Video Screencast Help
Symantec to Separate Into Two Focused, Industry-Leading Technology Companies. Learn more.

Error rebuilding Index for 1 specific user

Created: 08 Feb 2013 • Updated: 12 Feb 2013 | 5 comments
This issue has been solved. See solution.

Hi.

Since a few weeks we've been having problem with 1 specific mailbox.
See below for all the generated event logs about this problem.
We've tried lots of solutions provided by Symantec Forum but unfortenately that didn't lead to a solution in our case.

There are error messages implying we don't have enough memory available, even though the server is running with 12GB of mem this has never been a problem. Also there are messages about diskspace, I can assure you we have plenty of diskspace free.

Also tried to put the whole archive offline, rename the folder of the specific archive folder and let is rebuild completely.
Then after a while the same error messages as below show up in the Event Viewer.

After trying to find a solution for 2 weeks i'm hoping you could point me in the right direction.

Thanks in advance.

Log Name:      Symantec Enterprise Vault
Source:        Enterprise Vault
Date:          08.02.2013 10:43:30
Event ID:      7235
Task Category: Index Server
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      <servername.domain>
Description:
A low level indexing operation has failed
Error: Filter error [AV:24]
Index Id: 1FF4B881ADC47464EB39DE2B8534C43861110000vie-eu-archiv/Volume:32 (<name of user>)

For more information, see Help and Support Center at http://evevent.symantec.com/rosetta/showevent.asp?EvtID=7235
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Enterprise Vault " />
    <EventID Qualifiers="49156">7235</EventID>
    <Level>2</Level>
    <Task>25</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2013-02-08T09:43:30.000Z" />
    <EventRecordID>2505554</EventRecordID>
    <Channel>Symantec Enterprise Vault</Channel>
    <Computer><servername.domain></Computer>
    <Security />
  </System>
  <EventData>
    <Data>Filter error [AV:24]</Data>
    <Data>1FF4B881ADC47464EB39DE2B8534C43861110000vie-eu-archiv/Volume:32 (<name of user>)</Data>
  </EventData>
</Event>

Log Name:      Symantec Enterprise Vault
Source:        Enterprise Vault
Date:          08.02.2013 10:43:57
Event ID:      7187
Task Category: Index Server
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      <servername.domain>
Description:
Could not add Indexable Item and Per-user data to Index: Unspecified error  (0x80004005) 
Internal reference: 1FF4B881ADC47464EB39DE2B8534C43861110000vie-eu-archiv/Volume:32 (<name of user>)
Additional Info: AltaVista error

For more information, see Help and Support Center at http://evevent.symantec.com/rosetta/showevent.asp?EvtID=7187
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Enterprise Vault " />
    <EventID Qualifiers="49156">7187</EventID>
    <Level>2</Level>
    <Task>25</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2013-02-08T09:43:57.000Z" />
    <EventRecordID>2505559</EventRecordID>
    <Channel>Symantec Enterprise Vault</Channel>
    <Computer><servername.domain></Computer>
    <Security />
  </System>
  <EventData>
    <Data>Unspecified error  (0x80004005)</Data>
    <Data>1FF4B881ADC47464EB39DE2B8534C43861110000vie-eu-archiv/Volume:32 (<name of user>)</Data>
    <Data>AltaVista error</Data>
  </EventData>
</Event>

Log Name:      Symantec Enterprise Vault
Source:        Enterprise Vault
Date:          08.02.2013 10:48:17
Event ID:      7235
Task Category: Index Server
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      <servername.domain>
Description:
A low level indexing operation has failed
Error: can't allocate memory [AV:1]
Index Id: 1FF4B881ADC47464EB39DE2B8534C43861110000vie-eu-archiv/Volume:32 (<name of user>)

For more information, see Help and Support Center at http://evevent.symantec.com/rosetta/showevent.asp?EvtID=7235
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Enterprise Vault " />
    <EventID Qualifiers="49156">7235</EventID>
    <Level>2</Level>
    <Task>25</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2013-02-08T09:48:17.000Z" />
    <EventRecordID>2505560</EventRecordID>
    <Channel>Symantec Enterprise Vault</Channel>
    <Computer><servername.domain></Computer>
    <Security />
  </System>
  <EventData>
    <Data>can't allocate memory [AV:1]</Data>
    <Data>1FF4B881ADC47464EB39DE2B8534C43861110000vie-eu-archiv/Volume:32 (<name of user>)</Data>
  </EventData>
</Event>

Log Name:      Symantec Enterprise Vault
Source:        Enterprise Vault
Date:          08.02.2013 10:48:17
Event ID:      7313
Task Category: Index Server
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      <servername.domain>
Description:
Failed to commit Index updates to disk.
Reason: Not enough storage is available to complete this operation.  (0x8007000e)

Index Id: 1FF4B881ADC47464EB39DE2B8534C43861110000vie-eu-archiv/Volume:32 (<name of user>)
Index Path: D:\IndexD\index8\1FF4B881ADC47464EB39DE2B8534C43861110000vie-eu-archiv
Available Disk Space: 86331652 KB(86331652 KB)
Number of Items added: 8834
Number of Items deleted: 0
Number of Items updated: 0
Number of new words: 1246398
Additional Info: Makestable
                 Vers:-1 Mem Load:1 (Max:1310720) KB

