Events 6796, 6578, 6592 - From Migrator Server every 5 minutes in the Enterprise Vault Event log
| Article:TECH179458 | | | Created: 2012-01-20 | | | Updated: 2013-05-28 | | | Article URL http://www.symantec.com/docs/TECH179458 |
Problem
Events 6796, 6578, 6592 are repetitively logged in the Enterprise Vault (EV) Event log when Vault Cache (VC) is enabled for end users across multiple EV Sites.
Error
Type: Error
Event: 6796
Source: Enterprise Vault
Category: Migrator Server
User: N/A
Description:
A COM exception has been raised.
The Partition does not exist. (0xc0041aa4)
Internal reference
CPartitionCache::ReadEntry .\PartitionCache.cpp [lines {80,126,129,139}], built Mar 14 10:56:32 2011
An exception is raised when a process encounters an unexpected fault.
--------------------------------------------------
Type: Error
Event: 6578
Source: Enterprise Vault
Category: Migrator Server
User: N/A
Description:
Abnormal error occurred
Object: CVaultStorePartitionCache
Reference: RE(1)/fe
--------------------------------------------------
Type: Error
Event: 6592
Source: Enterprise Vault
Category: Migrator Server
User: N/A
Description:
Abnormal error occurred
VaultId: CV
Reference: (null)
Alternate Event 6592 Description:
Description:
Abnormal error occurred
VaultId:
Reference: CStore::CurrentVault()/Vault object is null
Cause
When users are initially enabled for archiving, a unique Archive ID is generated, utilizing the current SiteName which the users were enabled in. Within an EV environmant with multiple Sites, this can introduce Archive ID's with varying SiteNames.
Example:
1234567891038490574632829286VaultSite1
1098765432147465929826254859VaultSite2
The above errors will occur when users are moved from between Enterprise Vault sites without the associated user's Vault Cache being reset, as the local settings on a remote workstation must be updated to refer to the users new and current Archive ID and SiteName.
Solution
Identification:
1. Enable Dtrace on the MigratorServer process until the events occur in the EV Event log. (For assistance in utilizing Dtrace see TECH38122 under Related Articles)
2. Disable Dtrace logging.
3. Open the Dtrace log with text editor
4. Search Dtrace for "EV~E" from the MigratorServer process, which records the errors.
5. Search prior to the EV~E, referring to the same Thread ID (<Thread ID>) as the error, until the following line containing the Archive ID is located. This line will start with "{CStore::IsOpenVault}|Requested:".
Example:
MigratorServer <2014> {CStore::IsOpenVault}|Requested: 11111111111111111111111111111111111111111VaultSite1 Current: Open: False
Note: In the above example, <2014> is the Thread ID.
6. Copy the archive id.
Example: 11111111111111111111111111111111111111111VaultSite1
7. Identify which EV Site the current archive is located within by referring to the site name located at the end of the Archive Id.
Example: VaultSite1
8. Login the vault site "VaultSite1" and open the Vault Administration Console (VAC).
Identify the related user by performing the following:
a. Hold Ctrl+Shift and right click on Archives.
b. Click on Find archive or folder.
c. Paste the Archive ID into the Search box and select Find.
d. Record the user name returned.
Solution:
1. Once the user is located, on the EV Server returning the error, open the most recent IIS logs (On Windows 2008 and above, browse to inetpub\logs\Logfiles) and search for the User's logon account.
2. The requesting IP address will be listed in the request. This is the machine and user that generate the above errors.
3. Perform a Full Reset of Vault Cache on the referenced remote machine while logged on as the affected user.
Prevention:
When moving a user archive between sites, it is required to perform a Vault Cache Full Reset on the machine after the move is completed.
|
|
Article URL http://www.symantec.com/docs/TECH179458
Terms of use for this information are found in Legal Notices
Thank you.