Enterprise Vault (EV) archiving may return a 6882 error when attempting to index very large files.

Problem

Enterprise Vault (EV) archiving may return a 6882 error when attempting to index very large files.  The issue can effect Exchange Mailbox Archiving, Journal Archiving, Lotus Domino Archiving and File System Archiving. 

Error Message

Source: Enterprise Vault
Event ID: 6882
Task Category: Storage Crawler
Level: Error
Computer: EVSERVER.DOMAIN.COM
Description: Unable to complete retrieval request 
Reason: The compound file is too large for the current implementation  (0x80030111)

V-437-6882

Cause

This issue is caused when EV attempts to uncompress the data for indexing purposes.  The following file type is known to to cause this issue .xlsx, which is natively compressed.  The data within the file can uncompress to a much larger size then the size of the file on disk.
 

Workarounds 

Option 1

It may be possible to avoid the error by reducing the ConversionTimeout value on the indexing server.   This will cause the process to timeout on this file and move on to the next. 

Warning: Incorrect use of the Windows registry editor may prevent the operating system from functioning properly. Great care should be taken when making changes to a Windows registry. Registry modifications should only be carried-out by persons experienced in the use of the registry editor application. It is recommended that a complete backup of the registry and workstation be made prior to making any registry changes.
 

1.  Go to Start | Run on the EV server that contains the indexing service.

2.  Type regedit and click OK. 

3.  Expand the registry to HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\KVS\Enterprise Vault.

4.  Locate ConversionTimeout then right-click and choose Modify.

5.  Set the value to 3 and click OK.

6.  Restart the Enterprise Vault Indexing Service. 

7.  Monitor the EV Event Viewer log for the 6882 error. 

If the error continues to occur then move on to Option 2. 

Option 2

Rename the .DVSCC file associated with this error to allow the indexing process to move forward to the next item. 

1.  Locate the Item Id in the event log error.  It will be in the following format:

201204250666512~201205252025000000~Z~F0BCF3BA42FBB8F5E9FF6D1139FD7C41

2.  The first sequence of numbers contains the first two folders after the partition root path.  In this case it is 2012\04-25.

201204250666512~201205252025000000~Z~F0BCF3BA42FBB8F5E9FF6D1139FD7C41

3.   The last sequence of numbers contains the next two folders in the path.  In this case it is F\0BC. 

201204250666512~201205252025000000~Z~F0BCF3BA42FBB8F5E9FF6D1139FD7C41

The full path would be:  partition_root\2012\06-25\F\0BC.

Note:  The partition_root is the Location value on the General tab of the open partition properties under the Vault Store in the Vault Admin Console. 

4.  Go to the path and find the files that begin with the last sequence of numbers (F0BCF3BA42FBB8F5E9FF6D1139FD7C41).  There should be a .DVS, .DVSSP, .DVSCC, or possibly DVFCC file(s).  The .DVSCC or .DVFCC file will be in the following format. 

F0BCF3BA42FBB8F5E9FF6D1139FD7C41~##~########~00~1.DVSCC

5.  Add .6882 to all the .DVSCC files with that value in the name.  The file would then look like the following:

F0BCF3BA42FBB8F5E9FF6D1139FD7C41~##~########~00~1.DVSCC.6882

6.  Monitor the EV Event Log for the 6882 event. 

Note:  In both options the item will be searchable, however the attachment content will not be available for preview. 

Solution

This issue has been addressed in the following release:


Enterprise Vault 10.0.2 cumulative hotfix 2 release
http://www.veritas.com/docs/000087443

Enterprise Vault 10.0.4 - Release Details
http://www.veritas.com/docs/000003643