How to exclude applications from recalling Enterprise Vault (EV) File System Archiving (FSA) placeholder files during a backup or scan.

Article:TECH51039  |  Created: 2007-01-07  |  Updated: 2014-10-02  |  Article URL
Article Type
Technical Solution


It is possible to specify a list of programs that are prohibited from recalling archived items. This is most likely to be useful for antivirus, backup or any other type of file scanning program that does not honor the file system offline attribute which could cause recalls of all items marked as a placeholder.  FSA has limits on the number of files that can be recalled in a time window and during a backup this threshold is likely to be exceeded if offline files cannot be ignored.

To exclude specific programs from retrieving placeholder's specify the list of programs by editing a registry value on each file server that is running the Placeholder Service. 


To determine whether backup software is recalling files, do one of the following:

1. Use Windows Explorer to list files that have been backed up. Placeholder shortcuts have a unique icon and have the offline file attribute.

2. Check the File System Archiving report file. If files were recalled on the previous backup run, successive reports will show that an increasing number of files have been turned into placeholder shortcuts.

3. Dtrace the EVPlaceholderService and find the executable that is recalling the placeholder. (See Related Articles section TECH38122)

Method 1:

Warning: Incorrect use of the Windows registry editor may prevent the operating system from functioning properly. Great care should be taken when making changes to a Windows registry. Registry modifications should only be carried-out by persons experienced in the use of the registry editor application. It is recommended that a complete backup of the registry and workstation be made prior to making any registry changes.

1.  Go to Start | Run and type Regedit to open the Windows Registry.

2.  For Windows 32bits version, navigate to HKEY_LOCAL_MACHINE\Software\KVS\EnterpriseVault\FSA. For Windows 64 bits version, navigate to HKEY_LOCAL_MACHINE\Software\Wow6432Node\KVS\Enterprise Vault\FSA.

3.  Right-click on PlaceholderService and choose New | String Value and enter the name ExcludedExes.

4.  Edit the ExcludedExes string to specify the names of the program executable files, separated by semicolons (;). For example, to exclude Windows Explorer, 'MyBackupProgram' and a program called 'MyAntivirus' enter the following:


5.  Restart the Enterprise Vault File Placeholder Service

Note: This functionality is restricted to executables running on the local file server machine and NOT remotely from another server. This functionality is also not available when archiving from a NetApp filer and using Placeholders on a NetApp filer or Celerra device.


Method 2:

The EVFSABackupmode.exe program can be used to place the file server into a backup mode.  This operation may be scripted to run before backups.

1. Create the computer local group Enterprise Vault Backup Operators on the file server.  Alternatively a domain group named Enterprise Vault Backup Operators can be created.  If the file server is a Netapp, then the Enterprise Vault Backup Operators group must be created on the Netapp.

Note: When backup mode is restricted in this way, people who are not in the Enterprise Vault Backup Operators group can still recall files as normal.

2. Add the backup application service account to the computer group Enterprise Vault Backup Operators.

3. Confirm EV is not using the Pass-Through recall method to recall archived files, otherwise the EVFSABackupMode will be ignored. Pass-Through recall can be disabled and enabled on a per Server or per Volume Target basis so not the entire estate needs to be affected. Disabling or enabling Pass Through recall does not take a restart of any Services or Tasks.

4. Execute EVFSABackupmode.exe from the Enterprise Vault program folder (normally C:\Program Files\Enterprise Vault or C:\Program Files (x86)\Enterprise Vault) on the server that is running the Placeholder Service with the backup switch as displayed in the examples given below:


EVFSABackupmode.exe -backup MyWindowsServer
EVFSABackupmode.exe -backup MyFiler MyDirServ


Where MyWindowsServer is the name of the Windows file server that is running a Placeholder service.  MyFiler is the name of the NetApp file server.   MyDirServ is the name of the EV server where the Enterprise Vault Directory service is running, MyDirServ is only required for NetApp file servers.

5.  To return the server to normal operation run the following command:


EVFSABackupmode.exe -normal MyWindowsServer
EVFSABackupmode.exe -normal MyFiler MyDirServ


Where MyWindowsServer is the name of the Windows file server that is running a Placeholder service.  MyFiler is the name of the NetApp file server. MyDirServ is the name of the EV server where the Enterprise Vault Directory service is running, MyDirServ is only required for NetApp file servers.

To determine the status of the BackupMode when using a 'NetApp' device the following query can be executed against the FileServerEntry table in the EnterpriseVaultDirectory database:


Use EnterpriseVaultDirectory
Select DnsName,BackupMode from FileServerEntry


0- BackupMode not set

1- BackupMode is set

The only way to confirm that backupmode is set using non-NetApp/CIFS based storage is by running a dtrace on the evplaceholderservice.

Preventing file recalls on EMC Celerra

For an EMC Celerra device there is backup options to prohibit Active Directory groups or Active Directory accounts, such as a service account from triggering placeholder recalls from the Celerra file systems. For example, the service account for a backup program or antivirus program can be excluded.

To prevent members of a group or an individual account from triggering placeholder recalls through the CIFS interface, add the appropriate group or
account to the Celerra Backup Operators group. Then execute the following command to prevent those accounts from recalling placeholders:

fs_dhsm -m fs_name -backup offline

Where fs_name is the name of the file system on the Celerra.


Legacy ID


Article URL

Terms of use for this information are found in Legal Notices