Video Screencast Help
Symantec to Separate Into Two Focused, Industry-Leading Technology Companies. Learn more.

Event ID 6502 and 2856 after upgrading from SEV 2007 SP4 to SEV 2008 (8.0.2)

Created: 17 Jul 2009 • Updated: 21 May 2010 | 5 comments
This issue has been solved. See solution.

Hi all,

I have a really annoying issue that is preventing SEV from archiving to my current vault since I upgraded from SEV 7 to 8. Shortly after the upgrade which passed all checks and went through 100%, all was well until these two events starting filling up the Windows Event Log (Symantec Enterprise Vault). The product doesn't appear to archive once this message starts up and it fills the event log at a rate of around 60 events per second, so it grows to a full log in a matter of minutes. Event ID 2856 is almost always followed by 6502.

EVENT 2856

Failed to find configuration information for the Journaling Agent in the Directory Service on computer RSAVAULT

This could be because the Task was deleted before completing all its outstanding work.

Task entry id: 1845C5CF1F750CF4293292F98040574AF1011y00vault.rennies.co.za 
EVENT 6502

Failed to inform the Journaling Service of unsuccessful storage of a Saveset in a Vault Store.

Reason: Failed to find configuration information for the Agent in the Directory Service on computer This could be because the Task was deleted before completing all its outstanding work. Task entry id: [0xc0040b28]

If I put the Vault Store into 'Backup' mode, the error stops straight away, but obviously this prevents any further writing to the vault store, and even if I stop the Journally tasks and mailbox Archiving tasks while the store is open for writing, the events still persist. I can't find anything remotely similiar on the forums or via Google and the closest match mentioned MSMQ and items in the queues. I've purged any items in the queues and gone as far as to re-install MSMQ.

Any ideas? Short of re-installing the entire product, I can't find anything to resolve the issue.

Comments 5 CommentsJump to latest comment

MarkBarefoot's picture

Errors similar to the ones you mentioned are generated by StorageFileWatch, when an Archiving or Journaling task is deleted prior to completing all of its outstanding work. This is because there are entries in the JournalArchive table that have a "ServiceEntryID" referencing a deleted Task.

You can try this to rectify it - make sure you have a FULL backup of the Databases before doing anything :)

1. Record the new "TaskID" for the Exchange Server. This should be listed within the "Task" table of the EnterpriseVaultDirectory database.

2. Record the old "TaskID" within the Description of Event ID 2856.

3. Run the following SQL Update statement against the EVVaultStore database.

update journalarchive set serviceentryid = 'new_task_id' where serviceentryid = 'old_task_id'

4. Restart the Storage Service on the Enterprise Vault server.

Thanks,

 

Mark

Supportability Analysis Engineer for Enterprise Vault products.

 

**REMEMBER TO VOTE IF THIS HELPS AND MARK IT AS RESOLVED TOO IF IT IS!!**

SOLUTION
marccrowther's picture

I may need some help on retrieving that TaskID from the EnterpriseVaultDirectory. Would I use the SQL Management Tools to retrieve it and what would the table be named that has the actual TaskID entry name?

MarkBarefoot's picture

It states the table and DB name in step 1. You can use Enterprise Manager or Management studio depending on what version of SQL you have. Step 3 should be run against the particular DB you have for your vaultstores - this is just an example name in the step.

Thanks,

 

Mark

Supportability Analysis Engineer for Enterprise Vault products.

 

**REMEMBER TO VOTE IF THIS HELPS AND MARK IT AS RESOLVED TOO IF IT IS!!**

marccrowther's picture

Thanks. I found the TaskID's and updated them. The problem is now gone, but I'm stuck with an entirely new problem. When the Journal Task runs, it's now throwing out an Event Log Error ID 2850 and filling up the logs.

Source: Enterprise Vault
Catelgory: Journal Task
Event ID: 2850

Whilst post processing a message an error occurred in CArchivingAgent::PostProcessArchivedItem() whilst calling CExchangeShortcutAccessor::BuildFromSessionAndLocation().

Error returned from BuildFromSessionAndLocation(): 80040107

If I stop the Journal Task, the Event log error stops. I have also noticed the MSMQ queue for the Journal is growing really quickly. It's on 33000 messages, but the Journal Mailbox on Exchange only reports 3300 messages for archiving.

marccrowther's picture

I've opened up a new thread as the problem is a new problem most likely as a result of the upgrade, but the original problem on this thread is resolved. Link to new problem -> www-secure.symantec.com/connect/forums/sev-80-sp2-errors-journalling-task-eventid-2245-2270-and-2850