Hi All,
We recently deployed 2x new EV servers, one file and one mail.
Both are VM's with the following specs:
OS: Server 2012 R2 (Latest patches as of 07/07/2014)
Ram: 16GB
CPU: 8x vProcs
EV Version: 10.0.4.1354
VMware Tools: 9.4.5, build 1734305
Our EV file archiving server has been generating errors around the Storage Crawler process for quite some time now. Symantec support are recommending a re-install of the entire OS, and also EV itself. Before we go down that path, I wanted to get the advice of some of the community members on here first. There must be a better way of resolving this then just blasting the thing and starting all over again. Yes it's a virtual machine, and yes all the config is back on SQL, but that's not really the point.
Below are the errors from the application log and specific Symantec Enterprise Vault Log. When it throws error 28998 for storage crawler, it also appears to throw event id 1000 in application logs. Both are listed below. I have also attached dtrace log when event occured. Dtrace was only against the storage crawler process, happy to re-run dtrace if people require.
Log Name: Symantec Enterprise Vault
Source: Enterprise Vault
Date: 3/09/2014 2:38:48 PM
Event ID: 28998
Task Category: Storage Crawler
Level: Error
Keywords: Classic
User: N/A
Computer: BNE-EV02.corp.detir.qld.gov.au
Description:
Retrieval of a saveset failed.
Reason: The data is invalid. (0x8007000d)
Saveset Id: 201408319519198~201106200139000000~Z~E01A8113B44E1DA1F250EA9485D42421
Vault Id: 16518AE13DD9FF64F8B266CB373D69EB31110000SSA-EVSITE01
Index Sequence Number: 66594
Internal Reference: Fetching Saveset for indexing
For more information, see Help and Support Center at http://entced.symantec.com/entt?product=ev&languag...
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Enterprise Vault " />
<EventID Qualifiers="49156">28998</EventID>
<Level>2</Level>
<Task>113</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2014-09-03T04:38:48.000000000Z" />
<EventRecordID>41305</EventRecordID>
<Channel>Symantec Enterprise Vault</Channel>
<Computer>BNE-EV02.corp.detir.qld.gov.au</Computer>
<Security />
</System>
<EventData>
<Data>The data is invalid. (0x8007000d)</Data>
<Data>201408319519198~201106200139000000~Z~E01A8113B44E1DA1F250EA9485D42421</Data>
<Data>16518AE13DD9FF64F8B266CB373D69EB31110000SSA-EVSITE01</Data>
<Data>66594</Data>
<Data>Fetching Saveset for indexing</Data>
</EventData>
</Event>
Log Name: Application
Source: Application Error
Date: 3/09/2014 4:21:34 PM
Event ID: 1000
Task Category: (100)
Level: Error
Keywords: Classic
User: N/A
Computer: BNE-EV02.corp.detir.qld.gov.au
Description:
Faulting application name: StorageCrawler.exe, version: 10.0.4.1189, time stamp: 0x51dd972f
Faulting module name: MSVCR90.dll, version: 9.0.30729.8387, time stamp: 0x51ea24a5
Exception code: 0xc0000417
Fault offset: 0x00059e63
Faulting process id: 0x3cc
Faulting application start time: 0x01cfc73f4e985040
Faulting application path: D:\Program Files (x86)\Enterprise Vault\StorageCrawler.exe
Faulting module path: C:\Windows\WinSxS\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.8387_none_5094ca96bcb6b2bb\MSVCR90.dll
Report Id: 8d48bc51-3332-11e4-80d4-005056a9664b
Faulting package full name:
Faulting package-relative application ID:
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Application Error" />
<EventID Qualifiers="0">1000</EventID>
<Level>2</Level>
<Task>100</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2014-09-03T06:21:34.000000000Z" />
<EventRecordID>191934</EventRecordID>
<Channel>Application</Channel>
<Computer>BNE-EV02.corp.detir.qld.gov.au</Computer>
<Security />
</System>
<EventData>
<Data>StorageCrawler.exe</Data>
<Data>10.0.4.1189</Data>
<Data>51dd972f</Data>
<Data>MSVCR90.dll</Data>
<Data>9.0.30729.8387</Data>
<Data>51ea24a5</Data>
<Data>c0000417</Data>
<Data>00059e63</Data>
<Data>3cc</Data>
<Data>01cfc73f4e985040</Data>
<Data>D:\Program Files (x86)\Enterprise Vault\StorageCrawler.exe</Data>
<Data>C:\Windows\WinSxS\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.8387_none_5094ca96bcb6b2bb\MSVCR90.dll</Data>
<Data>8d48bc51-3332-11e4-80d4-005056a9664b</Data>
<Data>
</Data>
<Data>
</Data>
</EventData>
</Event>