What do the event logs mean when indexing service startup and shutdown?

Article:HOWTO56267  |  Created: 2011-07-27  |  Updated: 2011-07-29  |  Article URL http://www.symantec.com/docs/HOWTO56267
Article Type
How To



Event log messages and their meaning on startup on indexing service:

 
Index service on startup normally performs following operations:
      i. Indexing service initialization routines
      ii. Starts the indexing engine
      iii. Synchronize index metadata between 64-bit indexing engines repository and directory database if required.
      iv. Start IndexBroker.exe process to manage 32-bit index volumes
      v. Start EVIndexVolumesProcessor and EVIndexQueryServer to manage operations on 64-bit index volumes. 
      vi. Check for any the pending work from storage
 
Indexing service on startup will log appropriate event log messages based on above mentioned operations. 
 
Indexing admin service will start 64-bit indexing engine and synchronize index metadata. 
If index metadata is required to be updated then this process might take a long time as per following scenarios:
      i. Directory database and index metadata are in sync (normal scenario)
      ii. Startup of indexing service when index metadata is missing OR failover scenario in a building blocks environment 
 
Directory database and index metadata are in sync
In normal circumstances indexing service will log following messages at this stage:
 
1. In case indexing service manages 32 bit index volumes (normally present on upgraded index servers) then IndexBroker.exe process will be launched by indexing admin service.  Please note that indexing admin service will only launch this process if 32-bit index volumes are managed by indexing service.  
 
An event log message will reflect the launch on IndexBroker.exe process:
 
Log Name:      Symantec Enterprise Vault
Source:        Enterprise Vault 
Date:          19/07/2011 15:21:30
Event ID:      7345
Task Category: Index Broker
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      testindex3.testindex.local
Description:
IndexBroker has started on this server to manage old 32 bit index volumes. 
 
For more information, see Help and Support Center at http://evevent.symantec.com/rosetta/showevent.asp?EvtID=7345
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Enterprise Vault " />
    <EventID Qualifiers="16388">7345</EventID>
    <Level>4</Level>
    <Task>23</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2011-07-19T14:21:30.000000000Z" />
    <EventRecordID>26781</EventRecordID>
    <Channel>Symantec Enterprise Vault</Channel>
    <Computer>testindex3.testindex.local</Computer>
    <Security />
  </System>
  <EventData>
  </EventData>
</Event>
 
 
2. Once all initialization routines are completed indexing service will log following event log message:
 
Log Name:      Symantec Enterprise Vault
Source:        Enterprise Vault 
Date:          20/07/2011 12:48:11
Event ID:      41302
Task Category: Index Admin Service 
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      testindex3.testindex.local
Description:
The Indexing Service has completed its initialization. The service is now functioning fully. 
 
For more information, see Help and Support Center at http://evevent.symantec.com/rosetta/showevent.asp?EvtID=41302
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Enterprise Vault " />
    <EventID Qualifiers="0">41302</EventID>
    <Level>4</Level>
    <Task>132</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2011-07-20T11:48:11.000000000Z" />
    <EventRecordID>26841</EventRecordID>
    <Channel>Symantec Enterprise Vault</Channel>
    <Computer>testindex3.testindex.local</Computer>
    <Security />
  </System>
  <EventData>
    <Data>The Indexing Service has completed its initialization. The service is now functioning fully.</Data>
  </EventData>
</Event>
 
 
3. Indexing service has started message will be subsequently logged. 
 
Log Name:      Symantec Enterprise Vault
Source:        Enterprise Vault 
Date:          20/07/2011 12:48:12
Event ID:      41297
Task Category: Index Admin Service 
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      testindex3.testindex.local
Description:
The Indexing Service has started (10.0.0.1316). 
 
