Video Screencast Help
Symantec to Separate Into Two Focused, Industry-Leading Technology Companies. Learn more.
Archiving and eDiscovery Community Blog

Rebuilding an Enterprise Vault Index in EV 9.0.3

Created: 10 Sep 2012 • Updated: 29 May 2014 • 5 comments
Rob.Wilcox's picture
-1 1 Vote
Login to vote

Rebuilding an index in Enterprise Vault is not necessarily something that you do every day -- nor should it be.

However, as a reference here is an outline of the steps that I followed just now to rebuild one of my test user indexes.

The user has a sizeable number of items in their archive (for a test user anyway!):

And I can see the state of their current index on the properties of their archive:

Now I issue a rebuild request from that screen and you then see the status change:

At the same time an event is logged in the Symantec Enterprise Vault event log:

When the rebuild is complete you will see another event:

Something which was added to the product quite some time ago was the ability to check on the progress of the rebuild.  Every 10,000 items the following is logged:

The event actually shows some really useful information, such as how far through the rebuild is, and an estimate of when it will finish.

How long the rebuild takes depends on a lot of different factors for example ...  how busy the Enterprise Vault server is at the moment, the type of storage device, the amount, size and complexity of the items, and the indexing level you are rebuilding to.  It is for those reasons that you need to watch out for the progress event ID's.

Another couple of things to be mindful of are two registry keys:

HKEY_LOCAL_MACHINE \ Software \ KVS \ Enterprise Vault \ Indexing



This will set the number of attempts to process an item before it is deemed to be poisoned.  It is actually used for two purposes.  Firstly if an error is found trying to open an index volume then after these many attempts it will be deemed corrupt and marked as failed.  If the error is found when trying to add items to the index, then the addition is abandoned and the index update steps on to the next item.

HKEY_LOCAL_MACHINE \ Software \ KVS \ Enterprise Vault



The maximum number of consecutive poison pill items before the index update is abandoned.  It will be restarted if the indexing service is restarted or the hourly check for pending updates.

So sometimes it might be necessary to set the first registry key low, eg 1-2.  And the second registry key high, eg 100+.  I personally wouldn't suggest changing them without investigating the cause of the failures though, and/or discussing it with Symantec Support.

Comments 5 CommentsJump to latest comment

TonySterling's picture

Just for reference you can find the TechNote here for EV 9:

How to rebuild an index for a mailbox

Article:TECH71770  |  Created: 2009-01-22  |  Updated: 2011-05-26  |  Article URL

You mention above that this is something you should do often bit it is import to highlight that rebuilding should be the last resort. Always try to Update or Repair the index first.

The TechNote covers some of the negatives of having to rebuild. 

One thing that neither the technote nor your blog post covers is that you can restore the index from a backup if you have one and then choose Update.  This would save the time of having to rebuild the entire thing. 


Login to vote
Rob.Wilcox's picture

Yes there are caveats / reasons for not rebuilding, and taking or investigating another avenue first.  I didn't go in to them in this particular blog entry because they are a world-of-discussion once you open the can-of-worms.

Thanks for pointing out the technote.  I can't see the details of it though, because I'm getting this:

Gateway Timeout

The proxy server did not receive a timely response from the upstream server.

Reference #1.d649212e.1348494929.11cc5853

Login to vote
TonySterling's picture

Weird about the TN opens right up for me.  I only mentioned the other options as when I was at Symantec it seemed like it took years to train customers to not just rebuild the index.  The indexes are pretty resealant now so if you find yourself in need of repairing or rebuilding it is it is my opinion that it is best to figure our why rather than just shotgunning and rebuilding.

In case the problem is affecting others here it is, sans images:


How to rebuild an index for a mailbox


Generally, rebuilding an index is an expensive operation with multiple negative consequences:
1. Searches fail against this archive until the index volume(s) are rebuilt,
2. There is a significant increase in CPU load, I/O handling, and network traffic on the Enterprise Vault server,
3. There is no "undo" or "pause" operation once the rebuild operation is initiated.
There are other options that may be appropriate for an index volume which can also be attempted with relatively little negative consequence before considering a full index volume rebuild:
1. Update index volume.  This option is usually appropriate when the index volume needs to be updated to reflect changes to archived items which have not been updated to the index - such as might happen after restoring an index volume from backup.
2. Repair index volume.  This option is usually appropriate if there is an issue with the index volume and it is desired to try to have the index volume "heal" itself, such as when the index volume is marked as "Failed".
If an issue has come up that requires an index volume to be rebuilt, it is a good idea to keep a record of the "current state" of the particular index volume.  This can be done via:
Index Volume rebuild preparation:
1) Stop the Enterprise Vault Indexing service associated with the index volume,
2) Move the index volume folder to another location, or rename it, and
3) Start the Enterprise Vault Indexing service
Index Volume rebuild steps:
In the Enterprise Vault Administration console:
1. Expand Archives,
2. Click on Exchange Mailbox,
3. On the right column, right click the archive in question and select "Properties",
4. Click on the Index Volumes tab, and
5. Right click on the index volume in question (this is one of the displayed rows) and select "Rebuild Index Volume"
Note: If the preparatory steps have been followed, then "Update index volume" can be substituted in step 5 with the same effect.

Legacy ID


Article URL

Login to vote
Rob.Wilcox's picture

Yep you're right - I'm also not suggesting you take off and nuke them from orbit :)  Just elaborating/documenting/describing what happens if/when you do take the plunge.

Login to vote
John Santana's picture

Is there any lost items when taking the "poison" pill approach described in the article above ?

Kind regards,

John Santana
IT Professional


Please be nice to me as I'm newbie in this forum.

Login to vote