Video Screencast Help

FSA - archived files are recalled when browsing folders

Created: 30 Jul 2013 | 16 comments

Hi All,

I have an issue with enterprise vault 10.0 and FSA.

It happens that when some user browse a folder all archived files are recalled.

This cause space problem on the file server.

Do you have any idea?


Operating Systems:

Comments 16 CommentsJump to latest comment

Rob.Wilcox's picture

Is this from a Windows 7 or Windows 8 workstation?

Is preview turned on in Windows Explorer?

It's expected behaviour, if I remember correctly.

aiolfip's picture

The clients are Windows 7 Enterprise and preview is turned off.

EV_Ajay's picture


Are you having Antivirus Scan for FSA Target location ?



aiolfip's picture

these shared folder should not be scanned by our SEP.

And if it a AV related problems it should happen to all users.

Am I wrong?

GabeV's picture

If you are seeing this issue just for a few users, then there is a program installed on those computers that is recalling the EV placeholders. My suggestion, read this technote to identify which program is recalling the placeholders:

Since this is only for a few users, then it should be easy to troubleshoot it. Step #3 should be enough to identify the process (dtrace of the EVPlaceholderService):


To determine whether backup software is recalling files, do one of the following:

1. Use Windows Explorer to list files that have been backed up. Placeholder shortcuts have a unique icon and have the offline file attribute.

2. Check the File System Archiving report file. If files were recalled on the previous backup run, successive reports will show that an increasing number of files have been turned into placeholder shortcuts.

3. Dtrace the EVPlaceholderService and find the executable that is recalling the placeholder. (See Related Articles section TECH38122).

Another thing could be enable Pass-Through Recall in the EV server if you are unable to identify the process:

I hope this helps.

“Success is not final, failure is not fatal: it is the courage to continue that counts.”–Winston Churchill

aiolfip's picture
Here the dtrace...I can't find the exe name
any help=?
1519 15:40:41.691 [1260] (EvPlaceholderService) <1800> EV:M Wait for multiple objects...
1520 15:40:44.531 [1260] (EvPlaceholderService) <1800> EV:M Filter message event signaled [WAIT_OBJECT_0 + 1]
1521 15:40:44.531 [1260] (EvPlaceholderService) <1800> EV:M [EvRequestArchivedFile] Queueing placeholder request for file: S:\Shared\Departments\Finance\CASSA\Modulo cassa_Richiesta anticipo.xls
1522 15:40:44.531 [1260] (EvPlaceholderService) <1800> EV:L {RequestArchivedFile::RequestArchivedFile} (Entry)
1523 15:40:44.531 [1260] (EvPlaceholderService) <1800> EV:M WorkItem::GetExeName: Trying to get the .exe name for pid: 4
1524 15:40:44.531 [1260] (EvPlaceholderService) <1800> EV:M WorkItem::GetExeNameUsingPHHelper: entry - PID:4
1525 15:40:44.562 [1260] (EvPlaceholderService) <1800> EV:M WorkItem::GetExeNameUsingPHHelper: Failed to get .exe name for pid [4] using IPlaceholderSvcHelper, error: 0x80070005
1526 15:40:44.562 [1260] (EvPlaceholderService) <1800> EV:M WorkItem::GetExeNameUsingPHHelper: exit - PID:4, exe name:
1527 15:40:44.562 [1260] (EvPlaceholderService) <1800> EV:M WorkItem::GetExeNameUsingEnumProcessModules: The .exe name for for pid: 4 is
1528 15:40:44.562 [1260] (EvPlaceholderService) <1800> EV:M WorkItem::GetExeName: The .exe name for for pid: 4 is
1529 15:40:44.562 [1260] (EvPlaceholderService) <1800> EV:L {RequestArchivedFile::RequestArchivedFile} (Exit) Status: [Success]
1530 15:40:44.562 [1260] (EvPlaceholderService) <1800> EV:L {CQueue::EnQueue} (Entry)
1531 15:40:44.562 [1260] (EvPlaceholderService) <1800> EV:M CQueue::EnQueue item enQueued
1532 15:40:44.562 [1260] (EvPlaceholderService) <1800> EV:L {CQueue::EnQueue} (Exit) Status: [Success]
1533 15:40:44.562 [1260] (EvPlaceholderService) <7476> EV:M CQueue::DeQueue item deQueued
1534 15:40:44.562 [1260] (EvPlaceholderService) <7476> EV:L {CQueue::DeQueue} (Exit) Status: [Success]
1535 15:40:44.562 [1260] (EvPlaceholderService) <1800> EV:M FilterGetMessage() returned [800703e5] : Overlapped I/O operation is in progress.
1536 15:40:44.562 [1260] (EvPlaceholderService) <7476> EV:L {RequestArchivedFile::Process} (Entry)
1537 15:40:44.562 [1260] (EvPlaceholderService) <1800> EV:M Wait for multiple objects...
1538 15:40:44.562 [1260] (EvPlaceholderService) <7476> EV:M Processing a placeholder restore request for file: \\?\S:\Shared\Departments\Finance\CASSA\Modulo cassa_Richiesta anticipo.xls Url: https://sevault.xx.xx.xx/EnterpriseVault/download...., placeholder version: 1
1539 15:40:44.562 [1260] (EvPlaceholderService) <7476> EV:L {RequestArchivedFile::DownLoadFile} (Entry)
1540 15:40:44.562 [1260] (EvPlaceholderService) <7476> EV:L Attempting to download file: \\?\S:\Shared\Departments\Finance\CASSA\Modulo cassa_Richiesta anticipo.xls at Url: https://sevault.xx.xx.xx/EnterpriseVault/download.asp?VaultID=136B2B8103E48C14DB79ECE26FA7897601110000sevault&SavesetId=201305128360528~201209251532500000~Z~802341E4856364D3050E4188EBADE171&Request=NativeItem&EVHeaders=1&HashName=SHA256
1541 15:40:44.562 [1260] (EvPlaceholderService) <10532> EV:L {CDownloadFile::ThreadMain} (Entry)
1542 15:40:44.577 [1260] (EvPlaceholderService) <10532> EV:L {CDownloadFile::UpdateIntranetZoneSites} (Entry)
1543 15:40:44.577 [1260] (EvPlaceholderService) <10532> EV:H |[CDownloadFile] Inside UpdateIntranetZoneSites
1544 15:40:44.577 [1260] (EvPlaceholderService) <10532> EV:L {CDownloadFile::UpdateIntranetZoneSites} (Exit) Status: [Success]
1545 15:40:44.577 [1260] (EvPlaceholderService) <10532> EV:L WinHttpConnect handle = 0x74b4608 for URL=https://sevault.xx.xx.xx/EnterpriseVault/download.asp?VaultID=136B2B8103E48C14DB79ECE26FA7897601110000sevault&SavesetId=201305128360528~201209251532500000~Z~802341E4856364D3050E4188EBADE171&Request=NativeItem&EVHeaders=1&HashName=SHA256
1546 15:40:44.577 [1260] (EvPlaceholderService) <10532> EV:H ConnectForSegment:/EnterpriseVault/download.asp?VaultID=136B2B8103E48C14DB79ECE26FA7897601110000sevault&SavesetId=201305128360528~201209251532500000~Z~802341E4856364D3050E4188EBADE171&Request=NativeItem&EVHeaders=1&HashName=SHA256&Segment=0
1547 15:40:44.765 [1260] (EvPlaceholderService) <10532> EV:H BC 1
1548 15:40:44.765 [1260] (EvPlaceholderService) <10532> EV:H dwcode 200
1549 15:40:44.765 [1260] (EvPlaceholderService) <10532> EV:H BT 1
1550 15:40:44.765 [1260] (EvPlaceholderService) <10532> EV:L WINHTTP_QUERY_STATUS_TEXT : OK
1551 15:40:44.765 [1260] (EvPlaceholderService) <10532> EV:H File size:241152
1552 15:40:44.765 [1260] (EvPlaceholderService) <10532> EV:L {CDownloadFile::FetchFileChunks} (Entry)
1553 15:40:44.780 [1260] (EvPlaceholderService) <10532> EV:L Creating hash from 241152 byte source...
1554 15:40:44.780 [1260] (EvPlaceholderService) <10532> EV:L {CDownloadFile::FetchFileChunks} (Exit) Status: [Success]
1555 15:40:44.780 [1260] (EvPlaceholderService) <10532> EV:H Segment:1, read:241152
GabeV's picture