For more information, see Help and Support Center at http://evevent.symantec.com/rosetta/showevent.asp?EvtID=41297
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Enterprise Vault " />
    <EventID Qualifiers="0">41297</EventID>
    <Level>4</Level>
    <Task>132</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2011-07-20T11:48:12.000000000Z" />
    <EventRecordID>26842</EventRecordID>
    <Channel>Symantec Enterprise Vault</Channel>
    <Computer>testindex3.testindex.local</Computer>
    <Security />
  </System>
  <EventData>
    <Data>The Indexing Service has started (10.0.0.1316).</Data>
  </EventData>
</Event>
 
 
4. After indexing service becomes functional it then runs a check to find any pending work from storage and once this process is completed then an event log message is logged, stating how many index volumes have any pending work.
 
Log Name:      Symantec Enterprise Vault
Source:        Enterprise Vault 
Date:          20/07/2011 13:50:25
Event ID:      41365
Task Category: Index Admin Service 
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      testindex3.testindex.local
Description:
Summary of the current index volume check:
 
Volumes synchronized: 0
Failed volumes synchronized: 0
 
The next synchronization checks will take place as follows:
 
Volumes having pending work in 0 hours and 59 minutes
Failed volumes in 5 hours and 59 minutes
All volumes in 9 hours and 59 minutes. 
 
For more information, see Help and Support Center at http://evevent.symantec.com/rosetta/showevent.asp?EvtID=41365
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Enterprise Vault " />
    <EventID Qualifiers="0">41365</EventID>
    <Level>4</Level>
    <Task>132</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2011-07-20T12:50:25.000000000Z" />
    <EventRecordID>26858</EventRecordID>
    <Channel>Symantec Enterprise Vault</Channel>
    <Computer>testindex3.testindex.local</Computer>
    <Security />
  </System>
  <EventData>
    <Data>Summary of the current index volume check:
 
Volumes synchronized: 0
Failed volumes synchronized: 0
 
The next synchronization checks will take place as follows:
 
Volumes having pending work in 0 hours and 59 minutes
Failed volumes in 5 hours and 59 minutes
All volumes in 9 hours and 59 minutes.</Data>
  </EventData>
</Event>
 
 
Startup of indexing service when index metadata is missing OR failover scenario in a building blocks environment 
 
In case index metadata is missing from repository OR index metadata for existing index volumes on failed over index server is recreated on backup index server.  This process can take a long time depending on number of existing 64-bit index volumes on failed over index server.
 
1. In this scenario synchronization of index volume metadata between indexing engine repository and directory database will be started and a message will be logged in event log.
Log Name:      Symantec Enterprise Vault
Source:        Enterprise Vault 
Date:          20/07/2011 13:45:08
Event ID:      41372
Task Category: Index Admin Service 
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      testindex3.testindex.local
Description:
Indexing Service has started the synchronization of index volume metadata between the indexing engine repository and the Directory database.   
 
For more information, see Help and Support Center at http://evevent.symantec.com/rosetta/showevent.asp?EvtID=41372
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Enterprise Vault " />
    <EventID Qualifiers="0">41372</EventID>
    <Level>4</Level>
    <Task>132</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2011-07-20T12:45:08.000000000Z" />
    <EventRecordID>26846</EventRecordID>
    <Channel>Symantec Enterprise Vault</Channel>
    <Computer>testindex3.testindex.local</Computer>
    <Security />
  </System>
  <EventData>
    <Data>Indexing Service has started the synchronization of index volume metadata between the indexing engine repository and the Directory database.  </Data>
  </EventData>
</Event>
 
 
 
2. This message will be logged after every 20 seconds until indexing service initialization routines are completed: 
Log Name:      Symantec Enterprise Vault
Source:        Enterprise Vault 
Date:          19/07/2011 13:05:33
Event ID:      41299
Task Category: Index Admin Service 
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      testindex3.testindex.local
Description:
The Indexing Service is pending initialization.
Requesting additional time for initialization routines.... 
 
