When Enterprise Vault encounters a corrupt message during an archive run a 3288 event is logged and archiving stops.

Article:TECH78546  |  Created: 2010-01-05  |  Updated: 2013-05-29  |  Article URL http://www.symantec.com/docs/TECH78546
Article Type
Technical Solution

Product(s)

Environment

Issue



When Enterprise Vault encounters a corrupt message during an archive run a 3288 event is logged and archiving stops.


Error



Event ID 3288: A problem has occurred while archiving a message. The archived item was not found or is no longer archive pending.

A dtrace of the ArchiveTask will show the following results.  (See article TECH38122 for more information on dtrace.)

(ArchiveTask) <5452> EV:H :CArchivingAgent::WriteWorkItemsToQueue() |Calling MakeItemPendingAndQueueMsg() |Mailbox: /O=Org/OU=OU/cn=Recipients/cn=user |Message: Title |
(ArchiveTask) <5452> EV:M HRXEX fn trace :|Source     : .\ArchivingAgent.cpp (CArchivingAgent::MakeItemPendingAndProcessMsg) [lines {5543,5570,5574,5590,5592,5596,5600,5604}] built Jul 25 17:10:09 2007|Description: Call error 0x8004010f
(ArchiveTask) <5452> EV~W Event ID: 3288 A problem has occurred while archiving a message. |The archived item was not found or is no longer archive pending.   | |Task: Mailbox Archiving Task for MAIL |Message Title: Title|Users mailbox dn: /O=Org/OU=OU/cn=Recipients/cn=user |Internal reference: CArchivingAgent::PI_BuildObjectsFromMessage() [0x8004010F] |
(ArchiveTask) <5452> EV:H :CArchivingAgent::WriteWorkItemsToQueue() |Call to MakeItemPendingAndQueueMsg() failed |Mailbox: /O=Org/OU=OU/cn=Recipients/cn=user |Message: Title |Error Returned: c0040905 |
(ArchiveTask) <5452> EV:H :CArchivingAgent::WriteWorkItemsToQueue() |Exiting Routine. |
 


Solution



Solution 1: This is the default behavior and prior to Enterprise Vault version 8.0 the only workaround was to "Set Failed message to 'Do Not Archive'" in the Exchange Mailbox Policy (see Related Articles).

From version 8.0, Enterprise Vault can be configured to continue the current archive run when a corrupt message is encountered by implementing a registry key.

1.  Open REGEDIT and browse to the following location:

HKEY_LOCAL_MACHINE\SOFTWARE\KVS\Enterprise Vault\Agents  ( 32 bit)
 
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\KVS\Enterprise Vault\Agents  (64 bit)

2.  Click Edit - New - DWORD Value

3.  Rename the new value ContinueOnMissingItemErrors.

4.  Set the value data to a non-zero value.

5.  Restart the Enterprise Vault services.

Warning: Incorrect use of the Windows registry editor may prevent the operating system from functioning properly. Great care should be taken when making changes to a Windows registry. Registry modifications should only be carried-out by persons experienced in the use of the registry editor application. It is recommended that a complete backup of the registry and workstation be made prior to making any registry changes.
 
Solution 2: 
Extract the corrupted message, you can use Outlook exporting the item to a pst or using Microsoft Exmerge utility.
 

Solution 3:
Removing the affected message out of the mailbox to PST does not resolve the issue and the task is still "finding" the message in the mailbox. Try moving the mailbox to a different information store on the same Exchange server, this should filter out the corrupt messages.

 

Supplemental Materials

SourceETrack
Value1233378
Description

After an Event ID 3288 is thrown, archiving of other items in the mailbox completely stops.


SourceEvent ID
Value3288
Description

A problem has occurred while archiving a message. The archived item was not found or is no longer archive pending.


SourceUMI
ValueV-437-3288
Description

A problem has occurred while archiving a message. The archived item was not found or is no longer archive pending.



Legacy ID



339957


Article URL http://www.symantec.com/docs/TECH78546


Terms of use for this information are found in Legal Notices