A 7110 warning is returned in Enterprise Vault (EV) indicating that An invalid SIS part was encountered while doing watch file scan.

Article:TECH199104  |  Created: 2012-10-29  |  Updated: 2014-08-13  |  Article URL http://www.symantec.com/docs/TECH199104
Article Type
Technical Solution

Product(s)

Issue



A warning is returned from Storage File Watch indicating that an invalid SIS part was encountered. 


Error



Log Name:      Symantec Enterprise Vault
Source:        Enterprise Vault
Event ID:      7110
Task Category: Storage File Watch
Level:         Warning
Description:
An invalid SIS part was encountered while doing watch file scan. Following
further information is available. 

V-437-7110
 

Dtrace excerpt:

EV:L Sis part has been found to exist and but is zero size.
EV:H {CSisPartVerifierExistence::VerifySISPart} (Exit) Status: [SIS part validation failed. The stored SIS part size is different to the size expected. (0x80041bc2)]
EV:L CWFPostProcessSecuredItemRequest::VerifySISParts: Invalid SIS Part: No further item details available for non-Exchange item
EV~W Event ID: 7110 An invalid SIS part was encountered while doing watch file scan. Following further information is available.


Solution



This warning may be reported due to a check that is being performed on a SIS part that has been collected into a CAB file in the vault store partition.  The check shows that the size of the extracted item is 0 bytes, however the .ARCHDVSSP file can be seen on the disk and is greater than 0 bytes.  The item associated with this SIS part can be opened without issue and all of the parts are returned without error.


 
This issue has been resolved in the following release:


Enterprise Vault 10.0.3 - Release Details
http://www.symantec.com/docs/TECH193300

Note: Under some instances, the issue has been found post upgrade to 10.0.3. In this case, apply the following registry keys

Create following DWORD's at [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\KVS\Enterprise Vault\Storage]

DWORD: SisPartSizeCheckMaxRetryCount
Value = 10

DWORD: SisPartSizeCheckRetryInterval
Value = 2000


Supplemental Materials

SourceEvent ID
Value7110
Description

An invalid SIS part was encountered while doing watch file scan. Following
further information is available. 


SourceETrack
Value2914202
Description

Event 7110 from SFW when post processing CAB'ed Sisparts due to race condition when checking extracted SISPart size on disk.


SourceETrack
Value3157834
Description

Event 7110 - Still occurring after upgrade to 10.0.3



Article URL http://www.symantec.com/docs/TECH199104


Terms of use for this information are found in Legal Notices