Enterprise Vault Collections fail with a -1,073,741,502 Searcher shortly after the job begins

Article:TECH198524  |  Created: 2012-10-17  |  Updated: 2014-10-15  |  Article URL http://www.symantec.com/docs/TECH198524
Article Type
Technical Solution


Issue



V7.1.2 and V7.1.5
Enterprise Vault (EV) Collection Task fails immediately after 'Wrote collection job XML' in the Job Status log.

V7.1.4 and V7.1.5
EV Collection Task fails after release of the Index Server lease.

 


Error



V7.1.2 and V7.1.3
[#422298] EV searcher error - -1,073,741,502 Searcher exited with non-zero error code - {1.EN_US}.
Message: Failed: [#422280] The collection agent reported a failure.

V7.1.4 and V7.1.5
{ Job Status Log }
- Wrote collection job XML \\testserver\ediscovery\Collections\0.27.6.123-20141014-124524-403\0.34.6.222\ClearwellCollectionJob-134683169.xml for index server 1234EDFBE6501F64AAA1CEDF177B0FE931710000CWLAB
- Releasing lease on Index Server=1234EDFBE6501F64AAA1CEDF177B0FE931710000CWLAB, leaseId=0.4.2.36660
- Search failed for index sever 1234EDFBE6501F64AAA1CEDF177B0FE931710000CWLAB, ignoring for this run and moving ahead with rest of the index server results if any
- Task probably doesn't have any archives selected, the task might result in failure

{Icp RemoteJob Log }
[#422302] EV searcher error - -1,073,741,502 Searcher exited abruptly, check if the source account configured with the associated source is part of Local Administrators group

 


Cause



A. The EV Service Account (VSA) does not have local administrator rights on the Clearwell Appliance.

The initial writing of the collection job XML in the local D drive scratch area, is performed by the service starting the EsaApplicationService.  This written action is followed by an update in the scratch folder, from the account that starts the EsaEvCrawlerservice (typically the VSA).

 B. A Group Policy Object is preventing the execution of a batch job for the EV Source Account.

 


Solution



A. The EV Service Account (VSA) does not have local administrator rights on the Clearwell Appliance.

    1. Open The Administrators Group
Server Manager | Configuration | Local Users and Groups | Groups | Administrators

    2. Select Add...

    3. Enter the name of the account that starts the EsaEvCrawlerService in the 'Enter the object names to select' text box

    4. Select Check Names

    5. Once the account is verified, select OK

    6. Run the Clearwell Collection Task and verify the process continues with 'Search progress update' after the 'Wrote collection job XML' step within the Job Status Log.
 

B. A Group Policy Object is preventing the execution of a batch job for the EV Source Account.
- Contact your internal security team to discuss adding allow 'log on as a batch job' permissions for the EV Source Account.

 




Article URL http://www.symantec.com/docs/TECH198524


Terms of use for this information are found in Legal Notices