Video Screencast Help
Give us your opinion and win with Symantec! Please help us by taking this survey to tell us about your experience with Symantec Connect, so that we can continue to grow and improve.  Take the survey.

Invalid SIS part

Created: 18 Oct 2012 • Updated: 12 Nov 2012 | 2 comments
This issue has been solved. See solution.

Hi, I'm using EV10 SP1, Exch2010.  On both EV servers (mailbox and journal) I am getting a few of the below warnings. 

Log Name:      Symantec Enterprise Vault
Source:        Enterprise Vault
Date:          10/19/2012 9:27:51 AM
Event ID:      7110
Task Category: Storage File Watch
Level:         Warning
Keywords:      Classic
User:          N/A
Computer:      server.domain
An invalid SIS part was encountered while doing watch file scan. Following further information is available.
 Partition Name = Journal Vault Store 01 Ptn01
 VaultStoreEntryId = 13E47CC3616170F46A80FAB9A914FD1991210000SVR01
 ParentTransactionID = E09F7A90495C0F383D6C19C77EE10561
 Invalid Reason = Verification failed for sis part when post processing Saveset with TID = [E0F727A7B3E8178299B5F849323CDA71].
Following sis part details are available:
  FPDistinctionByte = [35]
  FPHashPart1 = [-984110173]
  UniqueId = [0].

Ran a dtrace of storagefilewatch, storagemanagement which couldnt capture all the info as it was running over the buffer (ran for 3 mins captured 100MB), but it did get:

StorageFileWatch) <4208> EV:H {CSisPartVerifierExistence::VerifySISPart:#358} _com_error exception: [SIS part validation failed. The stored SIS part size is different to the size expected.      (0x80041bc2)] 

Anyone seen this before?


Discussion Filed Under:

Comments 2 CommentsJump to latest comment

TonySterling's picture

There is a bug floating around and you might be seeing it.  Please log a call with Symantec and refer to Etrack – 2914202 to verify. 

From what they can tell EV appears to be failing to read the size attribute of a SIS part during post processing which results in an Invalid SIS part error being encountered. There is no evidence of data loss and from the tests that have been done -  dump saveset retruns the item in its entirety.