. For instance the collection file may be stored here E:\Enterprise Vault Stores\Journal Vault\2010\01-11\1\Collection12345.cab What happens when I delete an item or run storage expiry? When items are added to a CAB file, they will remain there until a process called Sparse Collections is run, which involves extracting valid savesets and then deleting the cab, those savesets are then re-collected at a later date. When an item is deleted, Enterprise Vault simply cannot delete an item with in a CAB file (this actually applies to any compressed file such as ZIP or RAR) therefor you get in to a situation where items are deleted from the Databases and indexes, but still remain in the CAB files. So what occurs is that Enterprise Vault does a look up of all the items in a CAB and determines which ones are still valid, if there is only a certain percentage of items that truly exist in the CAB file, then EV extracts all the items, and the cab file is deleted. So how does Enterprise Vault know which cab files to check? Well when a collection file is created, there are two SQL Columns populated in the Collections table. One is called RefCount and one is called TotalCount. When a Collection is first created, it takes a count of how many items are stored, and sets the refcount and totalcount to the same number, so if 100 items are stored , both refcount and totalcount will be set to 100. Then, when an item is deleted or expired from that collection, it will reduce the number of the refcount, but the totalcount will remain the same. So if 50 items are deleted that belong in that CAB file, then refcount will be set to 50, and the totalcount will remain at 100. When the Refcount hits 0, this means that none of the DVS files within that CAB file exist in the database or the indexes, thus the CAB file and all its contents can be deleted. But what happens if you have a refcount of 1 and a totalcount of 100? This 1 item that still exists in EV is stopping the other 99 items from being removed from disk and freeing up storage. So what happens is the Sparse collections process. The last items are extracted to their original location, the refcount is set to 0 and then EV deletes the CAB file. By default, Enterprise Vault will initiate the sparse collections when the refcount is 15% of the the totalcount. So if you have 100 items stored in a cab, as soon as the refcount hits 15 items or lower, it will extract and then delete the cab file. So if you every run a storage expiry, make sure you run your collections process after so that you can reclaim disk space immediately.
