Index rebuilds fail to progress due to StorageCrawler looping on missing items and generating numerous event ID's 28998.

Article:TECH207347  |  Created: 2013-06-19  |  Updated: 2014-05-19  |  Article URL http://www.symantec.com/docs/TECH207347
Article Type
Technical Solution


Issue



When attempting to rebuild an index the process gets stuck. Review of the event log will show a series of event ID 28998.  Inspection of the event ID's will show that the event is being generated by the same saveset over and over again. Attempts to retrieve the item or perform a DumpSaveset operation with EVSVR fail to return the full item.


Error



Log Name: Symantec Enterprise Vault
Source:  Enterprise Vault
Date:  6/18/2013 12:07:11 PM
Event ID: 28998
Task Category: Storage Crawler
Level:  Error
Keywords: Classic
User: N/A
Computer:  EVDG.EV.LOCAL
Description: Retrieval of a saveset failed. 
 
Reason: The system cannot find the file specified.  (0x80070002)
Saveset Id: 201306171497300~201306171927470000~Z~C16190FA09DD2A66360BD8302AEA8901
Vault Id: 113BB363634FE3644A95D6E44C01D2BBE1110000evserver1.EV.LOCAL
Index Sequence Number: 22
Internal Reference: Fetching Saveset for indexing

For more information, see Help and Support Center at http://entced.symantec.com/entt?product=ev&language=english&version=10.0.3.0&build=10.0.3.1090&error=V-437-28998
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Enterprise Vault " />
    <EventID Qualifiers="49156">28998</EventID>
    <Level>2</Level>
    <Task>113</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2013-06-18T16:07:11.000000000Z" />
    <EventRecordID>5069</EventRecordID>
    <Channel>Symantec Enterprise Vault</Channel>
    <Computer>EVDG.EV.LOCAL</Computer>
    <Security />
  </System>
  <EventData>
    <Data>The system cannot find the file specified.  (0x80070002)</Data>
    <Data>201306171497300~201306171927470000~Z~C16190FA09DD2A66360BD8302AEA8901</Data>
    <Data>113BB363634FE3644A95D6E44C01D2BBE1110000evserver1.EV.LOCAL</Data>
    <Data>22</Data>
    <Data>Fetching Saveset for indexing</Data>
  </EventData>
</Event>

Cause



The root cause is storagecrawler is attempting to retrieve an item that contains a SIS part that is contained in a CAB file that is no longer present and unrecoverable.

Attempts to repair the Vault Store Database using EVSVR with a DeleteSurplusReferences job do not resolve the issue.


Solution



This issue has been addressed in the following release:


Enterprise Vault 10.0.4 Cumulative Hotfix 1 Release
http://www.symantec.com/docs/TECH210673

Symantec Enterprise Vault 11.0 0 Release Details
http://www.symantec.com/docs/DOC7401


Supplemental Materials

SourceETrack
Value3233292
Description

Event Id 28998 may occur during an index rebuild operation


SourceError Code
Value3248441
Description

 Event Id 28998 may occur during an index rebuild operation




Article URL http://www.symantec.com/docs/TECH207347


Terms of use for this information are found in Legal Notices