For more information, see Help and Support Center at http://evevent.symantec.com/rosetta/showevent.asp?EvtID=7313
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Enterprise Vault " />
    <EventID Qualifiers="49156">7313</EventID>
    <Level>2</Level>
    <Task>25</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2013-02-08T09:48:17.000Z" />
    <EventRecordID>2505561</EventRecordID>
    <Channel>Symantec Enterprise Vault</Channel>
    <Computer><servername.domain></Computer>
    <Security />
  </System>
  <EventData>
    <Data>Not enough storage is available to complete this operation.  (0x8007000e)</Data>
    <Data>1FF4B881ADC47464EB39DE2B8534C43861110000vie-eu-archiv/Volume:32 (<name of user>)</Data>
    <Data>D:\IndexD\index8\1FF4B881ADC47464EB39DE2B8534C43861110000vie-eu-archiv</Data>
    <Data>86331652 KB(86331652 KB)</Data>
    <Data>8834</Data>
    <Data>0</Data>
    <Data>0</Data>
    <Data>1246398</Data>
    <Data>Makestable</Data>
    <Data>Vers:-1 Mem Load:1 (Max:1310720) KB</Data>
  </EventData>
</Event>

Log Name:      Symantec Enterprise Vault
Source:        Enterprise Vault
Date:          08.02.2013 10:48:27
Event ID:      7235
Task Category: Index Server
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      <servername.domain>
Description:
A low level indexing operation has failed
Error: a severe error occurred; cannot continue [AV:63]
Index Id: 1FF4B881ADC47464EB39DE2B8534C43861110000vie-eu-archiv/Volume:32 (<name of user>)

For more information, see Help and Support Center at http://evevent.symantec.com/rosetta/showevent.asp?EvtID=7235
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Enterprise Vault " />
    <EventID Qualifiers="49156">7235</EventID>
    <Level>2</Level>
    <Task>25</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2013-02-08T09:48:27.000Z" />
    <EventRecordID>2505562</EventRecordID>
    <Channel>Symantec Enterprise Vault</Channel>
    <Computer><servername.domain></Computer>
    <Security />
  </System>
  <EventData>
    <Data>a severe error occurred; cannot continue [AV:63]</Data>
    <Data>1FF4B881ADC47464EB39DE2B8534C43861110000vie-eu-archiv/Volume:32 (<name of user>)</Data>
  </EventData>
</Event>

Log Name:      Symantec Enterprise Vault
Source:        Enterprise Vault
Date:          08.02.2013 10:48:27
Event ID:      7235
Task Category: Index Server
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      <servername.domain>
Description:
A low level indexing operation has failed
Error: a severe error occurred; cannot continue [AV:63]
Index Id: 1FF4B881ADC47464EB39DE2B8534C43861110000vie-eu-archiv/Volume:32 (<name of user>)

For more information, see Help and Support Center at http://evevent.symantec.com/rosetta/showevent.asp?EvtID=7235
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Enterprise Vault " />
    <EventID Qualifiers="49156">7235</EventID>
    <Level>2</Level>
    <Task>25</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2013-02-08T09:48:27.000Z" />
    <EventRecordID>2505564</EventRecordID>
    <Channel>Symantec Enterprise Vault</Channel>
    <Computer><servername.domain></Computer>
    <Security />
  </System>
  <EventData>
    <Data>a severe error occurred; cannot continue [AV:63]</Data>
    <Data>1FF4B881ADC47464EB39DE2B8534C43861110000vie-eu-archiv/Volume:32 (<name of user>)</Data>
  </EventData>
</Event>

Comments 5 CommentsJump to latest comment

RahulG's picture

you may try creating the following DWord registry key 

 HKLM\Software\WOW6432NODE\KVS\Enterprise Vault\Indexing

NumWordsToWrite

and set the vaule as 50000 decimal and restart indexing service 

JesusWept3's picture

Yup and fwiw it is a memory issue more likely than not, even though you have 12gb memory, it's a 32bit app so it's space will be severely constrained

Also once you have finished with that index, remove the reg key or you will introduce disk thrashing

Phyrax's picture

Thanks for  the quick response, i've set the value to 50000 decimal and restarted the indexing service.
After this i reinitiated the rebuild of te specific enterprise vault archive and gave it some time.

After a while the same event messages appear in the event log. Did I do something wrong when applying this solution?

Kind regards,
Phyrax

JesusWept3's picture

Quick question
Do you have AntiVirus scanning the location? (not just full scan but on access scanning as well?)
Also where are these indexes located?
SAN? NAS? NetApp? Network share? local drive?

Maybe worth disabling Opportunistic locking as i've seen that as well cause issues like this

Also the archive, is it just a regular user mailbox? a journal mailbox? FSA share? sharepoint etc?

 

SOLUTION
Phyrax's picture

Hi,

Antivirus was not skipping these folder in both cases, configured it correct now.
The archives are located in a SAN, oppurtunistic locking has already been disabled.
This was conserning a regular user mailbox.

Right now the issue seems to be resolved as the archive is fully operational and I am not getting 50 messages per day regarding this specific user in my event log. I think it was the combination between the Anti Virus full/access scanning and setting NumWordsToWrite to 50000

Thanks for your quick answers!

Kind regards,
Phyrax