V-378-1312-202: Error updating audit information
|Article:TECH158438|||||Created: 2011-04-20|||||Updated: 2011-09-14|||||Article URL http://www.symantec.com/docs/TECH158438|
The root cause of the issue is that Netapp sends "directory open" events as "file open" events. Hence, Data Insight thinks that these paths in events are files and tries to process those events accordingly. But every now and then, it obviously finds a mismatch because the same path is added as a directory earlier and hence the indexwriter errors out while processing these audit files containing paths which are directories but being sent as files.
As you can see in below screen shot, which shows data in one of the audit files sent to "err" folder, that, there are paths which are files and which are directories, but type of all paths is 2 (which means file). This is the reason for files going in err directory and not being consumed by Index Writer in Data Insight.
Upgrade Firmware on the Netapp filer to 7.3.5
Article URL http://www.symantec.com/docs/TECH158438