Event ID: 28967 Watch file partition scan will be stopped for the following partition since 50 consecutive unsecured (not replicated or backed up) files/streams were found

Problem

The StorageFileWatch process generates persistent warnings indicating that 50 or more unsecured items have not been replicated or backed up. The resulting behavior is that post processing does not occur in a timely manner. Observed behavior may be that Enterprise Vault Shortcuts are in a "Pending" state longer than expected or the Storage Queue folder begins to increase in file count up until all disk space is consumed.

Error Message

Event ID: 28967 Watch file partition scan will be stopped for the following partition since 50 consecutive unsecured (not replicated or backed up) files/streams were found.

Cause

This behavior has been observed when Enterprise Vault utilizes storage devices such as Hitachi that rely on replication as the backup method.

This issue is related to the frequency of the partition scan and the rate at which replication occurs on the storage device. If the partition scan frequency occurs faster than the replication rate then these warnings will likely be seen. For example, if the partition scan frequency is set to every 10 minutes, but the replication of the storage device is greater than 10 minutes, then the warning will occur.

(StorageFileWatch) <7012> EV:L CStreamerItemSecuredVerifier::CheckItem Information: Checked stream status for StoreIdentifier = [evroot/EB79CE4FE385C74783CC717D5898550E/2019/April/01/d10c0e95-783d-48a9-8df9-492d44d39b1a/22_01_33/00015] on VaultStoreIdentity = [1] PartitionIdentity = [1] PartitionName = [VS02Ptn3] Stream size = [11305] Safe = [0]

Solution

Veritas recommends contacting the storage vendor and reviewing the storage device replication rate to ensure the storage device is replicating at optimal performance from the primary node to the secondary node.