Video Screencast Help
Symantec Appoints Michael A. Brown CEO. Learn more.

1 Archive with 1 item under legal hold

Created: 07 Jan 2013 • Updated: 07 Jan 2013 | 11 comments
Joseph Correia's picture
This issue has been solved. See solution.

This is an EV 9.0.2 environment, single server running on Windows 2003.

At some point DA was used to do some test searches and legal hold was enabled.

Decided to perform intra-site archive moves to get archives to new vault stores on newer server so the Legal Holds were removed from the one and only case.

Post archive move a single source archive reported through Event Viewer that it could not be deleted due to items being on hold.

Question is this:

If DA had only a single case visible in the console and the associated Legal Hold was removed and then the case was deleted....why does an archive still report having an item on hold?

Is there a way to remove this so I can delete the storage it is on and finish decommissioning the source server?

Comments 11 CommentsJump to latest comment

AndrewB's picture

can you run this against your DA customer databases and see if it returns any results?

SELECT COUNT(*) FROM tblSearchResults

Andy Becker | Authorized Symantec Consultant | Trace3 | Symantec National Partner | www.trace3.com

AndrewB's picture

also look at the table in your vault store DB called "HoldSaveset"

This will show you all of the savesets on hold, and also the ArchivePointIdentity associated with each saveset.

Andy Becker | Authorized Symantec Consultant | Trace3 | Symantec National Partner | www.trace3.com

Joseph Correia's picture

The query executes successfully but produces 0 results.

TonySterling's picture

If you do a select * from holdsaveset against the vault store database do you get results there? (That is the second question Andy was asking about.)

You might have to delete the entries from there.  It could be when the case was deleted the hold wasn't lifted.  I seem to remember an issue in the older versions that when that happened it didn't clean up holdsaveset correctly.

Joseph Correia's picture

Tony - I executed the query and the results are zero.

AndrewB - here is the output from HoldSaveSet...although I'm not sure what to do with the info :)

HoldIdentity 9

SavesetIdentity 123385

HoldDataIdentity 2

HoldGroupIdentity 2

ArchivePointIdentity 1

AndrewB's picture

i believe you just want to delete that entry. i recommend to backup the db before you make any changes.

Andy Becker | Authorized Symantec Consultant | Trace3 | Symantec National Partner | www.trace3.com

SOLUTION
Joseph Correia's picture

This is the exact error from the Event Viewer Enterprise Vault log...

 

Following archive could not be deleted as it contains items that are on hold, or
their retention category does not allow deletions, or a compliance device
retention period prevents them from being deleted. 
 Archive Name = Doe, John
 Archive Entry Id = 12215246DE47939489B5DF52B6C066B5E1110000DSIVault 
 Total items on hold = 1 
 
TonySterling's picture

So how did you get results

HoldIdentity 9

SavesetIdentity 123385

HoldDataIdentity 2

HoldGroupIdentity 2

ArchivePointIdentity 1

if select * from holdsaveset had no results??

 

Joseph Correia's picture

Tony - my error the results you're asking about came from the query to HoldSaveSets. Prior to that Andrew asked for the results from a query to SearchResults which came back 0.

I confused the two as I was typing my response.

TonySterling's picture

Ah ok, you will just need to clear the entry out of the HoldSaveSets table and you should be good to go.

Joseph Correia's picture

Removing that remaining row from the HoldSaveSets table got rid of the problem.

thanks AndrewB and Tony!

 

Couldn't mark you both as the solution so had to give it to Andrew since he was first in..