Event ID: 3250 and/or 3288 The following message could not be archived as it may be corrupt.

Article:TECH57396  |  Created: 2008-01-06  |  Updated: 2014-02-27  |  Article URL http://www.symantec.com/docs/TECH57396
Article Type
Technical Solution

Product(s)

Environment

Issue



Event ID: 3250 and or 3288 during archiving


Error



Type: Warning
Event: 3288
Source: Enterprise Vault
Category: Archive Task
Description:
A problem has occurred while archiving a message.
The archived item was not found or is no longer archive pending.
Task: Mailbox Archiving Task for Exchange Server
Message Title: RE: Email
Users mailbox dn: /o=O/ou=First Administrative Group/cn=Recipients/cn=user
Internal reference: CArchivingAgent::PI_BuildObjectsFromMessage() [0x8004010F]
V-437-3288

Type: Warning
Event: 3250
Source: Enterprise Vault
Category: Archive Task
Description:
The following message could not be archived as it may be corrupt.
Title: RE:Email
Mailbox: /o=O/ou=First Administrative Group/cn=Recipients/cn=user
V-437-3250


Cause



Items indicated in the Event ID 3250 and/or Event ID 3288 cannot be archived because the item is corrupt in some form. This is typically due to NULL terminated strings in the PGP signature. This is usually caused by some type of filtering software (spam, antivirus, etc.).
 


Solution




Check if the items are corrupt by opening, copying, or moving it to another folder. There may be an attachment on the email placed by the filtering software that is causing the problem. Or the email could be corrupt. 


Alternative workaround:
From EV8 onwards, it is possible to set a registry key that will enable Enterprise Vault to skip any items that generate a 3288 warning and continue processing the mailbox; the default behaviour is to stop processing the mailbox when a 3288 warning is thrown.

If the new registry key (below) is set, then processing of a mailbox will continue after Event 3288 is thrown for an item.
 
Warning: Incorrect use of the Windows registry editor may prevent the operating system from functioning properly. Great care should be taken when making changes to a Windows registry. Registry modifications should only be carried-out by persons experienced in the use of the registry editor application. It is recommended that a complete backup of the registry and workstation be made prior to making any registry changes.

 Key:
    HKLM\SOFTWARE\KVS\Enterprise Vault\Agents
 Item Name:
    ContinueOnMissingItemErrors
 Value (DWORD):
    Non-Zero to Enable the archiving process to continue when encountering missing items.



Note: It is highly recommended that the above workaround is introduced on only a temporary basis whilst the root cause of the corruption is identified and fixed.
 

Supplemental Materials

SourceEvent ID
Value3250
Description

The following message could not be archived as it may be corrupt.


SourceEvent ID
Value3288
Description

A problem has occurred while archiving a message.


SourceEvent ID
Value3250
Description

The following message could not be archived as it may be corrupt.


Legacy ID



297478


Article URL http://www.symantec.com/docs/TECH57396


Terms of use for this information are found in Legal Notices