Enterprise Vault (EV) Archives stuck in "Marked for Deletion" status.

Article:TECH178002  |  Created: 2011-12-30  |  Updated: 2014-09-26  |  Article URL http://www.symantec.com/docs/TECH178002
Article Type
Technical Solution


Issue



When deleting Archives via the EV Admin Console (VAC) the Status can remain as Marked for Deletion indefinitely, regardless of restarting the Storage service or refreshing the view.


Error



Event Type: Warning
Event Source: Enterprise Vault
Event Category: Storage Delete
Event ID: 7113
Description:
Following archive could not be deleted as it contains items that are on hold, or their retention category does not allow deletions, or a compliance device retention period prevents them from being deleted. 
 Archive Name = Test User
 Archive Entry Id = 12465EEB6E4B5604480511122A26C92CC1110000vault
 Total items on hold = 23124
V-437-7113


Cause



The Retention Category prevents deletions from the User's archive or potential SQL deadlocks.


Solution



Check that the StorageDelete process is not actively removing data from the Vault Store or Directory DB by gathering a Dtrace of that process. If there's no obvious activity on the archives follow these steps.

Example:

(StorageDelete) <3048> EV:L CNTFSStorageDeviceDeleter::BuildExtensionlessSavesetFileName - SavesetIdentifier=[201108113044613~201108030926200000~Z~40938CB249F0E302439A7D8094E688B1], ExtensionlessFileName=[C:\EVStorage\Express Vault Store\Express Vault Store Ptn1\2011\08-11\4\093\40938CB249F0E302439A7D8094E688B1]
(StorageDelete) <3048> EV:L {CNTFSStorageDeviceDeleter::Delete} (Entry) File name=[C:\EVStorage\Express Vault Store\Express Vault Store Ptn1\2011\08-11\4\093\40938CB249F0E302439A7D8094E688B1.DVS]
(StorageDelete) <3048> EV:L {CWORMDeviceHelper::IsWORMDevice:#56} Device [is not] WORM.
(StorageDelete) <3048> EV:L EVCommon::DeleteFile : FileName = C:\EVStorage\Express Vault Store\Express Vault Store Ptn1\2011\08-11\4\093\40938CB249F0E302439A7D8094E688B1.DVS
(StorageDelete) <3048> EV:L {CNTFSStorageDeviceDeleter::Delete} (Exit) Status: [False (0x1)]
(StorageDelete) <3048> EV:L {CNTFSStorageDeviceDeleter::DeleteSaveset} (Exit) Status: [False (0x1)]
(StorageDelete) <3048> EV:L {CSavesetSISManager::DeleteSaveset} (Exit) Status: [False (0x1)]

  1. Within SQL Management Studio run the following:

    USE EnterpriseVaultDirectory
    SELECT *  FROM  Archive
    WHERE ArchiveStatus = 4


    This will generate a list of all of the Archives set for Deletion.
     
  2. Check the results and make sure that the ArchiveName column contains the Archive/s in question. Take note of the RootIdentity for each Archive.
     
  3. Within SQL run the following SQL query to change the status back to Available:

    USE EnterpriseVaultDirectory
    UPDATE Archive
    SET ArchiveStatus = 1
    WHERE ArchiveStatus = 4 AND RootIdentity = 'RootIdentity taken from step2'

     
  4. Refresh the view in the VAC and make sure that the vault status for the archive/s have changed from Marked for Deletion to Available.
     
  5. Restart the Storage Service, delete the archive/s again and Dtrace the StorageDelete process.
      
  6. Refresh VAC and the archive should now be gone, although it may take a few minutes depending on the size of the archive.

Supplemental Materials

SourceEvent ID
Value7113
Description

Following archive could not be deleted as it contains items that are on hold, or their retention category does not allow deletions, or a compliance device retention period prevents them from being deleted.




Article URL http://www.symantec.com/docs/TECH178002


Terms of use for this information are found in Legal Notices