Index rebuilds fail to progress due to StorageCrawler looping on missing items and generating numerous event ID's 28998.

Article:TECH207347  |  Created: 2013-06-19  |  Updated: 2014-05-19  |  Article URL
Article Type
Technical Solution


When attempting to rebuild an index the process gets stuck. Review of the event log will show a series of event ID 28998.  Inspection of the event ID's will show that the event is being generated by the same saveset over and over again. Attempts to retrieve the item or perform a DumpSaveset operation with EVSVR fail to return the full item.


Log Name: Symantec Enterprise Vault
Source:  Enterprise Vault
Date:  6/18/2013 12:07:11 PM
Event ID: 28998
Task Category: Storage Crawler
Level:  Error
Keywords: Classic
User: N/A
Computer:  EVDG.EV.LOCAL
Description: Retrieval of a saveset failed. 
Reason: The system cannot find the file specified.  (0x80070002)
Saveset Id: 201306171497300~201306171927470000~Z~C16190FA09DD2A66360BD8302AEA8901
Vault Id: 113BB363634FE3644A95D6E44C01D2BBE1110000evserver1.EV.LOCAL
Index Sequence Number: 22
Internal Reference: Fetching Saveset for indexing

For more information, see Help and Support Center at
Event Xml:
<Event xmlns="">
    <Provider Name="Enterprise Vault " />
    <EventID Qualifiers="49156">28998</EventID>
    <TimeCreated SystemTime="2013-06-18T16:07:11.000000000Z" />
    <Channel>Symantec Enterprise Vault</Channel>
    <Security />
    <Data>The system cannot find the file specified.  (0x80070002)</Data>
    <Data>Fetching Saveset for indexing</Data>


The root cause is storagecrawler is attempting to retrieve an item that contains a SIS part that is contained in a CAB file that is no longer present and unrecoverable.

Attempts to repair the Vault Store Database using EVSVR with a DeleteSurplusReferences job do not resolve the issue.


This issue has been addressed in the following release:

Enterprise Vault 10.0.4 Cumulative Hotfix 1 Release

Symantec Enterprise Vault 11.0 0 Release Details

Supplemental Materials


Event Id 28998 may occur during an index rebuild operation

SourceError Code

 Event Id 28998 may occur during an index rebuild operation

Article URL

Terms of use for this information are found in Legal Notices