EV80SP2 - temp location VSA filling up with EV$xxx.tmp files on 1 server only
This issue has been solved. See solution.
GertjanA
November 9th, 2009
Hello all,
This has been posted several times. We have set the mentioned registry keys (DelFileTypes=ExchangePerf*.dat;EV$*.*;*.tmp and DelFilesOlderThanHours=0) but the temp location keeps filling with EV$xxx.tmp files, where xxx is a number from A0 to 427
The size of these files varies from 4142 kb to 23170 kb.
Eventlogs:
Application = clean
SEV = clean
System = clean
There is Sophos on the server. It is set to exclude the temp folder being used. EV is archiving (EV storage Archive msmq has some entries, but these are going down.
Does anyone know what the EV$xx.tmp files are indicating? Why am i seeing this only 1 this one server, and not on the 14 other mailarchiving servers?
Any hints arre welcome
Gertjan
Filed under: Enterprise Vault, Backup and Archiving
From dtrace
In the dtrace I see:
1682 15:17:27.373 [2120] (AdminService) <8068> EV:M CMonitor::Monitor - returning 0x00000000 to caller|
1683 15:17:28.357 [632] (w3wp) <7996> EV~E Event ID: 6979 AutoStorageOnline error. |Reason: Access is denied. [0x80070005] |Reference: [CTSOL] |
1684 15:17:28.357 [632] (w3wp) <7996> EV~E Event ID: 6979 AutoStorageOnline error. |Reason: Access is denied. [0x80070005] |Reference: [CO] |
1685 15:17:28.373 [2120] (AdminService) <8068> EV:M CMonitor::Monitor([entity 1],[critical 95],[warning 90],[interval 0],[poll 0])|
Attaching dttrace
Thank you, Gertjan
MCSE, MCITP, MCTS Exchange 2007 SCS2007, SCS8.0
Company: www.t2.nl
Good site: www.enterprisevaultfaq.com
Good site: www.evdiscuss.net
Dtrace log attached to 1st post
Dtrace attached
Thank you, Gertjan
MCSE, MCITP, MCTS Exchange 2007 SCS2007, SCS8.0
Company: www.t2.nl
Good site: www.enterprisevaultfaq.com
Good site: www.evdiscuss.net
Take a read...
Please take a read through
https://www-secure.symantec.com/connect/blogs/ev-c...
In your trace I can see a bunch of good lookup activity where files are being deleted.
Also is this EV server doing mailbox archiving, FSA, or both, or something else?
Thanks
Rob Wilcox
EV Engineering Support
Answers
Hi Rob,
Server is doing only mailbox archiving.
The link to the blog seems to be not working. But I found the article.
Everything I found seems to be pointing to how to fix it, but I would like to know what caused it.
Why (all of a sudden) only 1 out of 15 mailbox-archiving servers starts showing this behaviour?
Windowspatches?
Antivirus?
Exchange?
Networkproblems?
Any clues?
Thank you, Gertjan
MCSE, MCITP, MCTS Exchange 2007 SCS2007, SCS8.0
Company: www.t2.nl
Good site: www.enterprisevaultfaq.com
Good site: www.evdiscuss.net
Magically resolved
I did some further digging on the eventlogs, and found lots of DCOM errors.
Most related to the indexserver, and some to the archivetask.
I edited dcom to allow everyone and vsa the proper controls.
Additionally, I disabled antivirus on that server. (although there is an exclusion on both on-access and scheduled scan)
I noticed the files finally going down.
When the folder was empty, I let it sit for an hour. You could see files coming in, and disappearing again.
I enabled antivirus again.
No problem. Until now, system seems to be running fine.
Lesson:
Read through all the eventlog, especially Application adn System, and not just the few days before.
Gertjan
Thank you, Gertjan
MCSE, MCITP, MCTS Exchange 2007 SCS2007, SCS8.0
Company: www.t2.nl
Good site: www.enterprisevaultfaq.com
Good site: www.evdiscuss.net
Would you like to reply?
Login or Register to post your comment.