Enterprise Vault collection fails in one or more of the targeted index volume sets

Article: 100028208
Last Published: 2021-07-28
Ratings: 0 0
Product(s): eDiscovery Platform

Problem

eDiscovery EV collection finishes in 'Partial Success' and the following error is recorded in the Job Status Log.

Error Message

Error Code: 440878
INDEXING_E_INDEX_SEARCH_FAILED: The search failed due to a failure to search one or more of the targeted index volume sets.

Error searching archive name: JOURNAL 01, archive ID:ABCDEF0123456789ABCDEF1234567890EVJOURNALARCHIVE, Error Code:440878, Message:E_SERVER_UNAVAILABLE:The index server is not currently available

  • Received an unexpected exception from a searcher thread: [#422300] EV searcher error - 440,879 Searcher exited with non-zero error code
  • Caught interrupt - killing searcher

Error while searching JOURNAL01 EV01 - 440,878 - Error getting Search Result Property for Journal collection. Code:-2147352571, Message:Type mismatch.

  • Received an unexpected exception from a searcher thread: [#422300] EV searcher error - 440,851 Searcher exited with non-zero error code
  • Caught interrupt - killing searcher
  • [#422300] EV searcher error - 440,851 Searcher exited with non-zero error code

Cause

The eDiscovery Collection is overwhelming the EV Indexing server.

  • Failure occurs when using a large quantity in the filter 'custodian mapping' for EV Journal collections
    Example: 100 custodians
  • Failure occurs when submitting thousands of archive volumes in the collection search criteria 

Solution

If running 32-bit indexes (Alta-Vista version EV9),

  • Set the registry key Value to 30, if running EV servers with memory lower than the recommended 32GB. 

 \HKEY_LOCAL_MACHINE\SOFTWARE|Wow6432Node\KVS\Enterprisevault\Indexing
 Dword: MaxIndexServers
 Value: 30 (Decimal)
 Note: This registry key must be created if not present.

  • Lower the scope of the EV Collection.
Note If running EV servers with memory at the recommended 32GB or higher, remove the above registry entry if present.

For  EV10 and higher (non 32-bit index environments)

  1. Contact Veritas for technical assistance with adding a missing index to the Enterprise Vault Store databases (EV10 only). https://www.veritas.com/docs/000020076
  2. Increase memory to 32GB recommended and allocate 8 CPU cores on each EV server.

Note: EV 10 Best Practice - Enterprise Vault 10 Indexing (December 2011) https://www.veritas.com/docs/000081275

  1. Create a Pagefile to 1.5X installed physical memory on each EV server.

Note: EV 10 Best Practice - Enterprise Vault 10 Indexing (December 2011) https://www.veritas.com/docs/000081275

  1. Follow the recommended antivirus exclusions for Enterprise Vault. https://www.veritas.com/docs/000032085

 

** Special Exclusions for EV10 onward
C:\Users\<VaultServiceAccount>\AppData\Local\Temp\
C:\inetpub\temp\appPools\EnterpriseVaultAppPool\
C:\Windows\inf\Enterprise Vault Index Query Server\
C:\Windows\TEMP\
<install_path>Program Files (x86)\Enterprise Vault\EVIndexing\data
<install_path>\Users\<VaultServiceAccount>\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5
C:\EVStorageQueue (EV11 onward)

  1. Vault Service Account Temporary folder size.

All transactions requests from the Clearwell Collector to the EV server utilize the Vault Service Account (VSA) temporary folder for temporary storage. This folder needs to be able to grow large enough to accommodate Batch processing for Index (Search) and Storage (Export) requests on the EV server. Locating the VSA temporary folders on a hard drive with at least 20 GB free space availability is recommended for all EV servers.

  1. Separate the System page files from the Vault Service Account (VSA) temp folder onto different physical hard drives.  Also disable Anti Virus scanning on memory, the VSA temp folder and system paging files for all EV servers.  Reboot all EV servers to maximize memory availability prior to running the Clearwell collection.

ESA PROPERTY CHANGES: (recommended settings)
esa.icp.ev.searcher.outputTimeout = 300000 (5 mins) to extend the timeout for an EV response.
esa.icp.collection.evsearch.MaxThreads = 8 (default 10), to throttle the threads for searcher.
esa.icp.collection.evsearch.BatchSize = 5000 (default 50000) to throttle the batch size.

References

Etrack : 2218405

Was this content helpful?