Video Screencast Help
Search Video Help Close Back
to help
Not able to make it to Vision this year? Get a sampling in the Best of Vision on Demand group.

Unexpected behavior while archiving exchange-emails

Updated: 01 Mar 2012 | 7 comments
armacoma's picture
0 0 Votes
Login to vote
This issue has been solved. See solution.

We are testing exchange-archiving on an Enterprisevault 10 Server and we are experiencing unexpected behavior with this.

Our mailbox-policy uses the archiving strategy "Based on age" and the strategy value (Archive items when they are older than) is set to one month.

After archiving, there are some mails moved to the archive, but others which meet the archive credentials are left by Enterprisevault.
There is no consistency of the kind of messages not beeing archived. It's like a coincidence what's done with the mails in the box.

Unfortunately there are no messages in the eventlog indicating a problem.

Can anyone help us out?

Comments

Percy Vere's picture
02
Dec
2011
0 Votes 0
Login to vote

I suggest you perform a

I suggest you perform a dtrace of the archive tasjk fior one mailbox and that will tell you message by message why the item is not archived. To do the Dtrace:

 

Select to highlight the required EV Server in the left pane
From the top level menu, select Tool \ Advanced Features, this will allow you to view the 'Traces' option under the EV server
Right click Traces and select New - Trace to begin the wizard.
Select the relevant Category of Trace (Mailbox Archiving Issues - Exchange) and complete wizard to enable trace logging.
 
Post here if you like.
MarkBarefoot's picture
02
Dec
2011
0 Votes 0
Login to vote

Are these emails all

Are these emails all "original"? As in never been archived before, subsequently restored etc, as that can have a bearing.

Worth doing what Percy says, it will at least tell you the eligibilty testing.

Thanks,

 

Mark

Supportability Analysis Engineer for Enterprise Vault products.

 

**REMEMBER TO VOTE IF THIS HELPS AND MARK IT AS RESOLVED TOO IF IT IS!!**

armacoma's picture
02
Dec
2011
0 Votes 0
Login to vote

ok will try a dtrace

Thank you for the reply. I'll trace it using dtrace as mentioned.

I'll let you know the result.

Andy

JesusWept2's picture
02
Dec
2011
0 Votes 0
Login to vote

Also is this from scheduled

Also is this from scheduled archiving or on Run Nows?
It could be the Messages Per Pass which is set by default
So when the arching schedule first kicks off, it pushes every enabled user in to the exchange archiving tasks A5 queue, the task then goes through (usually 5 at a time by default) and connects to each mailbox and finds messages to archive, moved shortcuts and such

To keep things moving there is a Messages per pass setting, so by default it's set to 1000 email, after archiving 1000 email it then moves on to the next mailbox and so on and so forth until the A5 queue is cleared or until the archiving schedule ends, if it is clear and time is left in the schedule, it will requeue users who still had items to archive, and it will keep requesting users until its all complete or the Schedule runs out

So it could be something like schedule is too short, messages per pass too high, too many users on the exchange server, or as suggested it could be that items not being archived were previously restored in which case EV will not rearchive them until certain time has passed

Other than that could be something like the wrong message class, read vs unread, do not archive has been set on an item etc, but only the DTrace will tell you that for definite

armacoma's picture
02
Dec
2011
0 Votes 0
Login to vote

A: Also is this from scheduled

This is a test phase. The schedule is stopped and we are archiving manually: "RUN NOW" in normal mode. At this time, we are archiving 3 small mailboxes, that's all. In this case, the queue should be able to process all items. But for instance, we are unsure if actually archived items are from a previous archiving run. In between the customer did changes to the configuration... It's quite possibe, that items do not archive "anymore"... to check this out, we are attaching another mailbox and try it with the new one...

The dtrace has listed all allready archived items (Shortcutcreation), but failed items are not listed in the (verbose) log. There could be another issue (error message) in the log, but i didn't find it until now.

Andy

Maverik's picture
02
Dec
2011
0 Votes 0
Login to vote

http://www.symantec.com/docs/

http://www.symantec.com/docs/HOWTO42224

Does this technote assist with understanding the logic?  You can use tools like Outlook Spy and MFCMAPI to view message MAPI attributes that are mentioned in the article.  

If you see in the dtrace that the item is ineligable for archiving this is usually the reason why. 

TypoProne's picture
18
Jan
2012
0 Votes 0
Login to vote

things to check

The DTrace should help a lot.

 

It may also be worth your while to run a report prior to the archive run and after the archive run to compare the results and see if what was archived was expected. There is a great TN on how to read the not-too-intuitive archive report that is generated.

 

Also do you have a backlog in your queues at all? For a run now you should see entries when you select to archive against all users . KeyPlayers recommendation to use Outlook Spy is helpful but you did mention that you are not seeing references to the problematic messages at all....so that would make me think it is not yet hitting them .

 

I would also check your Exchange Event logs.  A lot of times I see issues on Exchange that are not obvious at any other time until EV is implemented. 9646 events come to mind when considering this . . .but there are others as well.

 

Hope this helps.

 

J