What version and Service Pack of EV aer you using

Have you gone through any upgrades of earlier versions of EV

Have you run Storage Expiry before on your present version of EV

yeah the version is important, one thing i'd be interested in seeing, can you do a run now against the user?
do you get any 13360's at all?

There is an issue in EV8 where the VaultId doesn't exist in the vault table in the Storage database.

So what i would do is the following

1. Remote to the Enterprise Vault Server and open the Vault Admin Console
2. Hold CTRL-SHIFT and right click "Archives"
3. Select "Find Archives or Folders"
4. In the text box, enter "178D330BDD62DAB4ABEBCA29C286C01271110000vault1"
5. See if that comes back with any errors or whether it lists the user and folder correctly

6. Then in the VAC expand out Archives and then click Exchange Mailboxes
7. Find the problem user and then it will say what vault store the user exists in
8. you should see to the right of the user the Vault Store the user exists in

9. RDP to your SQL server or open a management studio
10. Run the following command and see if you get any hits

USE EVYourVaultStore
SELECT *
FROM Vault
WHERE VaultId = '178D330BDD62DAB4ABEBCA29C286C01271110000vault1'

If it doesn't return any results, then you will need to put on the following (if on EV8 SP3)
http://seer.entsupport.symantec.com/docs/341594.htm

EV8 SP1, upgraded pretty much from every version since the KVS days. We've been doing storage expiry for several years now.

What kind of storage are you using? Centera, NTFS, NAS?

nt

As JW can account for we have been through a big expiry issue. Follow his instructions and lets see the outcome. Also get a DTrace when you can so we can see whats happening

ok totally weird, sorry , get a dtrace of StorageDelete like liam suggested.
The deletion date being 1753 just means that its never been run against the archive, but the column does need a date/time stamp so it creates the earliest one you can have

will look more in to this for you, just as a matter of interest, can you find that user and folder, give yourself access to them, open the mailbox in outlook or OWA and archive something in that folder and try again

our EV service account already had access so i used that to open the user's mailbox via outlook 2003 and manually archived an email from her sent items. not sure what it is that you wanted me to try again but nothing appears to have changed as far as the sql query results and our expiry runs at 6am so i'll keep an eye out tomorrow for that.

what's the best way to setup the dtrace to run at 6am tomorrow to catch the storage delete events? scheduled task?

You can put a trigger on the DTrace to look for the event ID that way it will only start logging when the event happens

Here is the KB on how to setup a trigger in a DTrace

http://seer.entsupport.symantec.com/docs/284344.htm

Sorry, the reason i wanted you to manually archive an item is so that it updates the ArchiveFolder etc and update the modified dates because from what you said, that archive hasnt been touched in years, was just hoping it may kick start something, also i'm pretty sure wayne humphrey either in a blog or an article describes how to put evpm to run at a certain time

thanks for all the great advice. i'll get that dtrace setup and let you know how it goes.

scanner, JW,
i've attached the dtrace to my first post. thanks!

when i paste it in the VAC i get no results.

the sql query returns:
113C324F1457E384287BD251361DE86AD1110000vault1,99348,178,1,42,0,0,0,2008-03-21 05:50:01.707,NULL,1753-01-01 00:00:00.000

whaaaaaaaaaat?!
it can't be found in the vac?
great, so it's an orphaned folder

dont suppose you ever restored the enterprisevaultdirectory but not the Vault stores at any point in time?

give me a few minutes to think what can be done

do you think i should open a case for this issue?

Hi Andrew,

I would recommend getting a case going for this issue.  Sometimes a hands on look can find and resolve the issue faster than what can be done via the forum.

Do please report back your findings!  :)

cheers,

they will tell you to put on the hotfix that i mentioned above, then they will ask you to

1. Disable the user
2. Export the archive to a pst
3. Delete the archive
4. Re-enable the user
5. Reimport it and your problems will be resolved

just to update you on the progress:

02/12/2010: opened case via MySupport portal with all pertinent details and a reference to this post.
02/15/2010: symantec engineer emailed that he reviewed all the details and asked if we use CA/DA. I replied no.
02/17/2010: symantec engineer emailed asking if EV backup mode overlaps storage expiry schedule. I replied no.

I'm not sure if this answers your question but from the Storage Expiry Report on the particular vault store where the problem archive sits:
Number of vaults processed: 2116
Total number of expired items deleted: 8577

could you do a quick count on the archivepoint table?
i'm wondering if when it hits this user it kills the entire Storage Expiry thread, because i seem to remember having that issue with liam some time ago

run the following query

USE EVyourvaultstore
SELECT COUNT(ArchivePointId) FROM ArchivePoint

Does it return 2116 results?

JW: it returned 2116

he changed the refcount in the collections table as well right?

he did not make any changes to the collections table. also, the dvs file itself is still inside the cab. he said it would be deleted automatically once an expiry threshold was met and the cab was rebuilt.

Per Symantec:
"as far as changing the reference count for the .cab file, as this is only one item it will not make much of a difference on when the cab is rebuilt. If you want to change this I would recommend waiting until the upgrade to SP4, and then run EVSVR."