Applying Legal Holds appears to stall with the error "Cause:Problem with object properties."

Article:TECH180872  |  Created: 2012-02-07  |  Updated: 2014-07-25  |  Article URL http://www.symantec.com/docs/TECH180872
NOTE: If you are experiencing this particular known issue, we recommend that you Subscribe to receive email notification each time this article is updated. Subscribers will be the first to learn about any releases, status changes, workarounds or decisions made.
Article Type
Technical Solution

Product(s)

Environment

Issue



Applying Legal Holds appears to stall.  The DA Client display of the Case properties shows the error "Cause:Problem with object properties. Property: ItemID. Reason: The identifier specified was not formatted correctly.".  A dtrace of the Accelerator Service shows the error codes "-2147220730" and "0x80070057".
 


Error



- Error displayed on the properties page of the DA Case as viewed through the DA Client:
Legal Hold Thread - worker thread (6)
Case ID: 83
Number of tries: 2
Cause:Problem with object properties. Property: ItemId. Reason: The identifier specified was not formatted correctly.

- Sample from dtrace log of the AcceleratorService, formatted for easier reading:
EV-H {LEGALHOLD.EN_US} Exception: An internal failure occurred.
Internal Error: 'The parameter is incorrect. [0x80070057]'.
Info:{C2.EN_US} An COM error occurs [adding] holds,
Error Code: -2147220730
Diag:
HRESULT: 80040306
Type:System.Runtime.InteropServices.COMException ST:
at KVS.EnterpriseVault.Interop.IHolds.PlaceHolds()|
at KVS.Accelerator.LegalHold.LegalHold.AddReleaseHolds(Int32 CaseID, String GroupId, String ConsumerId, Boolean addHolds, LegalHoldSyncStatus legalHoldSyncStatus)

 


Environment



- Symantec Enterprise Vault 9.x
- Symantec Discovery Accelerator 9.x
- Microsoft SQL Server 2005 or 2008


Cause



This issue is caused by a KVSSaveSetID that is not formatted properly in the tblIntDiscoveredItems table for the DA Case in which the hold processing appears to be stuck.

When Legal Holds are to be applied to items captured in a DA Case, a SQL  stored procedure runs to identify the items on which to apply holds in batches of 1000 by default.  This SQL stored procedure obtains the KVSSaveSetID of each item and a VaultID of the archive in which the item is stored.  The improperly formatted KVSSaveSetID causes the SQL stored procedure to loop and repeat the same listing of KVSSaveSetIDs.

The KVSSaveSetID field is expected to be formatted in character sets of 15 - 18 - 1 - 32, with each set separated by the tilde (~) character (i.e., 201201106229769~201201102103070000~Z~E025F93E4725FE4B298AAE9042E38B81). Any format other than this is considered invalid.


Solution



Workaround:

Set the LegalError code for the item with the improperly formatted KVSSaveSetID to 427 (Item Deleted) using the following steps:

--- On a workstation running the Discovery Accelerator (DA) Client using an account with access to the Case

1) Note the CaseID of the DA Case where the Legal Holds appear to be stuck using the steps in Technical Article TECH72127, "How to obtain the CaseID and SearchID in Enterprise Vault (EV) Compliance Accelerator (CA) or Discovery Accelerator (DA)" (see the Related Articles section below).

--- On the Discovery Accelerator (DA) server

Important: Backup the Discovery Accelerator Customer database prior to completing the following steps.

2) Record a 5 minute long dtrace log of the AcceleratorService while attempting to apply holds.

3) Review the dtrace log for instances of the following lines:

EV-L {LEGALHOLD.EN_US} {C3.EN_US} Legal Hold Thread - worker thread (0): Case ID 115.
 group ID'DA_EV_DA_Cust1_E332A04A-D855-42CF-9A59-C5162927AEC4'
 batch of 1000 items started at 1/19/2012 1:18:18 PM on Directory EVSITE
EV:L CContentManagementAPI::get_Holds
EV:L CHolds::Initialise()
EV:L CContentManagementAPI::get_Hold
EV:L CHold::Initialise()
EV:L CContentManagementAPI::get_Hold
EV:L CHold::Initialise()

4) Count and note the number of instances of "CContentManagementAPI::get_Hold" following the line with the CaseID obtained in Step 1 above (i.e., CaseID 115 in the sample line above).

5) Close the DA  Client.

6) Stop the Customer's Background Task (CBT)  through the EVBAAdmin site or stop the Enterprise Vault Accelerator Manager Service (EVAMS).

--- On the SQL Server hosting the DA Customer database

7) Open a 'New Query' window focused on the DA Customer database in SQL Server Management Studio while logged onto the SQL Server using an account with permissions to modify the DA Customer database contents (such as the Vault Service Account).

8) Run the following query in the window, replacing XX with the CaseID obtained in Step 1 and displaying the output to either the grid below the query window or to a file:

SELECT DiscoveredItemID
     , KVSSaveSetID
     , Subject
     , LegalStatus
FROM tblIntDiscoveredItems
WHERE CaseID = XX
 AND LegalStatus = 420

9) Review the output and scroll down the rows to the number obtained in Step 4 (i.e., Row 155).

10) Confirm the KVSSaveSetID  is not formatted properly (i.e., contains the Subject field contents instead of a valid KVSSaveSetID).

11)  Note the DiscoveredItemID of the item with the improperly formatted KVSSaveSetID.