For more information, see Help and Support Center at http://evevent.symantec.com/rosetta/showevent.asp?EvtID=41299
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Enterprise Vault " />
    <EventID Qualifiers="0">41299</EventID>
    <Level>4</Level>
    <Task>132</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2011-07-19T12:05:33.000000000Z" />
    <EventRecordID>26764</EventRecordID>
    <Channel>Symantec Enterprise Vault</Channel>
    <Computer>testindex3.testindex.local</Computer>
    <Security />
  </System>
  <EventData>
    <Data>The Indexing Service is pending initialization.
Requesting additional time for initialization routines....</Data>
  </EventData>
</Event>
 
 
3. Following message will be logged once initialization routines are completed:
 
Log Name:      Symantec Enterprise Vault
Source:        Enterprise Vault 
Date:          20/07/2011 13:47:04
Event ID:      41297
Task Category: Index Admin Service 
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      testindex3.testindex.local
Description:
The Indexing Service has started (10.0.0.1316). 
 
For more information, see Help and Support Center at http://evevent.symantec.com/rosetta/showevent.asp?EvtID=41297
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Enterprise Vault " />
    <EventID Qualifiers="0">41297</EventID>
    <Level>4</Level>
    <Task>132</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2011-07-20T12:47:04.000000000Z" />
    <EventRecordID>26853</EventRecordID>
    <Channel>Symantec Enterprise Vault</Channel>
    <Computer>testindex3.testindex.local</Computer>
    <Security />
  </System>
  <EventData>
    <Data>The Indexing Service has started (10.0.0.1316).</Data>
  </EventData>
</Event>
 
 
4. A subsequent message will be logged that indexing service has started but must complete additional work before responds to external work.
 
This means that synchronization of index volumes metadata between indexing engine repository and directory database is still running and indexing service will only accept new request once this process has completed.
 Log Name:      Symantec Enterprise Vault
Source:        Enterprise Vault 
Date:          20/07/2011 13:47:04
Event ID:      41303
Task Category: Index Admin Service 
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      testindex3.testindex.local
Description:
The Indexing Service has been started, but must complete additional work before it can respond to external requests. 
 
For more information, see Help and Support Center at http://evevent.symantec.com/rosetta/showevent.asp?EvtID=41303
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Enterprise Vault " />
    <EventID Qualifiers="0">41303</EventID>
    <Level>4</Level>
    <Task>132</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2011-07-20T12:47:04.000000000Z" />
    <EventRecordID>26854</EventRecordID>
    <Channel>Symantec Enterprise Vault</Channel>
    <Computer>testindex3.testindex.local</Computer>
    <Security />
  </System>
  <EventData>
    <Data>The Indexing Service has been started, but must complete additional work before it can respond to external requests.</Data>
  </EventData>
</Event>
 
 
5. Indexing service will log a progress summary every 10 minutes in case index volumes metadata and directory database synchronization takes a long time:
 
Log Name:      Symantec Enterprise Vault
Source:        Enterprise Vault 
Date:          25/07/2011 11:39:18
Event ID:      41376
Task Category: Index Admin Service 
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      testindex3.testindex.local
Description:
Indexing Service is synchronizing index volume metadata between the indexing engine repository and the Directory database.
Progress summary:
Created metadata for 1392 index volume(s) in indexing engine.
Updated location for 0 index volume(s) in indexing engine. 
 
For more information, see Help and Support Center at http://evevent.symantec.com/rosetta/showevent.asp?EvtID=41376
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Enterprise Vault " />
    <EventID Qualifiers="0">41376</EventID>
    <Level>4</Level>
    <Task>132</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2011-07-25T10:39:18.000000000Z" />
    <EventRecordID>27110</EventRecordID>
    <Channel>Symantec Enterprise Vault</Channel>
    <Computer>testindex3.testindex.local</Computer>
    <Security />
  </System>
  <EventData>
    <Data>Indexing Service is synchronizing index volume metadata between the indexing engine repository and the Directory database.
Progress summary:
Created metadata for 1392 index volume(s) in indexing engine.
Updated location for 0 index volume(s) in indexing engine.</Data>
  </EventData>
</Event>
 
 
6. Once indexing service has completed synchronization of index volume metadata between the 64-bit indexing engine repository and the directory database then following message is logged:
 
