Video Screencast Help
Archiving and eDiscovery Community Blog
Showing posts in English
Rob.Wilcox | 20 Aug 2014 | 0 comments

One of the questions which comes up is whether or not to rollover archives in Enterprise Vault. End user archives typically don't get that big, usually a few Gb. File System Archives, Public Folder archives, and Journal Archives can all become pretty massive though over time. 

So should you have one large archive, or several smaller ones?

For end user archives I wouldn't recommend splitting them, and having multiple per user. The archives are just not going to get to the large scale that might cause issues. Even if an archive has 50,000,000 items in it, and is 400 Gb in size, that's a drop in the ocean compare with FSA Archives, Public Folder Archives and Journal Archives. Having split archives for end-users can be confusing too, because they'll see them in the search interface, and archive explorer.

For some types of archive there are benefits in splitting them up.  I'll cover FSA and Public Folder archives in a future article let's, for now, focus...

Rob.Wilcox | 17 Aug 2014 | 0 comments

A mailbox archive in Enterprise Vault will typically have on it, something called 'inherited permissions'. This is the owner. From time to time it might be necessary to remove this access, for example if someone is transferring to a different department or region.

The permissions show up like this:

i1_1.png

If you try to remove them using the Vault Admin Console, you get the following pop-up:

i2_1.png

What you have to do is use EVPM and Zap the Archive. How to do this is described in this technote: http://www.symantec.com/business/support/index?page=content&id=TECH44818. Once that's done, refresh the list of archives in the VAC, and the permissions will be gone:

i3_1.png

Rob.Wilcox | 14 Aug 2014 | 0 comments

Sometimes the niggles in Enterprise Vault drive me crazy. For example, just now I’ve tried to create a new FSA Target, and of course, I wanted this data to go to a new Vault Store. It’ not straight forward though…

I had to exit out of the new FSA Target wizard, and create the new Vault Store (and partition). That’s fine, I did that pretty quickly, as this is just a lab machine. But then when I go back to the FSA Volume Target wizard, and get to the point of picking the vault store, I can’t see my newly created vault store. So I have to exit the wizard, again.

I refreshed the part of the UI I was in (right click, refresh, on the FSA Target).  I went back through the wizard, and got to the Vault Store selection page, and still..  I can’t see the new Vault Store.

I thought I was going to have to restart the VAC, but I was determined not to unless I really had to.  In the end, I discovered that if I right clicked on the list of Vault Stores, and did...

Rob.Wilcox | 11 Aug 2014 | 2 comments

The new search interface delivered in Enterprise Vault 11 is a big step forward in look, feel, and functionality over the older versions. It of course relies on Enterprise Vault 11 on the back-end, in my limited testing you can use the EV 10 Outlook Add-in with the EV 11 Server on the back-end. But that's not what this article is about, this article is about some cool ways that you can search for data within an archive.

Boolean operators are operators that can be used within your search

The simples of these is of course AND, and OR.  So you can search for John AND Smith for example. You can search for Smith OR Jones. They're pretty simple. Everyone is probably already used to using things like this.

NOT is another Boolean operator, and this can be quite powerful if there is a recurrence of something in your initial search results that you want to exclude. Not comes in two forms, the word NOT, and the minus sign (-). So you can have -Jones, which will...

Rob.Wilcox | 08 Aug 2014 | 0 comments

Sometimes checking the Hidden Messages which Enterprise Vault users to store policy and desktop settings is necessary. Sometimes it’s just to validate that the messages are there, sometimes it’s to actually check the settings.

It’s really quick to do with this with Outlook Spy. Take a look at the screenshot below which shows how easy it is:

W7__and_AS02.png

Rob.Wilcox | 02 Aug 2014 | 0 comments

I’m all for making systems more secure and robust, and one of the changes which often implemented ‘after deployment’ is to change Enterprise Vault to use HTTPS rather than plain, old HTTP.  The problem with this is that it can break existing archived content, and in this article I’ll talk about placeholders with FSA.

A placeholder in FSA contains a ‘link’ back to the original item in the archive.  A small utility called fsutil can be used to view the contents of the placeholder like we see here:

2014-07-28_10h06_43.png

What this means it that if you change Enterprise Vault (and IIS) to use HTTPS these placeholders won’t work, because they were built using HTTP.

The Cure?

The cure for this is to recreate the placeholders. Fortunately FSAUTILITY has an option to do that, the -c switch.

Have you ever changed from HTTP to HTTPS...

Rob.Wilcox | 30 Jul 2014 | 4 comments

In the past version numbers within Enterprise Vault were pretty straight forward. You had the base release, and service packs.  Sometimes people would have hot fixes, but that usually affected a handful of files. It all got a bit more complicated with the introduction of the Cumulative Hotfixes. And worse, it’s not easy any more to find out what specifically is installed. Let’s take a few examples:

On a regular Enterprise Vault 10.0.4 environment you might see that the binaries are like this:

Screen Shot 2014-07-28 at 12.06.42.png

And if you do Help -> About Enterprise Vault in the VAC you’ll see:

Screen Shot 2014-07-28 at 12.06.53.png

That’s good, but how do I know if I have installed the 10.0.4 Cumulative Hotfix...

Rob.Wilcox | 27 Jul 2014 | 0 comments

Quite often end-users make use of Virtual Vault to archive things that they no longer need in their mailbox. How do they do this? What happens to the Virtual Vault files? Let's see...

First of all, as we all know, Virtual Vault and Vault Cache work in tandem. Virtual Vault itself really consists of just a metadata cache (the MDC file). If you have that, then you have Virtual Vault in your Outlook mailbox profile. Here is one for my test user:

2014-07-27_11h31_47.png

When I drag and drop some items from my mailbox into Virtual Vault, what happens to them?

First of all, they are added by the Enterprise Vault Outlook Add-in to the MDC file. Here you can see the size difference from the previous screenshot, after I dragged and dropped a folder from Outlook into Virtual Vault:

...

Rob.Wilcox | 24 Jul 2014 | 0 comments

A few weeks ago I helped on a forum post on the Symantec Connect forums (If you're an EV person, and don't use those forums, you should!). The issue was about the 'typical' secretary/manager relationship that exists in many companies around the world, and the issue related to restoring items.

Say you have a typical secretary/manager relationship and, when logged in as the secretary, you try to restore something to the managers Inbox folder. The user interface in the new Enterprise Vault 11 Search application is pretty slick and it lets you pick the folder you want to restore the item to. In my case I chose the Inbox of the Managers mailbox.

When the "Restoring" window then pops up, unfortunately it says it's restoring it to:

\\sec1@ev.local\Inbox

argghh That's the secretaries folder.  That's not what I selected in the previous step.

Turns out that this is a bit of a bug, I think, and the person on the forums was going to follow this up with...

Rob.Wilcox | 18 Jul 2014 | 0 comments

Items Pending Indexing

From time to time you may get into a situation where indexing in Enterprise Vault is lagging behind. It happened to me just the other day when ingesting a large amount of data into some test archives. I'm sure of the exact trigger, but the net result was that the indexing service stopped. This didn't immediately cause me an issue, because the data was still added to the archive. But searching for the data was a bit tricky!

This can happen in a production environment too. Perhaps it's something you've encountered, or had escalated to you from the IT Helpdesk? 

A couple of handy SQL queries can help with figuring out if this is something that is affecting your environment:

select COUNT (*) from JournalArchive where IndexCommited = 0 

The output in my environment looked like this:

Image_11.png
The second query is used to...