Video Screencast Help

Mail wont archive - email icon changes to timer then back to normal

Created: 30 Apr 2012 • Updated: 30 Jul 2012 | 22 comments
This issue has been solved. See solution.


I have a few users including myself that when we click on the "store" icon in outlook 2007/2010, the mail icon will change to the timer icon for 1min, then will revert back to the normal outlook mail icon.

From my understanding the way it should work is the timer icon should stay until they have been archived over.

I've checked the backups and they ran sucessfully the night before.  Restarted services, ran sync and the achriving taks.

Am i missing something?

We are running EV  Some user have outlook 2007 and some have 2010.

Discussion Filed Under:

Comments 22 CommentsJump to latest comment

TonySterling's picture

Is your server still in backup mode?

Another poster had a similar issue and it was due to none of the vault store partitions being open, can you check that?

Other than that, are there any errors in the Event log?  Maybe grab a client trace whilst trying to archive an item.

zoky's picture

Hey tony, thanks for the quick reply!!!

We have 4 vault storage groups setup. 1xFSA, 1xJournal, 2x mialbox.  All seem to be out of backup mode.  console allows me to set them into "backup mode"

Is there other ways of checking?

I just tried to store an emial and checked event viewer.  Had the below come from outlook

Starting reconciliation for the store C:\Users\spirkosz\AppData\Local\KVS\Enterprise Vault\E2B7758FAD11744C9F43E5407A348EEC\2012_04_06_0015.db for the following reason: The store was last opened on a different machine.

The store C:\Users\spirkosz\AppData\Local\KVS\Enterprise Vault\E2B7758FAD11744C9F43E5407A348EEC\2012_04_06_0015.db has detected a catalog checkpoint.

Reconciliation completed for the following store: C:\Users\spirkosz\AppData\Local\KVS\Enterprise Vault\E2B7758FAD11744C9F43E5407A348EEC\2012_04_06_0015.db. Stats: Added: 5, Deleted: 0, Modified: 0, Compared: 18, Version: 14.0.6117.5000.

TonySterling's picture

Easiest way to check backup mode is look in the Vault Admin Console, in the right pane click on the Vault Store Group and then check the Backup Mode column

As for you events, that just looks like Vault cache updating.  I was referring to the Event log on the EV server.

zoky's picture

stores all look to be out of backup mode!

on the EV server under "symantec enterprise vault" i can see a bunch of warnings, but nothing from my machine/user

TonySterling's picture

what are the warnings?  Anything to do with storage?

Can you grab a client trace whilst trying to archive?

Nups's picture

Hi Zoky,

Can you get the dtrace of EVExchangePolicySync process while the synchronization of the affected user is running. As well as the archiving task.

What happens when you try to restore an item back using the outlook restore button ?

Thanks and Regards, Backup Exec, BESR, Enterprise Vault

zoky's picture

Liferhytm - sorry but how do i do exactly do a dtrace?  I opened up dtrace.exe and then typed in "log exechangepolicysync", then i synced on my mailbox (i am affect), then stopped the logging.  Nothing is in the log file though.

GertjanA's picture

I had this a while ago turned out all partitions were closed.

Thank you, Gertjan, MCSE, MCITP,MCTS, SCS, STS

JuanAntonio's picture

Hi Zoky,

I had a similar problem than yours. I don't know the reason why this was happening, by finally I found a solution:

Article URL (How to remove Enterprise Vault (EV) properties from vault enabled Exchange mailboxes).

This is what I did:

- First restore all from archive to every mailbox having the problem (export).

- Then, use the EVPM utilitie as it's described in the article.

- Delete the archive.

- Wait until the archive is completelely removed (at the beginning it's marked for deletion).

- Finally enable those accounts again.

Hope this help (it worked for me).


Juan A.

Machine's picture


To use dtrace:

  1. On the relevant EV archiving server, open a command prompt (you can do this via the GUI now, but this is how I still do it)
  2. Navigate to the  Enterprise Vault folder
  3. Type "dtrace"
  4. Type "view"
  5. Look at the list for (in this case) EVExchangePolicySync and note the number next to it.  The lab box I have open is EV 9 and it's #20, but that may not be the same in your environment
  6. Type "set 20 v" (the 20 is the number mentioned above, the "v" means verbose)
  7. Type "log <pathname>\<filename>.log" (C:\EVExchangePolicySync.log, for example).
  8. Perform the sync of any afflicted user (including yourself), as recommended by liferhythm
  9. After a few minutes, type "log"
  10. When prompted for whether you'd like to stop logging, type "Y."
  11. Open and review the file for warnings/errors.
JesusWept3's picture

If you are tracing the Synchronization process, you would sync the AgentClientBroker if doing a single user manually through the task, or through the ArchiveTask if you were synchronizing ALL users at the same time or on a schedule.

