Unexpected behavior while archiving exchange-emails
Updated: 01 Mar 2012 | 7 comments
This issue has been solved. See solution.
We are testing exchange-archiving on an Enterprisevault 10 Server and we are experiencing unexpected behavior with this.
Our mailbox-policy uses the archiving strategy "Based on age" and the strategy value (Archive items when they are older than) is set to one month.
After archiving, there are some mails moved to the archive, but others which meet the archive credentials are left by Enterprisevault.
There is no consistency of the kind of messages not beeing archived. It's like a coincidence what's done with the mails in the box.
Unfortunately there are no messages in the eventlog indicating a problem.
Can anyone help us out?
Discussion Filed Under:
Comments
I suggest you perform a
I suggest you perform a dtrace of the archive tasjk fior one mailbox and that will tell you message by message why the item is not archived. To do the Dtrace:
From the top level menu, select Tool \ Advanced Features, this will allow you to view the 'Traces' option under the EV server
Right click Traces and select New - Trace to begin the wizard.
Select the relevant Category of Trace (Mailbox Archiving Issues - Exchange) and complete wizard to enable trace logging.
Are these emails all
Are these emails all "original"? As in never been archived before, subsequently restored etc, as that can have a bearing.
Worth doing what Percy says, it will at least tell you the eligibilty testing.
Thanks,
Mark
Supportability Analysis Engineer for Enterprise Vault products.
**REMEMBER TO VOTE IF THIS HELPS AND MARK IT AS RESOLVED TOO IF IT IS!!**
ok will try a dtrace
Thank you for the reply. I'll trace it using dtrace as mentioned.
I'll let you know the result.
Andy
Also is this from scheduled
Also is this from scheduled archiving or on Run Nows?
It could be the Messages Per Pass which is set by default
So when the arching schedule first kicks off, it pushes every enabled user in to the exchange archiving tasks A5 queue, the task then goes through (usually 5 at a time by default) and connects to each mailbox and finds messages to archive, moved shortcuts and such
To keep things moving there is a Messages per pass setting, so by default it's set to 1000 email, after archiving 1000 email it then moves on to the next mailbox and so on and so forth until the A5 queue is cleared or until the archiving schedule ends, if it is clear and time is left in the schedule, it will requeue users who still had items to archive, and it will keep requesting users until its all complete or the Schedule runs out
So it could be something like schedule is too short, messages per pass too high, too many users on the exchange server, or as suggested it could be that items not being archived were previously restored in which case EV will not rearchive them until certain time has passed
Other than that could be something like the wrong message class, read vs unread, do not archive has been set on an item etc, but only the DTrace will tell you that for definite
A: Also is this from scheduled
This is a test phase. The schedule is stopped and we are archiving manually: "RUN NOW" in normal mode. At this time, we are archiving 3 small mailboxes, that's all. In this case, the queue should be able to process all items. But for instance, we are unsure if actually archived items are from a previous archiving run. In between the customer did changes to the configuration... It's quite possibe, that items do not archive "anymore"... to check this out, we are attaching another mailbox and try it with the new one...
The dtrace has listed all allready archived items (Shortcutcreation), but failed items are not listed in the (verbose) log. There could be another issue (error message) in the log, but i didn't find it until now.
Andy
http://www.symantec.com/docs/
http://www.symantec.com/docs/HOWTO42224
Does this technote assist with understanding the logic? You can use tools like Outlook Spy and MFCMAPI to view message MAPI attributes that are mentioned in the article.
If you see in the dtrace that the item is ineligable for archiving this is usually the reason why.
things to check
The DTrace should help a lot.
It may also be worth your while to run a report prior to the archive run and after the archive run to compare the results and see if what was archived was expected. There is a great TN on how to read the not-too-intuitive archive report that is generated.
Also do you have a backlog in your queues at all? For a run now you should see entries when you select to archive against all users . KeyPlayers recommendation to use Outlook Spy is helpful but you did mention that you are not seeing references to the problematic messages at all....so that would make me think it is not yet hitting them .
I would also check your Exchange Event logs. A lot of times I see issues on Exchange that are not obvious at any other time until EV is implemented. 9646 events come to mind when considering this . . .but there are others as well.
Hope this helps.
J
Would you like to reply?
Login or Register to post your comment.