Enterprise Vault Indexing service fails to start stating event ids 41293 and  41312.

Problem

The Enterprise Vault (EV) Indexing service fails to start with event ids 41293 and 41312.This issue applies to EV 14.2 & later versions.

Error Message

The events seen on the Enterprise Vault server include - 

Event ID:      41293
Task Category: Index Admin Service
Level:         Error
Computer:      EVSERVER
Description:
An unexpected error has occurred.
Error Summary: Indexing Service start up error
Error Details: Fatal error in Indexing Service child process EV Indexing Engine Elasticsearch.

V-437-41293

Event ID:      41312
Task Category: Elasticsearch Indexing Engine
Level:         Error
Computer:      EVSERVER
Description:
The Elasticsearch Indexing Engine could not complete all the required startup routines: Failed to start Elasticsearch JVM. Service will be stopped.

V-437-41312

The exact problem can be seen in a Dtrace of the EVIndexAdminService and EVIndexingEngineElasticsearch processes on the EV server.

(EVIndexAdminService)    <13328>    EV~E    |Event ID: 41293 An unexpected error has occurred.|Error Summary: Indexing Service start up error |Error Details: Fatal error in Indexing Service child process EV Indexing Engine Elasticsearch.

(EVIndexingEngineElasticsearch)    <**:**>    EV~E    |Event ID: 41312 The Elasticsearch Indexing Engine could not complete all the required startup routines: Failed to start Elasticsearch JVM. Service will be stopped.

(EVIndexingEngineElasticsearch)    <***:216**>    EV-H    {ElasticsearchLogger} ElasticsearchException[failed to bind service]; nested: CorruptIndexException[Unexpected file read error while reading index. (resource=BufferedChecksumIndexInput(NIOFSIndexInput(path="I:\EVIndex\nodes\0\_state\segments_5a")))]; nested: NoSuchFileException[I:\EVIndex\nodes\0\_state\_2r.si];

Cause

This is caused by Core Elastic Engine files being missing or corrupt in the Index location.

Solution

Please make sure Antivirus Exclusions are in place as per https://www.veritas.com/support/en_US/article.100017720

1) You may restore this location from a working backup and place the required file(s) from a backup 

Or if a backup is not present, proceed to Step 2.

2)Rename the _state folder in the Elastic index location such as:  I:\EVIndex\nodes\0\_state to _state.old

This would make sure all required files are created again when starting the service.