Change in Legal Hold Process with DA 9.0.4 CU2 / 10.0.2 CU2
Recently we upgraded our EV 9.0.1 environment to EV 9.0.4 CU3 along with appropriate DA updates. Since the upgrade, we faced issue where cases stayed in "idle" status and the legal holds didn't apply at all i.e. items stayed in "remaining items" bucket for case.
We tried normal troubleshooting included with legal hold which can be read about here. However same didn't help. In the event logs we were getting Error 562, which basically indicates that some items could not be processed due to legal hold error.
On quick search for that error, i stumbled on this technote 66365 which tells you that after 9.0.4 CU2, DA will keep retrying applying legal hold on items which've been erroring out in hope that administrators have fixed the issue with that particular item accordingly. However, it still didn't explain why no item was going into hold state at all. The SQL query in above technote didn't help either.
Running out of option, we opened case with Symantec and after couple weeks of troubleshooting, they asked us to disable "Sync validation" configuration via DA client (which is hidden by the way, to display same, you'll need to show hidden settings in DA client, steps for which are covered here.)
After disabling Sync validation and restarting DA service, the items started processing and all items which DA didn't have any issue with were put on hold accordingly. The remaining items in our scenario basically are those which no longer exists in EV environment. The status changed from "Idle" to "To Add Holds" with some remaining items in case bucket.
According to Symantec, the DA should basically give up after n number of retries but in our case it is not doing so. Currently investigating same. If anyone has further thoughts in this direction, please do share.
Once we reach final case resolution, I'll update same here accordingly.
Hope it helps !