pid [4] is the System process in Windows. I remember seeing this issue when PGP is installed on the computer. Could you please check this TN and let me know if applies?

“Success is not final, failure is not fatal: it is the courage to continue that counts.”–Winston Churchill

aiolfip's picture

we have some involved user that have pgp install but other people affected by this issue doen't have it installed.

pgp is running with the last available version

Nathan Clark 2's picture

yep they will come in FileServer side, on PID 4 system process you need to troubleshoot client side with a procmon and try to determine what issues an open request for such files (advanced output look at the stacks of IRP_MJ_CREATE for the given files) .

This may not be easy as it maybe explorer.exe which possibly has some shell extension loaded (which you will need to look at the stack of, which is recorded in the procmon dump)

or call support

Swipe's picture

I have the exact same problem with just windows 7 clients. Only the placeholders within the active session window get recalled. Incidentlaly, browsing through windows explorer with XP or 2008 Server does not recall placeholders. I have a call open with support, awaiting a solution and will report back here when one has been found.

GabeV's picture

What kind of storage do you have? We've seen this behavior with Windows 7 clients and NetApp storages:

Unexpected Placeholder (PH) recall when NetApp PH is accessed from Windows 7 Client

Windows 7 machines can recall placeholders unnecessarily

However, if you already have a call open with support, they can provide more details on this issue.

“Success is not final, failure is not fatal: it is the courage to continue that counts.”–Winston Churchill

Swipe's picture

Yes, we have netapp filers for our storage. I've tried disabling preview and navigation panes and everything mentioned in those tech notes. One for support to figure out, I'm afraid.

GabeV's picture

Do you have any updates on this thread? Do you need more assistance regarding this topic? If not, please mark the post that best solves your problem as the answer to this thread.

“Success is not final, failure is not fatal: it is the courage to continue that counts.”–Winston Churchill

Swipe's picture

I have no update on this. My case is still open with support. They asked me to try a few things but none of them have resolved this.

The Boulon's picture


I just got the same at a customer where we implemented FSA.

The trick was to disable/deactivate the details pane in Windows Explorer.


Swipe's picture

Unfortunately disabling the details, preview or navigation panes in windows explorer didn't resolve the issue for us.