Video Screencast Help
Symantec Appoints Michael A. Brown CEO. Learn more.

Particular mailbox not being archived

Created: 01 Jan 2014 | 9 comments

Hello all,

EV version is  9.0.3.1164

We have a particular mailbox which stopped being archived about 6 months ago. There is nothing relevant in the event log about it (as I see it).

I have attached the Archiving Task report for this user, I didn't see an indication for a problem.

The thing is that when I run the archive job manually and choose this user it works as it should, but in the site scheduled nightly run it archives all mailboxes excpet this one.

 

 

 

Operating Systems:

Comments 9 CommentsJump to latest comment

Rob.Wilcox's picture

I'd suggest:

- Look at the Vault Store usage report, and see how many items are in the archive now.
- The report says that 190 items would be archived.
- Do a run now in normal mode for this mailbox
- Look at the Vault Store usage report, has the item count gone up? By roughly 190?

orik's picture

Rob, When I do a run now in normal mode, it archives the items according to the policy (older than one week) I can see it when I look at the shortcuts in outlook. But when the task runs for all mailboxes on its schedule, this particular mailbox stays untouched.

Rob.Wilcox's picture

Okay, i'm sure (somewhere) on the forums there is a post about MSMQ and the queues used for archiving...

Try enabling journaling on those queues - does an entry exist for the mailbox that you are having problems?

DTrace the archiving task just before the scheduled run starts.. and let it run through to the end. Search then, I think, for Process User.

irisst's picture

Has the mailbox in question been hidden from Exchange address list?

Best regards, Iris Landsbankinn

orik's picture

Thanks Rob,

I have enabled journaling on the a5 queue and there is no entry for this mailbox.

I ran dtrace on archiving task, I have now 55 100MB files from one of the night runs, these are the log lines that contain the specific user name, exported from all 55 log files I hope it gives enough information:

1:1:ArchiveTask_0036_084300_000037.log:83306:93954333 16:00:10.176 [12952] (ArchiveTask) <10772> EV:M CAgentExchSynch::ListMailboxesExchange2k - The account (/o=MAIL/ou=R1 Administrative Group/cn=Recipients/cn=TaliaA) is disabled and wont be synchronized until its been activated again
2:2:ArchiveTask_0036_084300_000037.log:83307:93954334 16:00:10.176 [12952] (ArchiveTask) <10772> EV:M CTaskControl::GetTarget - Entry not found in map [/o=MAIL/ou=R1 Administrative Group/cn=Recipients/cn=TaliaA] Current target count [0]
3:3:ArchiveTask_0036_084300_000037.log:83308:93954335 16:00:10.176 [12952] (ArchiveTask) <10772> EV:M CJournalTargetList::GetTarget[ByKey] - Entry not found in Journal mbx list Key:[/o=MAIL/ou=R1 Administrative Group/cn=Recipients/cn=TaliaA]
6:31:ArchiveTask_0036_084300_000037.log:334733:94230480 00:00:04.996 [12952] (ArchiveTask) <11376> EV:H {CArchivingAgent::processMailboxesInChunks2k:#9262} The account [/o=MAIL/ou=R1 Administrative Group/cn=Recipients/cn=TaliaA] is disabled and won't be processed until reactivated.
7:35:ArchiveTask_0036_084300_000037.log:340679:94236476 00:00:05.417 [12952] (ArchiveTask) <1012> EV:M CAgentExchSynch::ListMailboxesExchange2k - The account (/o=MAIL/ou=R1 Administrative Group/cn=Recipients/cn=TaliaA) is disabled and wont be synchronized until its been activated again
8:36:ArchiveTask_0036_084300_000037.log:340680:94236477 00:00:05.417 [12952] (ArchiveTask) <1012> EV:M CTaskControl::GetTarget - Entry not found in map [/o=MAIL/ou=R1 Administrative Group/cn=Recipients/cn=TaliaA] Current target count [0]
9:37:ArchiveTask_0036_084300_000037.log:340681:94236478 00:00:05.417 [12952] (ArchiveTask) <1012> EV:M CJournalTargetList::GetTarget[ByKey] - Entry not found in Journal mbx list Key:[/o=MAIL/ou=R1 Administrative Group/cn=Recipients/cn=TaliaA]
 

 

irisst, I am not managing the Exchange server but I can find the user in the address book so I guess it is not hidden.

