Video Screencast Help
Search Video Help Close Back
to help

How do you find what objects have been retrieved from the Archive in the last 48 hours?

Created: 15 Oct 2012 | Updated: 15 Oct 2012 | 4 comments
SheltonS's picture
SheltonS
0 0 Votes
Login to vote
This issue has been solved. See solution.

I'm new to EV (inherited it last month) and we just had an issue where an FSA protected volume suddenly lost 250GB of space over the weekend.  We show that no one added that much data to the volume so the only explination we can come up with is someone or something triggered a restore from archive for the 250 GB.  Being new to EV, however, I can't figure out how to prove this or find what person or process casued it assuming it was EV.  I've looked at the reports and they seem weak on this type of need and I found out we do not have auditing turned on.

Can anyone help?

 

Thanks,

Shelton

Discussion Filed Under:
, , , ,

Comments 4 Comments • Jump to latest comment

TonySterling's picture
TonySterling Trusted Advisor Partner Accredited Certified
How do you find what objects have been retrieved from the Archive in the last 48 hours? - Comment:15 Oct 2012 : Link

without auditing it will be a bit difficult to know for sure.

One thing to note, even if some recalled a lot of items the next time the FSA archive task ran it would normally convert them back to placeholders, unless you set a registry key to prevent it.

Tony Sterling
www.bluesource.net or www.bluesource.co.uk
Offices in the US and the UK

0
Login to vote
  • Actions
SheltonS's picture
SheltonS
How do you find what objects have been retrieved from the Archive in the last 48 hours? - Comment:15 Oct 2012 : Link

I was afraid that not having auditing was going to limit the information.  I have since activated it.

 

As for the other comment, won't the files need to re-age again before they will be converted back to placeholders?

0
Login to vote
  • Actions
TonySterling's picture
TonySterling Trusted Advisor Partner Accredited Certified
How do you find what objects have been retrieved from the Archive in the last 48 hours? - Comment:15 Oct 2012 : Link

No, FSA is a bit different than Mailbox shortcuts.  When you view a placeholder it only temporarily restores the item to the file server.  Some times the item reverts to placeholder before the archive task runs but if it hasn't yet reverted the file will be turned back into a placeholder with the task runs.

 

Tony Sterling
www.bluesource.net or www.bluesource.co.uk
Offices in the US and the UK

0
Login to vote
  • Actions
TonySterling's picture
TonySterling Trusted Advisor Partner Accredited Certified
How do you find what objects have been retrieved from the Archive in the last 48 hours? - Comment:15 Oct 2012 : Link

So there is one caveat, do you use Last access time for your rules?

The following TN has this:

A file that is recalled to the file server replaces the placeholder shortcut.

  • If the recalled file remains unmodified, then Enterprise Vault converts the file back to a placeholder on the next archiving service run. The only exception is if the archiving policy's shortcut creation rules are based on the last access time. In that case, Enterprise Vault reverts the file only when the shortcut creation rules are met.

  • If the recalled file becomes modified, then Enterprise Vault converts the file back to a placeholder according to the archiving policy's shortcut creation rules.

About placeholder shortcuts

Article:HOWTO57685  |  Created: 2011-08-01  |  Updated: 2012-09-23  |  Article URL http://www.symantec.com/docs/HOWTO57685

 

Tony Sterling
www.bluesource.net or www.bluesource.co.uk
Offices in the US and the UK

SOLUTION
0
Login to vote
  • Actions