Video Screencast Help
Symantec Appoints Michael A. Brown CEO. Learn more.

Problems after reindexing to 64bit. Slow/Mixed result searchs, flaky.

Created: 18 Jul 2013 | 5 comments

 

Hi All,

 

Recently upgraded our EV svr to version 10.0.3. 

All was going well until after we upgraded our indexes to 64bit  & we started doing a search of the journal store.  The upgrade took 38 plus days due to the amount 60million journaled.  However, on the old system searchs were relatively quick and the old svr was dated and low spec'd. 

Since, searching our journal now is really slow and flaky with results, it's not reliable.  Either not enough time to do a search error, parts of the system is being updated or just no results at all, nothing.  After kicking off a search our EV svr memory max's out at 16gb and after that our the page file gets hammered. 

Our sql svr dosen't seem to break a sweat while we search, I've removed AV off both svrs.  I've verified indexes, even rebuilt some of the ones that had failed items.  We still have a couple with missing items reported but overall all seems well.

We have a call open with support but they are being very slow.  I was on a 2+hour call with them and they eventually took a dtrace and have yet to hear from them.

Any help or ideas would be great.

 

Thanks,

 

Operating Systems:

Comments 5 CommentsJump to latest comment

GertjanA's picture

Hello Glyn,

Are you doing the search using Discovery Accelerator / Clearwell, or are you doing a search using the 'search archive' function?

 

Thank you, Gertjan, MCSE, MCITP,MCTS, SCS, STS
Company: www.t2.nl

www.quadrotech-it.com

www.symantec.com/vision

GabeV's picture

For EV 10, the Windows virtual memory should be 1.5 times of the total physical memory. Sometimes, it's necessary to increase it up to 2 times. By default, Enterprise Vault indexing is configured to use up to 1.5 memory of the total memory. However, that doesn't explain a degradation on the performance. I've seen in some scenarios that the archive search is not very efficient with large archives, where CA/DA performs much better with searching. Make sure that you have the latest hotfix installed on your EV 10.0.3 server:

http://www.symantec.com/docs/TECH205731

“Success is not final, failure is not fatal: it is the courage to continue that counts.”–Winston Churchill

Glyn Raymond the 4th's picture

GabeV

 

Thanks for the heads up on the page file, this has certainly given it a lift in the right direction.  I've doubled up and moved off the os disk, spread across 2 other drives.

 

Searchs are now comin back with good results, although still taking 4/7 minutes to return results.  Also, if the journal task is pulling email it comes up with the currently being updated page and results.

 

Anything else you can think of that we can tweak which will help?

 

Thanks Again,

GabeV's picture

Glyn,

I'd try to find a botteleneck that could be affecting the process, such as the disks. Where you have the indexes? Are they local disks, UNC or SAN LUN attached? Take a look at the disks and make sure are not being maxed out by the index process when doing a search (IOps, RPMs, etc). Next step would collecting a dtrace, but that's something you might need to get more in deep with tech support, since a performance analysis might some take some time to determine what processes are spending more time during the search.

I hope this helps !!

“Success is not final, failure is not fatal: it is the courage to continue that counts.”–Winston Churchill