 

orik's picture

Sorry for bumping it, but does anyone has an idea? I'm quite lost here

GertjanA's picture

Hello Orik,

1:1:ArchiveTask_0036_084300_000037.log:83306:93954333 16:00:10.176 [12952] (ArchiveTask) <10772> EV:M CAgentExchSynch::ListMailboxesExchange2k - The account (/o=MAIL/ou=R1 Administrative Group/cn=Recipients/cn=TaliaA) is disabled and wont be synchronized until its been activated again
 
Can you check and verify:
User-account in AD enabled? Can user logon to workstation?
In EV - Open console, expand Targets, right-click Exchange, display policies assigned to mailboxes. Type name, click find. Is user in a provisioning group, and does it have policies assigned?
If yes, verify (using disable/enable mailbox) you can disable mailbox, and re-enable again.
when done, sync mailbox (properties of task for exchange server user is on). verify sync is ok.
when done, run task in report mode again, then run in normal mode for only this user. Verify Ax MSMQ are getting items in them.
 
 

Thank you, Gertjan, MCSE, MCITP,MCTS, SCS, STS
Company: www.t2.nl

www.quadrotech-it.com

www.symantec.com/vision

orik's picture

Thanks GertjanA,

Our users are in different forest from the Exchange server so we work with linked mailboxes configuration. Every user has a "parallel" user in the exchange forest which is disabled, but it works like this for all users with no problem.

I have checked as you say, the user is assigned policies.

I have disabled and then enabled again the user, the report looks the same. I will check how it behavesafter scheduled archive and let you know.

 

 

Ben Watts's picture

Try removing the entry from the ExchageMailboxEntry table in SQL and then run a zap of the mailbox.

It is a bit of a hammer to crack a nut but I have seen this so many times where the hidden message/Entry in the ExchangeMailboxEntry table has a problem and this causes EV to ignore the archive on the scheduled archiving run but will run against it when carrying out a Run Now.

I am not promising that this WILL fix the issue but through my experience it has a very good chance of rectifying the issue.

***BORING BUT IMPORTANT BIT - MAKE SURE YOU HAVE A FULL GOOD WORKING BACKUP OF EV/SQL BEFORE CARRYING OUT THE BELOW, IF YOU ARE UNCERTAIN ABOUT CARRYING OUT WORKS ON SQL PLEASE CONSULT A SQL DBA****

1) Run the below query:-

USE EnterpriseVaultDirectory
SELECT * FROM ExchangeMailboxEntry
-- Choose one of the below to suit your needs then uncomment the line
--WHERE DisplayName = '%DisplayNameofUser%"
--WHERE LegacyMbxDN = '/o=MAIL/ou=R1 Administrative Group/cn=Recipients/cn=TaliaA'

This should pull back ONLY ONE entry, if it does then run the below to remove the entry from the table:-

2) USE ENTERPRISEVAULTDIRECTOY
DELETE FROM ExchangeMailboxEntry
-- Choose one of the below to suit your needs then uncomment the line
--WHERE DisplayName = '%DisplayNameofUser%"
--WHERE LegacyMbxDN = '/o=MAIL/ou=R1 Administrative Group/cn=Recipients/cn=TaliaA'

(Then run the first query again to ensure you have deleted the entry, it should not produce any results)

3) Then run the below to zap the mailbox of the hidden message that EV places in it when the mailbox is enabled:-
http://www.symantec.com/docs/TECH35614

It simply deletes the hidden message from the Exchange mailbox therefore making it appear as if it is a new 'non-EV enabled'. You will not lose any data from either Exchange or the Archive.

4) Once the above has been done run the Provisioning Task again, once this has completed check the provisioning report to ensure the mailbox has been picked up again, then run the first query again, this should pull back the one result again.

5) Once that is done, enable the mailbox as you would normally, except this time you will need to ensure the mailbox links to the existing Archive.

Once it has been enabled again wait for the following Scheduled Archiving run, in my experience this SHOULD fix it.

 

If the above doesnt help then I would suggest opening a case, its not usually a major issue when it comes to a single mailbox not archiving on the scheduled run but it may be faster if you have someone looking at all the evidence.