Journal Task crashes with Event ID 1000 after upgrade to Enterprise Vault 10.0.2 or 10.0.3
| Article:TECH200294 | | | Created: 2012-11-29 | | | Updated: 2013-05-14 | | | Article URL http://www.symantec.com/docs/TECH200294 |
Problem
After an upgrade to Enterprise Vault 10.0.2 or 10.0.3, the Journal Task may begin to fail frequently with the error below.
Error
The following Event is logged in the Application Event Log three times.
Source: Application Error
Event ID: 1000
Task Category: (100)
Level: Error
Description:
Faulting application name: JournalTask.EXE, version: 10.0.2.1112, time stamp: 0x5050ef80
Faulting module name: MSVCR90.dll, version: 9.0.30729.6161, time stamp: 0x4dace5b9
Exception code: 0xc0000417
Fault offset: 0x0005a7d8
Faulting process id: 0x1e10
Faulting application start time: 0x01cdcdb4e590e93e
Faulting application path: C:\Program Files (x86)\Enterprise Vault\JournalTask.EXE
Faulting module path: C:\Windows\WinSxS\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\MSVCR90.dll
Report Id: 261378b0-39a8-11e2-b8b1-000c291d63c2
Event Xml:
<Event xmlns="
<System>
<Provider Name="Application Error" />
<EventID Qualifiers="0">1000</EventID>
<Level>2</Level>
<Task>100</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2012-11-28T22:08:34.000000000Z" />
<EventRecordID>60700</EventRecordID>
<Channel>Application</Channel>
<Computer>EV10-VaultN01.EV10.local</Computer>
<Security />
</System>
<EventData>
<Data>JournalTask.EXE</Data>
<Data>10.0.2.1112</Data>
<Data>5050ef80</Data>
<Data>MSVCR90.dll</Data>
<Data>9.0.30729.6161</Data>
<Data>4dace5b9</Data>
<Data>c0000417</Data>
<Data>0005a7d8</Data>
<Data>1e10</Data>
<Data>01cdcdb4e590e93e</Data>
<Data>C:\Program Files (x86)\Enterprise Vault\JournalTask.EXE</Data>
<Data>C:\Windows\WinSxS\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\MSVCR90.dll</Data>
<Data>261378b0-39a8-11e2-b8b1-000c291d63c2</Data>
</EventData>
</Event>
The task will show as failed in the Vault Administration Console. Restarting the task causes the Event above to reappear. No errors are logged in DTrace at the point of failure.
Environment
This only affects tasks that are archiving from Exchange 2010 using Enterprise Vault 10.0.2 or 10.0.3.
Cause
This appears to be caused by a problem with the ability of the distribution list expansion functionality in Enterprise Vault 10.0.2 and 10.0.3 to handle items with certain types of distribution lists.
Solution
A workaround is available by adding the following registry setting.
Warning: Incorrect use of the Windows registry editor may prevent the operating system from functioning properly. Great care should be taken when making changes to a Windows registry. Registry modifications should only be carried-out by persons experienced in the use of the registry editor application. It is recommended that a complete backup of the registry and workstation be made prior to making any registry changes.
Location: HKLM\Software\WOW6432Node\KVS\Enterprise Vault\Agents
Name: ForceMAPIDLExpansion
Type: dword
Value: 1
Notes: When set to 1, distribution list expansion against Exchange 2010 servers will use MAPI. When set to 0, the expansion uses Active Directory. The 0 behavior is the default when the dword is not present.
When set to 1, the DS Server registry setting must also be set as described in TECH147417.
This will force the Journal Task to use MAPI (rather than Active Directory) to expand the distribution list, which was the behavior in Enterprise Vault 10.0.1 and earlier. This will allow the Journal Task to process items that contain the problematic type of distribution lists without crashing.
Please be sure to refer back to this document periodically as any changes to the status of the issue will be reflected here.
|
|
| Source | ETrack |
| Value | 3009160 |
| Description | Active Directory distribution list expansion causes JournalTask.exe to fault |
Article URL http://www.symantec.com/docs/TECH200294
Terms of use for this information are found in Legal Notices
Thank you.