In certain circumstances, the Enterprise Vault (EV) Backtrace function can generated more than expected logs, which may cause drivespace issues.

Article:TECH204659  |  Created: 2013-04-03  |  Updated: 2013-08-29  |  Article URL http://www.symantec.com/docs/TECH204659
NOTE: If you are experiencing this particular known issue, we recommend that you Subscribe to receive email notification each time this article is updated. Subscribers will be the first to learn about any releases, status changes, workarounds or decisions made.
Article Type
Technical Solution

Product(s)

Issue



Some event processes will cause EV Backtrace to generate excessive logs which may cause the associated install location's drive to run out of drivespace.


Cause



EV Backtrace is designed to monitor the Enterprise Vault Event Log systematically for Errors and Warnings and record the process functionality prior to the Event.  This log can then be leveraged to identify additional details of the process causing the Event. Backtrace is designed to track Events ID's per Process Name and Process ID, customizable within the registry.  Backtrace limits the number of occurances of an Event per day using the following Registry value:

 
HKEY_LOCAL_MACHINE
 \SOFTWARE
  \Wow6432Node
   \KVS
    \Enterprise Vault
     \Backtrace
 
Name : MaxEventsOfEachTypePerDay
Type   : DWORD
 
NOTE: See HOWTO74977 for further details regarding the Backtrace registry settings.
 
In certain circumstances, a Process ID can exit at the time of the Event and a new Process, with a new Process ID, will be generated.  The MaxEventsOfEachTypePerDay value will reset the active count for each new process and due to the unique Process ID(s) generated, the maximum count set may never be reached.  This will cause Backtrace to continually report on each unique occurance of the Event, which can produce excessive logs to be generated.
 
Example Event:
 
Type : Warning
Date : <Date>
Time : <Time>
Event : 41450
Source : Enterprise Vault 
Category : EVArchivingReportGenerator
User : N/A
Computer : SERVER1.DOMAIN.COM
Description:
Cannot generate any archiving reports for 'SERVER1'.
 
Error.  The report folder path is invalid [d:\Program Files (x86)\Enterprise Vault\Reports\Exchange Mailbox Archiving\SERVER1\Scheduled\Scheduled_20130313_045758]

Solution



Workaround:

Exclude the Event(s) in question from Backtrace reporting:
 
1. Open Registry Editor.
2. Browse to the following key:
 
32-bit
HKEY_LOCAL_MACHINE\Software\KVS\Enterprise Vault\Backtrace
 
64-bit
HKEY_LOCAL_MACHINE\Software\Wow6432Node\KVS\Enterprise Vault\Backtrace
 
3. Right-click the registry value "Exclude" - Modify.
 
4. Change the Exclude (String) value to a semicolon separated list of Event ID(s) that Backtrace will ignore. (Ex. 41450)
 
5. Restart the Enterpise Vault Admin Service to have registry changes take effect.
 
Note: See TECH180757 for further details regarding Backtrace. 

This issue has been addressed in the following release:


Enterprise Vault 10.0.4 - Release Details
http://www.symantec.com/docs/DOC6317


Supplemental Materials

SourceETrack
Value3132836
Description

Backtrace floods log folder and fills drive causing system down.




Article URL http://www.symantec.com/docs/TECH204659


Terms of use for this information are found in Legal Notices