Event IDs 6796, 6578, 6592 are logged on the Enterprise Vault server

Article:TECH179458  |  Created: 2012-01-20  |  Updated: 2013-11-11  |  Article URL http://www.symantec.com/docs/TECH179458
Article Type
Technical Solution


Issue



Event IDs 6796, 6578, 6592 are logged in the Enterprise Vault (EV) Event log


Error



Type:  Error
Event:  6796
Source:  Enterprise Vault
Category: Migrator Server
User:  N/A
Description:
A COM exception has been raised.
The Partition does not exist.      (0xc0041aa4)
Internal reference
CPartitionCache::ReadEntry .\PartitionCache.cpp [lines {80,126,129,139}], built Mar 14 10:56:32 2011

An exception is raised when a process encounters an unexpected fault.

--------------------------------------------------

Type:  Error
Event:  6578
Source:  Enterprise Vault
Category: Migrator Server
User:  N/A
Description:
Abnormal error occurred

Object:    CVaultStorePartitionCache
Reference: RE(1)/fe

--------------------------------------------------

Type:  Error
Event:  6592
Source:  Enterprise Vault
Category: Migrator Server
User:  N/A
Description:
Abnormal error occurred

VaultId:   CV
Reference: (null)

Alternate Event 6592 Description:

Description:
Abnormal error occurred

VaultId:
Reference: CStore::CurrentVault()/Vault object is null
 


Cause



This can occur when the user's Vault Cache becomes corrupt, or a user is migrated to a new Enterprise Vault site without the related Vault Cache being reset (When attempting to synchronize with an Enterprise Vault site using an incorrect Archive ID).

 


Solution



The issue can be resolved by identifying the offending computer and resetting the Vault Cache on that machine.

Identifying the specific archiveID being used:

1. Enable Dtrace on the MigratorServer process until the events occur in the EV Event log. (For assistance in utilizing Dtrace see TECH38122 under Related Articles)
2. Disable Dtrace logging.
3. Open the Dtrace log with a text editor.
4. Search Dtrace for "EV~E" from the MigratorServer process, which records the errors.
5. Search prior to the EV~E, referring to the same Thread ID (<Thread ID>) as the error, until the following line containing the Archive ID is located. This line will start with "{CStore::IsOpenVault}|Requested:".

Example:
MigratorServer    <2014>   {CStore::IsOpenVault}|Requested: 11111111111111111111111111111111111111111VaultSite1 Current:  Open: False

Note: In the above example, <2014> is the Thread ID.

6. Copy the archive id.

Example: 11111111111111111111111111111111111111111VaultSite1

7. Identify which EV Site the current archive is located within by referring to the site name located at the end of the Archive Id. 

Example: VaultSite1

8. Log on to the vault site "VaultSite1" and open the Vault Administration Console (VAC).

    Identify the related user by performing the following:

    a. Hold Ctrl+Shift and right click on Archives.
    b. Click on Find archive or folder.
    c. Paste the Archive ID into the Search box and select Find.
    d. Record the user name returned.

Identifying the specific machine attempting to synchronize Vault Cache:


1. Once the user is located, on the EV Server returning the error, open the most recent IIS logs (On Windows 2008 and above, browse to inetpub\logs\Logfiles) and search for the User's logon account (Domain\Username).
2. The requesting IP address will be listed in the request.  This is the machine and user that is generating the above errors.
3. Perform a Full Reset of Vault Cache on the referenced remote machine while logged on as the affected user.

 Identifying the machine when Vault Cache is corrupt and ArchiveID is completely invalid:

1.  Run the following query against the Directory database on the SQL Server:

USE EnterpriseVaultDirectory
SELECT
CASE WHEN JobType = '8' THEN 'CC Reg Build'
WHEN JobType = '9' THEN 'CC Inc Build' End AS 'Buildtype'
,CASE WHEN JobState = '0' THEN 'None'
WHEN JobState = '1' THEN 'Completed'
WHEN JobState = '2' THEN 'Failed'
WHEN JobState = '3' THEN 'Queued'
End AS 'JobState'
,JobDescription
,RetryCount
FROM AdminJobEntry
WHERE JobState != '1'
AND JobType IN ('8','9')

 

This will return all of the non-complete Vault Cache jobs Content Cache (CC).  This may be leveraged to locate the machines of those usernames to identify which workstation requires a Vault Cache reset.

 





Article URL http://www.symantec.com/docs/TECH179458


Terms of use for this information are found in Legal Notices