Log Name:      Symantec Enterprise Vault
Source:        Enterprise Vault 
Date:          25/07/2011 11:53:19
Event ID:      41377
Task Category: Index Admin Service 
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      testindex3.testindex.local
Description:
Indexing Service has completed the synchronization of index volume metadata between the indexing engine repository and the Directory database.
Total index volume(s) whose metadata was created: 3406
Total index volume(s) whose location was updated: 0 
 
For more information, see Help and Support Center at http://evevent.symantec.com/rosetta/showevent.asp?EvtID=41377
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Enterprise Vault " />
    <EventID Qualifiers="0">41377</EventID>
    <Level>4</Level>
    <Task>132</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2011-07-25T10:53:19.000000000Z" />
    <EventRecordID>27112</EventRecordID>
    <Channel>Symantec Enterprise Vault</Channel>
    <Computer>testindex3.testindex.local</Computer>
    <Security />
  </System>
  <EventData>
    <Data>Indexing Service has completed the synchronization of index volume metadata between the indexing engine repository and the Directory database.
Total index volume(s) whose metadata was created: 3406
Total index volume(s) whose location was updated: 0</Data>
  </EventData>
</Event>
 
7. In case any index volumes metadata is deleted during synchronization of index volumes metadata and directory database then following event log message is logged:
 
Log Name:      Symantec Enterprise Vault
Source:        Enterprise Vault 
Date:          25/07/2011 14:52:13
Event ID:      41375
Task Category: Index Admin Service 
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      TESTINDEX9.testindex.local
Description:
Indexing service has removed redundant metadata for 3 index volume(s) from the indexing engine repository.  
 
For more information, see Help and Support Center at http://evevent.symantec.com/rosetta/showevent.asp?EvtID=41375
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Enterprise Vault " />
    <EventID Qualifiers="0">41375</EventID>
    <Level>4</Level>
    <Task>132</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2011-07-25T13:52:13.000000000Z" />
    <EventRecordID>2427</EventRecordID>
    <Channel>Symantec Enterprise Vault</Channel>
    <Computer>TESTINDEX9.testindex.local</Computer>
    <Security />
  </System>
  <EventData>
    <Data>Indexing service has removed redundant metadata for 3 index volume(s) from the indexing engine repository. </Data>
  </EventData>
</Event>
 
 
8. If indexing service manages 32 bit index volumes (normally present on upgraded index servers) then IndexBroker.exe process will be launched by indexing admin service.  
 
Please note that indexing admin service will only launch this process if 32-bit index volumes are managed by indexing service.  An event log message will reflect the launch on IndexBroker.exe process at this stage:
 
Log Name:      Symantec Enterprise Vault
Source:        Enterprise Vault 
Date:          19/07/2011 15:21:30
Event ID:      7345
Task Category: Index Broker
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      testindex3.testindex.local
Description:
IndexBroker has started on this server to manage old 32 bit index volumes. 
 
For more information, see Help and Support Center at http://evevent.symantec.com/rosetta/showevent.asp?EvtID=7345
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Enterprise Vault " />
    <EventID Qualifiers="16388">7345</EventID>
    <Level>4</Level>
    <Task>23</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2011-07-19T14:21:30.000000000Z" />
    <EventRecordID>26781</EventRecordID>
    <Channel>Symantec Enterprise Vault</Channel>
    <Computer>testindex3.testindex.local</Computer>
    <Security />
  </System>
  <EventData>
  </EventData>
</Event>
 
 
9. Once all sub processes of indexing server are successfully launched then an event log message will be logged that indexing service is now fully functional: 
 
Log Name:      Symantec Enterprise Vault
Source:        Enterprise Vault 
Date:          20/07/2011 13:50:17
Event ID:      41302
Task Category: Index Admin Service 
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      testindex3.testindex.local
Description:
The Indexing Service has completed its initialization. The service is now functioning fully. 
 