12) Check for additional instances of the message in the tblIntDiscoveredItems table by running the following SQL query in the query window, replacing 'message subject' with the Subject field content of the item found in Step 9 and replacing XX with the CaseID obtained in Step 1:

SELECT DiscoveredItemID
     , KVSSaveSetID
     , Subject
   
     , VaultID
     , LegalStatus
FROM tblIntDiscoveredItems
WHERE CaseID = XX
AND Subject = 'message subject'
ORDER BY VaultID
     , DiscoveredItemID

 

13) Note the number of items returned with the same VaultID as the message with the improperly formatted KVSSavesetID.  This number will be compared against another count in Step 25 to determine if there is only one instance of the item with an improperly formatted KVSSavesetID entry.

--- On the Enterprise Vault Indexing Service server

14) Log on as the Vault Service Account (VSA).

15) Open the Vault Administration Console.

16) Navigate to the Archives folder.

17) Navigate to the Archives sub-folder containing the archive in which the items were found (for example, Exchange Journal).

18) Right click on the archive in which the items were found and select the Properties option.

19) Ensure the VSA has at least Read permission granted, adding that permission if needed, then click the OK button to close the properties.

20) Right click on the archive again, then select the Search Archive option.

21) Click the Browser search link in the upper left corner of the search criteria pane.  This action will launch Internet Explorer to the 'search.asp' search criteria page.

22) Select the archive to be searched in the Vault field using the drop down arrow to display the available archives to which the VSA has at least Read permission, then click on the archive to select it.

23) Enter into the Subject field the contents of the Subject field from the result of the SQL Query of Step 12.

24) Change the inclusion option from contains any of to contains all of, then click the Search button in the lower left of the page.

25) Count the number of items found by the search and compare this number to the number of items noted in Step 13.

26) If the count of items in Step 25 is 1 less than the number from Step 13, the item with the incorrectly formatted KVSSaveSetID does not exist in the Vault Store and can safely be ignored.

27) If the count is equal to the number from Step 13, for each item returned

   a) Click the link of the message.  This will display a preview of the HTML rendering of the message in the browser window.

  b) Highlight the URL in the Address field and copy it into Notepad.  This will provide a line with the VaultID (labeled as 'vault=') and KVSSavesetID (labeled as 'SaveSetID=' in the line) for the item.

  c) Locate the portion of the URL in NotePad that begins with SaveSetID and place a carriage return at the beginning of SaveSetID to place that information on a separate line.

  d) In the SaveSetID line, locate each instance of %7E and replace these characters with the tilde (~).  There should be 3 instances to replace.  For example:

SaveSetID=790000000000000%7E200805291331590000%7E0%7E1E4261319490410080C9BF4F043F9A7 would become

SavesetID=790000000000000~200805291331590000~0~1E4261319490410080C9BF4F043F9A7

  e) Save the NotePad document, but keep it open until all of the SaveSetIDs have been obtained.

  f) Return to Step 27a) for the next item until each item has been processed to obtain its SaveSetID.

--- On the SQL Server hosting the DA Customer database

28)  Compare the SaveSetIDs in the NotePad document with the KVSSaveSetID entries from the SQL query of Step 12.

29) All of the SaveSetIDs should match the KVSSaveSetIDs except for the one with the improperly formatted KVSSaveSetID. 

30) If the number of KVSSaveSetIDs is one more than the SaveSetIDs AND the SaveSetIDs match the remaining KVSSaveSetIDs, run the following SQL statement in the query window, replacing XXX  with the DiscoveredItemID  noted in Step 11:

UPDATE tblIntDiscoveredItems
SET LegalStatus = 427
WHERE DiscoveredItemID = XXX

31) If the number of SaveSetIDs matches the number of items returned in the query of Step 13, note the SaveSetID that does not have a matching KVSSaveSetID as this is the SaveSetID that should be in that item's KVSSaveSetID field.

  a) Run the following SQL statement to correct the KVSSaveSetID for the item, replacing XXX with the DiscoveredItemID noted in Step 11 and replacing the word "actualsavesetid" with the SaveSetID noted in Step 31:

UPDATE tblIntDiscoveredItems
 
SET KVSSaveSetID = 'actualsavesetid'
 
WHERE DiscoveredItemID = XXX 

32) Repeat Steps 8 and 9 to ensure the item is no longer listed, or is listed with a properly formatted KVSSaveSetID, indicating a successful change of the LegalStatus from 420 to 427 or correction of its KVSSaveSetID.

Note: Additional rows may exist in the tblIntDiscoveredItems table with improperly formatted KVSSaveSetID field contents.  A review of the query output below the item identified in Step 9 should be performed to look for any other such rows.  Any other such rows should have their DiscoveredItemID noted and used in the SQL statement of Step 12 for each such item.

--- On the Discovery Accelerator (DA) server

33)  Start the CBT through the EVBAAdmin site or start EVAMS.

--- On a workstation running the Discovery Accelerator (DA) Client using an account with access to the Case

34)  Open the DA  Client.

35)  Change to the Cases tab.

36)  Click in the left panel on the Case where the holds were stuck.

37)  Monitor the properties to confirm at least 1 'Number of errors:', the 'Remaining items:' is decreasing and the 'Number of holds' is increasing.

There are currently no plans to address this issue by way of a patch or hotfix in the current or previous versions of the software at the present time. This issue may be resolved in a future major revision of the software at a later time. However, this particular issue is not currently scheduled for any release. If you feel this issue has a direct business impact for you and your continued use of the product, please contact your Symantec Sales representative or the Symantec Sales group to discuss these concerns. For information on how to contact Symantec Sales, please see http://www.symantec.com


Supplemental Materials

SourceETrack
Value2676739
Description

Invalid KVSSaveSetID in tblIntDiscoveredItems table causes Legal Hold processing to loop on the same 1000 items that include that SavesetID.




Article URL http://www.symantec.com/docs/TECH180872


Terms of use for this information are found in Legal Notices