How to exclude applications from recalling Enterprise Vault (EV) File System Archiving (FSA) placeholder files during a backup or scan.

Problem

It is possible to specify a list of programs that are prohibited from recalling archived items. This is most likely to be useful for antivirus, backup or any other type of file scanning program that does not honor the file system offline attribute which could cause recalls of all items marked as a placeholder.  FSA has limits on the number of files that can be recalled in a time window and during a backup this threshold is likely to be exceeded if offline files cannot be ignored.

To exclude specific programs from retrieving placeholders specify the list of programs by editing a registry value on each file server that is running the Placeholder Service. 
 

Solution

Troubleshooting:
To determine whether backup software is recalling files, do one of the following:

1. Use Windows Explorer to list files that have been backed up. Placeholder shortcuts have a unique icon and have the offline file attribute.

2. Check the File System Archiving report file. If files were recalled on the previous backup run, successive reports will show that an increasing number of files have been turned into placeholder shortcuts.

3. Dtrace the EVPlaceholderService and find the executable that is recalling the placeholder. (See https://www.veritas.com/docs/000125000)


Method 1:

Warning: Incorrect use of the Windows registry editor may prevent the operating system from functioning properly. Great care should be taken when making changes to a Windows registry. Registry modifications should only be carried-out by persons experienced in the use of the registry editor application. It is recommended that a complete backup of the registry and workstation be made prior to making any registry changes.


1.  Go to Start | Run and type Regedit to open the Windows Registry.

2.  For Windows 32 bits version, navigate to HKEY_LOCAL_MACHINE\Software\KVS\EnterpriseVault\FSA. For Windows 64 bits version, navigate to HKEY_LOCAL_MACHINE\Software\Wow6432Node\KVS\Enterprise Vault\FSA.

3.  Right-click on PlaceholderService and choose New | String Value and enter the name ExcludedExes.

4.  Edit the ExcludedExes string to specify the names of the program executable files, separated by semicolons (;). For example, to exclude Windows Explorer, 'MyBackupProgram' and a program called 'MyAntivirus' enter the following:

               Explorer.exe;MyBackupProgram.exe;MyAntivirus.exe

5.  Restart the Enterprise Vault File Placeholder Service

Note: This functionality is restricted to processes running locally on a Windows file server and does not work with requests initiated remotely from another server or client system. This functionality is only available to Windows file servers running the FSA Agent and does not apply to NetApp, Celerra or VNX CIFS servers.

A recall request will still be seen in a Dtrace log of the EvPlaceholderService process, however the request will be rejected and show the following: 

The placeholder restore request for file: FILE_PATH has been rejected as the calling executable is excluded from placeholder recalls

Method 2:

The EVFSABackupMode.exe utility can be used to place the file server into a backup mode.  This operation may be scripted to run before backups.

1. Create the computer local group Enterprise Vault Backup Operators on the file server.  Alternatively a domain group named Enterprise Vault Backup Operators can be created.  If the file server is hosted on a NetApp, then the Enterprise Vault Backup Operators group must be created on the NetApp CIFS server.

Note: When backup mode is restricted in this way, people who are not in the Enterprise Vault Backup Operators group can still recall files as normal.

2. Add the backup application service account to the computer group Enterprise Vault Backup Operators.

3. Confirm that the FSA targets for the relevant file server are not configured to use the PassThrough recall method; otherwise the EVFSABackupMode will be ignored. PassThrough recall can be disabled and enabled on a per Server and/or per Volume Target basis therefore it is not necessary to disable PassThrough completely.  Disabling or enabling PassThrough recall does not require a restart of any Services or Tasks.

4. From the command prompt (CMD) execute EVFSABackupMode.exe from the Enterprise Vault program folder (normally C:\Program Files\Enterprise Vault or C:\Program Files (x86)\Enterprise Vault) on the server that is running the Placeholder Service with the backup switch as displayed in the examples given below:

Where MyWindowsServer is the name of the Windows file server that is running the Placeholder service.  MyFiler is the name of the NetApp CIFS file server.   MyDirServ is the name of the EV server where the Enterprise Vault Directory service is running, MyDirServ is only required when using the utility against NetApp CIFS file servers.

5.  To return the server to normal operation run the following command:

Where MyWindowsServer is the name of the Windows file server that is running the Placeholder service.  MyFiler is the name of the NetApp CIFS file server. MyDirServ is the name of the EV server where the Enterprise Vault Directory service is running, MyDirServ is only required when using the utility against NetApp CIFS file servers.

To determine the status of the BackupMode for a NetApp target the following query can be executed against the FileServerEntry table in the EnterpriseVaultDirectory database:

0- BackupMode not set

1- BackupMode is set

Note: The above query against the FileServerEntry table cannot be used to monitor the BackupMode state for Windows file server targets. In order to confirm that BackupMode is set against Windows targets it is necessary to run dtrace on the EvPlaceholderService process on the respective Windows file server.
When enabling dtrace, if the BackupMode is already set there will be no activity captured in the dtrace output as the recall prevention will intercept the request before the recall processing is performed by EvPlaceholderService. Enabling dtrace prior to setting BackupMode to -backup or -normal will capture specific lines that confirm the BackupMode state as shown below:

Setting BackupMode to –backup:
EV:L Attempting to enter backup mode for the FSA filter driver
EV:L Backup mode set for the FSA filter driver

Setting BackupMode to –normal:
EV:L Attempting to exit backup mode for the FSA filter driver
EV:L Exited Backup for the FSA filter driver
 

Preventing file recalls on EMC Celerra

For Celerra / VNX targets a dhsm feature can be used to prevent Active Directory groups or users, such as a service account, from triggering placeholder recalls from the Celerra / VNX file systems. For example, the service account for a backup or antivirus program program can be prevented from recalling placeholders.

To prevent members of a group or an individual user account from triggering placeholder recalls through the CIFS interface, add the appropriate group or account to the respective Celerra / VNX Backup Operators group. Then execute the following command to prevent those accounts from recalling placeholders:

Where fs_name is the name of the file system on the Celerra.