For more information, see Help and Support Center at http://evevent.symantec.com/rosetta/showevent.asp?EvtID=41302
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Enterprise Vault " />
    <EventID Qualifiers="0">41302</EventID>
    <Level>4</Level>
    <Task>132</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2011-07-20T12:50:17.000000000Z" />
    <EventRecordID>26857</EventRecordID>
    <Channel>Symantec Enterprise Vault</Channel>
    <Computer>testindex3.testindex.local</Computer>
    <Security />
  </System>
  <EventData>
    <Data>The Indexing Service has completed its initialization. The service is now functioning fully.</Data>
  </EventData>
</Event>
 
10. After indexing service becomes fully functional it then runs a check to find any pending work from storage and once this process is completed then an event log message is logged, stating how many index volumes have any pending work. This process can also be time consuming.
 
Log Name:      Symantec Enterprise Vault
Source:        Enterprise Vault 
Date:          20/07/2011 13:50:25
Event ID:      41365
Task Category: Index Admin Service 
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      testindex3.testindex.local
Description:
Summary of the current index volume check:
 
Volumes synchronized: 0
Failed volumes synchronized: 0
 
The next synchronization checks will take place as follows:
 
Volumes having pending work in 0 hours and 59 minutes
Failed volumes in 5 hours and 59 minutes
All volumes in 9 hours and 59 minutes. 
 
For more information, see Help and Support Center at http://evevent.symantec.com/rosetta/showevent.asp?EvtID=41365
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Enterprise Vault " />
    <EventID Qualifiers="0">41365</EventID>
    <Level>4</Level>
    <Task>132</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2011-07-20T12:50:25.000000000Z" />
    <EventRecordID>26858</EventRecordID>
    <Channel>Symantec Enterprise Vault</Channel>
    <Computer>testindex3.testindex.local</Computer>
    <Security />
  </System>
  <EventData>
    <Data>Summary of the current index volume check:
 
Volumes synchronized: 0
Failed volumes synchronized: 0
 
The next synchronization checks will take place as follows:
 
Volumes having pending work in 0 hours and 59 minutes
Failed volumes in 5 hours and 59 minutes
All volumes in 9 hours and 59 minutes.</Data>
  </EventData>
</Event>
 
 
 Event log messages when indexing service is stopped:
 
1. Once a shutdown process of indexing service is initiated, if index server manages 32-bit index volumes then IndexBroker.exe process is stopped first and following message will be logged in event log:
 
Log Name:      Symantec Enterprise Vault
Source:        Enterprise Vault 
Date:          20/07/2011 13:44:04
Event ID:      7346
Task Category: Index Broker
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      testindex3.testindex.local
Description:
IndexBroker has stopped. 
 
For more information, see Help and Support Center at http://evevent.symantec.com/rosetta/showevent.asp?EvtID=7346
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Enterprise Vault " />
    <EventID Qualifiers="16388">7346</EventID>
    <Level>4</Level>
    <Task>23</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2011-07-20T12:44:04.000000000Z" />
    <EventRecordID>26844</EventRecordID>
    <Channel>Symantec Enterprise Vault</Channel>
    <Computer>testindex3.testindex.local</Computer>
    <Security />
  </System>
  <EventData>
  </EventData>
</Event>
 
 
2. Once all 64-bit index volume related processes are successfully stopped then following event log message is logged:
 
Log Name:      Symantec Enterprise Vault
Source:        Enterprise Vault 
Date:          20/07/2011 13:44:19
Event ID:      41298
Task Category: Index Admin Service 
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      testindex3.testindex.local
Description:
The Indexing Service has stopped (10.0.0.1316). 
 
For more information, see Help and Support Center at http://evevent.symantec.com/rosetta/showevent.asp?EvtID=41298
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Enterprise Vault " />
    <EventID Qualifiers="0">41298</EventID>
    <Level>4</Level>
    <Task>132</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2011-07-20T12:44:19.000000000Z" />
    <EventRecordID>26845</EventRecordID>
    <Channel>Symantec Enterprise Vault</Channel>
    <Computer>testindex3.testindex.local</Computer>
    <Security />
  </System>
  <EventData>
    <Data>The Indexing Service has stopped (10.0.0.1316).</Data>
  </EventData>
</Event>
 


Article URL http://www.symantec.com/docs/HOWTO56267


Terms of use for this information are found in Legal Notices