How to determine why deleted items are still being shown in Enterprise Vault (EV) Search results

Description

The main SQL tables used to track the deletion of data and the removal of items from the index volumes are the Vault Store database JournalDelete table and ItemDeletionStatusLog table.

JournalDelete
This table contains information about items that have been deleted from the archive. If the item has not yet been sent for deletion from the index, the IndexCommited flag is set to 0. Conversely, if the deletion request has been sent to the index and has been acknowledged by the indexing engine, then the IndexCommited flag is set to 1. When the flag is set to 1, the item could either have been successfully deleted from the index or could have failed to be deleted from the index.

Example:
Run the following SQL Query to identify the items within the JournalDelete table that are pending deletion from the indexes.

USE <VaultStoreDBName>
SELECT *
FROM JournalDelete
WHERE IndexCommitted = 0

Note: Replace <VaultStoreDBName> with the name of the current Vault Store database name.

ItemDeletionStatusLog
This table contains records for items that are currently being deleted from the index. Successfully deleted items are removed from the table. If there are items that have failed to be deleted from the index, these will remain in the ItemDeletionStatusLog, until a subsequent retry is successful. After two further failed retry attempts, the poison pilled flag for the item will be set and the item will no longer be retried. Poison pilled deletions will be retained in this table and will be retried when the index is repaired or rebuilt.

Only when items have been successfully deleted from the index and removed from the ItemDeletionStatusLog will they no longer appear in EV Search results. Therefore searching the archive for items that have not been successfully deleted from the index will continue to be returned in a search.