The EVPolicySynchTask is for the Provisioning Task when the provisioning task is processing.

As for this error:

Starting reconciliation for the store C:\Users\spirkosz\AppData\Local\KVS\Enterprise Vault\E2B7758FAD11744C9F43E5407A348EEC\2012_04_06_0015.db for the following reason: The store was last opened on a different machine.

This is because the Vault Cache has downloaded a DB (PST File) that was built on the EV Server before the user downloaded it to their local machine. so its just (unnecessarily) warning you about it.

Anywho, the issue if not in read only mode sounds like the user was moved from one exchange server to another, their mailbox was not synchronized properly and when you attempt to archive an item its trying to go to the wrong Exchange servers Archiving task.

But really a client trace and a dtrace of AgentClientBroker as you are attempting to manually archiving items.

zoky's picture

thanks for the reply guys!  I've done a dtrace both on evexchangepolicysync and agentclientbroker.

I can see a few errors about unpacking a cab file etc, but nothing about me trying to archive an item.

I will try and log into another pc and see if i get the same issue.  Could be my current pc setup

AttachmentSize 14.19 KB
JesusWept3's picture

EVExchangePolicySyncTask was never going to return anything unless you were provisioning
I'm still not entirely sure what good a dtrace of a synchronization would have done in the first place.

So what I would suggest is this

1. client trace set to maximum on the outlook side
2. Dtrace of ArchiveTask and AgentClientBroker on the server

What is your storage btw?
It looks like you have a WORM device, is that right? (Write Once, Read Many)?
Devices like this are JukeBox storage arrays, NetApp with SNAPLock etc

The type of error you are getting seems to suggest either its a WORM device *or* the drive is out of space

\\GISVWA-EV04\EVPartition01cc686fa54df530$\ <--- that device, how much space does it have?

zoky's picture

I've done what you have suggested! See attached

EV has been setup to go to a netapp device.

gisvwa-ev04 is our journaling server.  just ran a report and only 647GB is being used.  I can see that space ran out, i have created another 500Gb and rolled over to it.

AttachmentSize 3.97 MB
KarlW's picture


Is the archiving task for this user on EV01 or EV02?  The client trace is sending the archiving request to EV02 (the users storage server) but the server trace looks like its taken from EV01.

The reason I ask is that I see no client requests hitting AgentClientBroker - this suggests that either you've traced the wrong archiving task server or perhaps an issue within IIS on server EV02.

Please could you make sure the server trace is the correct archiving task server, and to complicate things a little further a Dtrace from EV02 tracing W3WP, AuthServer and StorageArchive would be helpful.



JesusWept3's picture

if thats the case then it could be an MSMQ issue as well, you may want to check your outgoing queues because it will end up doing a ping pong effect between the two EV Servers

so all the HTTP requests go through to the Vault Storre server that holds the archive

1. Client submits a Store In Vault Request that goes to EVServer2
2. EVServer2 passes the request on to EVServer1 that places a message in A2 queue
3. EVServer1 passes the request from A2 to EVServer1's Storage Queues
4. EVServer2 passes the request from the storage queue back to EVServer1's A1 queue to turn in to a shortcut.

I have seen something similar to this in the past but items remained in a pending state, the item was actually getting archive, it was just the Storage Server didn't have permission to post to Task servers A1 queues.

zoky's picture

Karl - Yes my mailbox is going via ev02 server.  Sorry should have though of this before.  I have re-run dtrace.

JesusWept2 - You might be onto somthing!! have a peak at the new logs from EV02
AttachmentSize 115.1 KB
KarlW's picture

Seems to be a permission issue on the archive.  The user doesn't have access to the Inbox.  I've removed your user information but you should be able to find trace similar to the following;

1464 11:43:42.069 [4604] (ArchiveTask) <6768> EV:M CClientIdentity::CheckAccess - User xxx-xx\yyyyy does not have permissions (Write) to Archive Folder [Path = \Inbox VaultId = 181DA8B6685D7B349876714E50EC298ED1110000EV01]

I would check the permissions on the Inbox of this archive using PermissionsBrowser.  It may be a synchronization issue.



KarlW's picture

You can find PermissionsBrowser.exe in the EV install folder.  It allows you to view the permissions set on archives and the individual folders inside the archive.

If you search Connect forums you should find others use of it.  I can't find a HOWTO though.