Video Screencast Help
Symantec to Separate Into Two Focused, Industry-Leading Technology Companies. Learn more.

1 user no longer Archiving with EV

Created: 18 Oct 2012 • Updated: 19 Oct 2012 | 13 comments
This issue has been solved. See solution.

Hi all,

Right ive just done the EV course, No previous experience with EV and now my first EV fault!

All my users are working fine except one, who's emails have not archived since Aug. Now she was on client 7.5 and i upgraded her to 9.04 (server version is 8). I thought with 9.0.4 having logs it maybe able to shed some light but no luck. Can anyone point me in the right direction to start troubleshooting this. Shes in all the right groups and everyone else is working fine.

Thanks in advance guys!

Comments 13 CommentsJump to latest comment

Rob.Wilcox's picture

I would suggest :-

a/ Check if she is 'suspended' from archiving.

Click on 'Exchange' under 'Targets', right click Exchange, and do Display Policies Assigned To Mailboxes.

b/ Check what happens if you do a run now in report mode just for this user.

Martin9991's picture

Hi there,

Thanks for your quick reply.

a. just checked and shes not suspended.

b. I went to tasks, and run the mailbox archiving task for this user in report mode "processing successfully launched for this user". Is that what you meant? as that has worked can i now run in "archiving" mode just for this one user?

Rob.Wilcox's picture

Regarding b.

What you need to do now is open Explorer, navigate to the REPORTS subfolder of your EV Installation folder, and locate the report that you just run..  and see what it says.

JesusWept3's picture

what rob was getting at was when you run in Report mode, it generates a text file in the reports directory that shows how many items the user has, how many are eligible for archiving etc, because it could just be that the user doesn't have any eligible items

And it will also show things like Quota, like are they over quota? if they are then EV will not be able to archive anything, are you doing quota based archiving and they are just way under quota so again, EV won't archive anything

Is the user moving all their items to a PST file, meaning that only things in the mailbox are new items etc etc,

Typically the best way to determine whats going on is to DTrace ArchiveTask and look for IsEligible statements to determine what items are being examined, and why or why not they are being passed over.

sometimes it can be that the items are unread and you are set to to not archive unread items, or that the items are just too new/young and that you have the policy set to not archive items younger than X amount of Days/Weeks/Months etc

SOLUTION
Martin9991's picture

Thanks guys,

Im struggling to find the report browsed both the below locations but nothing has been modified or created for the last few hours

Program Files\Enterprise Vault\Reports\Exchange Mailbox Archiving

Program Files\Enterprise Vault\Reports

so im a bit confused to where thats hiding.

Our Archiving is set based on age, every 30 days so obviously some are in the remit to be archived, All have been read aswell so that shouldnt be the issue.

How do i run a Dtrace for this user?

Again thanks for your help guys this is proving vary good information for future issues!

JesusWept3's picture

well first of all, how big is the users mailbox?
Typically when you right click the task, go to Run Now, choose the user and set it to run in "Report Mode", it should take several minutes to appear, if it doesn't it usually means that the mailbox is huge , and it takes time to examine each message in the mailbox.

If you go to the Event Viewer and look at the Symantec Enterprise Vault event logs, do you see any errors? especially regarding the user where it maybe failing to run or connect to the users mailbox?

Rob.Wilcox's picture

IF you go down the dtrace route:

Launch DTRACE

set ArchiveTask v

log c:\temp\userxyz.log

mon

Then run the task in either archive mode, or report mode, for this particular user.  Verify that 'stuff' starts to fly past the screen in DTRACE, then press Control C to stop the output going to the screen.

Wait a bit...

Wait a bit longer.

Type MON every now and again

Control C to interrupt it if it is still mega busy.

Wait a bit ...Wait a bit longer.

Until you think it's finished.

Then look at the log.

If the log file is 'huge' it's like that the archiving task is working, but maybe not finding anything eligible.

Martin9991's picture

right as soon as i done the below the trace went mad.

Launch DTRACE

set ArchiveTask v

log c:\temp\userxyz.log

mon

i then started the archive task in report mode and it continued to run like mad. I take it this dtrace wasnt just look at the task running in report mode? Looks like it was monitoring everything?

Martin9991's picture

Does the archive task need stopping before i run this?

Martin9991's picture

Half a GB of mail and no errors for this user is appearing in the log. I shall look at running the Dtrace and see what pops up.

Rob.Wilcox's picture

Yes when the archive task is processing, it will log a LOT of data.  It will be logging EVERYTHING that the task is instructed to perform - ie a report mode run of this single user.

So seeing it logging lots = good.

No you don't need to stop the task, unless it's already doing something, which it probably wasn't right?

Martin9991's picture

Started working now! thanks for all your help lads!