Video Screencast Help
Symantec to Separate Into Two Focused, Industry-Leading Technology Companies. Learn more.

EV task is running but no email being archived

Created: 14 Aug 2013 • Updated: 09 Sep 2013 | 4 comments

Folks, 

I've been trying to figure out this issue that I am having for the last 2-days.

I have EV 9.0.1.1073 running on Windows Server 2003 Std Ed. w/ SP2 and Exchange 2010 (ver 14.02.0283.003) with a DAG setup running on Windows Server 2008 R2 Enterprise w/ SP1.

Question:

I just realized that EV has stopped archiving email for a while now.

Things I've checked:

1. All the DAG servers (active and standby) are on EV target list

2. My policy specifies all email older than 3 months should be archived

3. All services under Enterprise Vault Servers are running, i.e. Task Controller, Shopping, Indexing, and Storage

4. Archiving Task for all DAG servers are running (I have tasks that are running by using the Vault Service Account and by explicitly specifying the account that is a member of the local administrators on the DAG servers and a member of Organizational Management group.

5. On the event viewer I saw a warning telling me when each DAG server was scanned, and they are not too long ago, they are like 2-3 days ago (but why I don't see email being archived? or new email being archived? I checked randomly on different mailboxes on the "active" DAG servers and I can see email from last year not being archived. Am I missing something here?

6. I have also looked at this help article from the EV Doc Library:

Status: Days since Exchange mailboxes scanned for new items

Monitoring tab alert name: Days since Exchange mailboxes scanned for new items

Problem: Enterprise Vault has not checked users' Exchange Server mailboxes for new items to archive.

This problem can cause any of the following:

  • Quota problems for users. Because Enterprise Vault has not scanned mailboxes or archived from them, users may run out of mailbox space if mailbox quotas are enabled. Users who are nearly out of mailbox space receive warning emails from Exchange Server. This problem can lead to calls to your help desk.

  • Users who search archived items may receive incomplete search results because unarchived items have not been indexed.

  • Enterprise Vault cannot remove those old shortcuts that correspond to the archived items that have been deleted by expiry. These shortcuts are now broken and possibly need to be deleted for compliance purposes.

  • If you search user mailboxes for compliance reasons, the search results may be incomplete because items have not been indexed.

  • Enterprise Vault does not update archives to synchronize the location of moved items. The different locations may look strange to users. Also, users who restore items may find that the items may not be restored to the expected folders.

  • Enterprise Vault does not update archives to synchronize changes in permissions.

Work through the following steps to fix the problem
  1. The Exchange mailbox archiving task may not be able to start or may not be able to connect to Exchange Server. There may be a problem with permissions. Check the Enterprise Vault event log for errors.

    See http://www.symantec.com/docs/TECH138606.

  2. There may be a problem with the task logon account. The mailbox that the Exchange mailbox archiving task uses to log on to Exchange Server may have been disabled or deleted. In the Administration Console, check the properties of the task to make sure that the correct logon account is specified. Check that the logon account has the correct permissions.

    See Creating the Vault Service account.

  3. The Exchange mailbox archiving task may be stopped intentionally. For example, the task may be stopped because the Exchange Server is not longer used. If the task is not longer needed you may decide to disable or delete the task.
     
  4. Run the checks again to make sure that you have corrected the problem.

I have checked step 2-4 with luck - The only thing I didn't try is to run the script on the exchange server. 

I gladly appreciate if someone can help me out either by pointing me to the right docs or troubleshooting guides.

Thanks!

 

 

 

 

Operating Systems:

Comments 4 CommentsJump to latest comment

Rob.Wilcox's picture

Have you tried running the task in report mode and reviewing the file generated?

Are there any task related errors in the event log?

Pradeep_Papnai's picture

Can you check archiving schedule from the properties of each task, it should not be set to 'never' (if 'use site setting' is check the verify site properties schedule must be configured).

The archiving schedule should not conflict with backup schedule as in backup mode EV does not archive anything.

Run provisioning task in normal mode so current owner of database from DAG can be taken then run archiving task in report mode as Rob directed.

Vefify the 'no of item that would be archive' column. If it display the value then archiving in next run would archve that many items.

Understanding the Archiving Task report http://www.symantec.com/docs/TECH35622

You may run immediate archiving by runnow option again each exchange server those have active copy of mailbox database (right click on archiving task \ runnow \ normal, select either all or selected mailbox).

 

TypoProne's picture

Hey ozzi.

 

Thanks for the post. I can see some have tried to help you and if they were successful in their efforts please flag this posting as resolved and give proper credit to the posting which helped you to ensure that those seeking help can dedicate their time where it is most needed.

 

When I have seen these sorts of issues, I will run a report run of the applcable archiving task, check the Enterprise Vault Event log (not the notification thing where the OPs original examples came from... but the actual Event logs) for errors related to the report run. Assuming none exist, you should get a report. I would use the report and the TN that was provided by EV-Coun.. above to review the report and make sure the content you have in these mailboxes is eligable for archiving under the current policy settings.

 

If the report implies data is ready to be archive, do a "RUn Now" against applicable mailboxes from teh same task you ran a report on. I would then suggest another report.

 

I have worked with many many people who have the same concerns you have. The vast majority of these are a discrepency in what the administrator feels that should be archived compared to what the system is configured to archive. The method above should confirm that. If the first report shows nothing is ready to archive on the next run... nothing will be ready to archive on teh next run.

 

On occasion, there is an issue where there is a backlog of items to be archived and items are actually archiving... just not everything. This is also a configuration setting that the process above will confirm.

 

The least common issue is a problem processing the items. Report runs or Archive runs should generate events (most times) if they fail to successfully process the items. You would investigate those appropraitely.

 

ALso worth an honorable mention... if you ahve a backlog in your MSMQ it is possible that items are just stacking behind the request and nothing is being processed. If no reports are generated in teh first step... I would take a look here and see if you have such a backlog. Sometimes the queues Jam up and just cycling the MSMQ service will permit them to flow again... and sometimes other approaches are needed.

 

With this post and the posts above... you should be able to narrow the focus of your issue pretty substnatially. Please let us know the results and mark the proper posting as helping you to resolve your issue when the issue is resolved.

 

Thanks in advanced and I hope this posting helps you in some way.

 

Regards.