Video Screencast Help
Symantec to Separate Into Two Focused, Industry-Leading Technology Companies. Learn more.

Vault store deletion - just looking for confirmation

Created: 27 Nov 2012 • Updated: 27 Dec 2012 | 19 comments
This issue has been solved. See solution.

I've read a handful of posts on getting rid of old EV data and am no facing the same scenario.  We are running EV 10.0.2 for Microsoft Exchange.

When we initially got EV, back in 2006 we set it up for journal archiving.  Then, in 2008 we decided to take all of our old emails (pre-2006) and import them into EV so we could take advantage of CA & DA.  We never full decided on an appropriate retention policy so we left it at forever.  Now, I'm glad I imported all those old emails into EV in their own vault store because I think it will make things easier...

I've been asked if we can remove emails from EV that are from a particular date and older that are outside of what is required for us to keep.  If I understand correctly, I can delete the vault store(s) that contain the imported emails in question and storage expiry will take care of removing the content and updating the indexes.  I also understand that this is provided there are no CA or DA interests in, or legal holds on, the content being deleted in those vault stores.

Sounds simple enough.  Am I missing or misunderstanding anything?  Thank you!!!

Discussion Filed Under:

Comments 19 CommentsJump to latest comment

AndrewB's picture

storage expiry is what will take care of deleting your archived data based on the retention policy that it was archived with. did you archive all those "old emails" with their own retention category? if so, it's recommended to slowly step down the retention so that the expiry process doesn't bog down the system.

Andy Becker | Authorized Symantec Consultant | Trace3 | Symantec National Partner | www.trace3.com

TonySterling's picture

So it sounds like you imported the old mail to it's own archives and\or vault stores.  If yes, you can just delete those archives directly and the indexes for those archives will also be deleted.

BigAnvil's picture

Tony,

Thanks for your valuable input.  Almost all. the data had been imported into its own archives/vault stores.  I did discover however, that a small portion of the data - the last part of 2006 - was live, rather than historical which means it exists in our main/active vault store.

Would the best way to delete the end portion of the 2006 data be to search against the journal archive via the web interface and use the delete option there?

TonySterling's picture

Search and delete might be the best option depending on how much data there is. 

Per chance, do the items have their own retention category?

BigAnvil's picture

They do have their own retention catgegory.  I just verified by doing a web search against the journal archive and items only show up if I choose the "Journaling" retention category.  Somewhere around 700,000 items will need to be deleted from there (the ones that fall outside the other vault store).

BigAnvil's picture

I guess I should clarify - the items that are only from 2006 do not have their own retention catgegory.  All journaled items from 2006 to current are in the "Journaling" retention category.  Deleting these 50 at a time is going to take forever...

BigAnvil's picture

I would think there should be some facility to delete emails based on the timestamp of the email and not just based on the archive date (whether that deletion is by expiry via the storage service or via a web page or other method besides searching the journal archive and returning only 50 results maximum at a time).

AndrewB's picture

where exactly are you limited to only 50 results at a time?

Andy Becker | Authorized Symantec Consultant | Trace3 | Symantec National Partner | www.trace3.com

BigAnvil's picture

AndrewB,

When you right-click on the Journal mailbox in Archives and choose "Search Archive", then conduct a "Browser Search", the maximum results that can be returned at one time is 50 (unless this is a configurable option).

AndrewB's picture

if you use the advanced browser search you can get up to 500 search results at a time!

go to http://evserver/enterprisevault/search.asp?advanced

Andy Becker | Authorized Symantec Consultant | Trace3 | Symantec National Partner | www.trace3.com

BigAnvil's picture

AndrewB - thanks for that reminder!  I had forgotten about the Advanced Search...  With almost 700,000 items to delete, that is STILL going to suck unless there's yet a better way.  There has to be other companies that have ingested legacy email that need to do this kind of thing as well.

I'll give it until mid next week and then mark your answer as the solution if no one comes up with something better.

TonySterling's picture

Well if Storage Expiry is based on the Modified Date cant you just run Expiry for mail older than 6 years?  When you did the migration the received date should have stayed the same.

If you have a look in the Help for Storage Expiry it says this:-

When you select modified date, the start of the Retention period is calculated as follows:-
- For Mail message, this is the time since the message was received.
- For documents, it is the time since the document was last modified."

BigAnvil's picture

Tony, I should be able to do that but I don't think I can.  Where my trouble comes in is with retention categories.

No one had deceided on a retention period initially, so all email was archived with a retention category of business which is set to "forever".  For the items that are in the main vault store, if I change the retention category called business to "older than six years" that still doesn't really take care of things.  My assumption is that if I apply a new rentention policy to delete items older than six years, we will begin deleting email older than six years as each day ticks by which, at the moment, isn't what's been communicated to me.

It's my understanding they want to keep emails from January 1, 2007 and forward.  If I apply the older than six years policy, come January 2nd 2013, we'll lose January 1,2007 emails.  On January 3rd 2013, we'll lose  January 2nd, 2007 emails, etc.

Not intending to be a pain but I don't see where I have an option to specify a calendar date for retention - I feel like that should be an option.

AndrewB's picture

retention settings in EV go by "older than" like you describe. so in theory, what you could do is turn of your expiry schedule once you hit the retention "date" that you're reaching for.

Andy Becker | Authorized Symantec Consultant | Trace3 | Symantec National Partner | www.trace3.com

BigAnvil's picture

AndrewB,

I did think about that but was trying to figure out how long the storage expiry will need to run before it cleans out those items - and - would I end up needing to leave the policy for expiration applied past the one-day window that I have available to run it? 

AndrewB's picture

there are so many factors that influence expiry, there's really no way to tell how long it's going to take to run. most likely, 1 day wont be enough.

Andy Becker | Authorized Symantec Consultant | Trace3 | Symantec National Partner | www.trace3.com

TonySterling's picture

Your mileage may vary but the expiry rate in the performance doc says this:

 
 

Items eventually pass their retention category and must be deleted from Enterprise Vault. Storage Expiry can be concurrent with archiving, but this slows down both archiving and deletion of items. On a server with 4 CPUs, items are expired at the rate of 100,000 items an hour. The rate is higher when items are stored in Centera collections where it is up to 200,000 items an hour. This figure applies to items that were archived in versions before Enterprise Vault 8.0. For items that are archived in Enterprise Vault 8.0, assume that they are deleted at least as fast as they are archived.

BigAnvil's picture

Tony/Andrew - Thanks for your assistance with this.  If you don't mind indulging me just a little longer... So, it sounds like the plan for me is to create a new retention category that will expire items older than six years and apply the policy to the journal vault store on the day we want expiry to start sifting through the emails.  We should then shut it off before the followind day to make sure we don't delete items forward of the December 31st, 2006 mark.

Assuming it makes it through most of the emails we want to expire, I may only have a small chunk of emails I'll need to manually delete via the web interface.  I guess my remaining question, assuming all of the above is correct, is does the retention category need to "reclassify" all the emails in the journal vault store before it will be able to start expiry?  Meaning, once I change the retention category on the journal vault store, does EV need to go through all the emails in the store first to determine which will expire and be deleted AND THEN it goes through and deletes them later?  I'm just wondering, do I need to apply the new retention category over the weekend so it has time to flag emails to be expired before it will actually delete them on January 1?

TonySterling's picture

No, you don't create a new retention category, that would only apply to items archived after you created it.

You change the retention period on the existing retention category to expiry older than 6 years.  Let Expiry run, at this point you can let it run until Dec 31st.  Then you can change the retention period back to forever or just disable Storage Expiry.

SOLUTION