Deletion of Vault Archives (Mailbox) and factors which may impact the deletion process in Enterprise Vault (EV) for Microsoft Exchange.

Article: 100017863
Last Published: 2014-09-23
Ratings: 3 0
Product(s): Enterprise Vault

Problem

Details regarding the deletion of Enterprise Vault (EV) Archives and factors which may impact the deletion process in Enterprise Vault for Microsoft Exchange.

Solution

General Process
 
1. In order to delete an EV Archive, right-click on an Archive and select Delete (Figure 1).

Figure 1
 
 
Note that the archive Status is changed to Marked for Deletion. (Figure 2)
 
 
Figure 2
 
 
2. When the EV Storage Service starts, EV will query the EnterpriseVaultDirectory Database for all Archives in a Marked for Deletion status and add these to a Deletion Queue.
 
3. EV then performs a Query on the EV Vault Store Database(s) for each Archive and locates all saveset (Archived Items) objects related to the Archive as well as all Index Items related to the saveset.
 
4. Once the items associated with the Archive are identified, a subsequent query is then performed for each item to locate the physical location and files pertaining to the Index and saveset data on the storage device. 
 
5. A Delete request of all the saveset objects for the specified Vault Archive will be performed, as well as a removal of all the Transaction IDs (Unique saveset item identifiers) for these saveset objects.
 
6. Once the SQL entries for each of the saveset objects are removed, a delete is performed on the physical data.  

Note: The above process occurs for every item within an Archive. Only after all saveset references and index references are removed, will the actual Archive be deleted. The performance of the deletions are dependant on a number of factors, including the total items on the Storage Location (Vault Store). It may take time to trawl through the vault store partition(s) to identify all references for a particular archived item.


Aspects that may slow down the deletion process:
 
  • Continual archiving:

    During the Journal Archiving and Mailbox Archiving process, Updates and Inserts against the EnterpriseVaultDirectory, Vault Store Database(s) and Fingerprint Database occur. If a delete request is made, it will be queued in the same Queue as the archiving requests.  If there are numerous archive requests, a delete request may be delayed. 
     
  • Backups:

    When Enterprise Vault is in a Backup Mode, items are not updated, inserted or deleted. Depending on the time windows allowed for nightly backups, deletion requests may be delayed significantly.
     
  • Size and quantity of items in Vault Store:

    If there are a large number of items in the Mailbox archive, it will take time to locate and purge these from the database. This process will also be delayed due to the number of Index files and Data files that must be deleted. Due to the design of EV, these items are stored by the age or modified date of the email, not by the archive. The storage location must be searched for each item to be deleted. The greater number of total items in the storage location, the longer the trawl will take.
     
  • SQL Fragmentation:

    The saveset entries associated with an archive are referenced within the Vault Store database.  As per best practices, regular SQL maintenance must be performed against the SQL indexes in order to keep especially large SQL table indexes from becoming fragmented.  High fragmentation can cause heavy queries to take longer than expected, cause SQL dead-locks, or fail entirely.
     
Aspects that will stop the deletion process:
 
Below are additional components which will stop the deletion of an archive.  Archives affected by the factors below will appear to be in a permanent Marked for Deletion status. 
 
  • Legal Holds:


    Enterprise Vault Discovery Accelerator (DA) has the option to place discovered items on 'Legal Hold'. Items on legal hold cannot be deleted from Enterprise Vault. Archives which have associated items on legal hold will not be deleted until all items associated with the archive are removed from legal hold and deleted by storage.  
     
  • Archive being 'Of Interest' via Discovery Accelerator (DA):

    When performing case searches utilizing DA, all archives associated with an open case will be considered 'Of Interest' regardless if items are on Legal Hold. When an archive is of interest, the deletion process will delete all items associated with the archive which are not on legal hold and fail to delete the archive container when the number of items in the archive reach 0.
     
  • Retention Category value "Prevent deletion of archived items in this category":

    Each Retention Category has an option to prevent deletion of items.  This option affects all deletion requests, including user-initiated and systematic deletions.
     
  • Items stored to a Compliancy device (Ex. EMC Centera in Compliance/Governance mode, or NetApp Snaplock):

    With many Compliance devices, the retention category value is stored on the items themselves at the time of archival. When a deletion request is made, the compliance device will check the retention value on the item to verify the item may be deleted.  On compliance devices, if a delete request is performed prior to when the retention value expires, the device will deny the deletion request.
     

Method to monitor and track the deletion progress of an archive:

1. Record the ArchiveID (VaultEntryID) for the archive(s) in a 'Marked for Deletion' status.

USE EnterpriseVaultDirectory
SELECT ArchiveName, VaultEntryID, ArchiveStatus
FROM ArchiveView
WHERE ArchiveStatus = 4


-- Record the VaultEntryID value
 

2. The following SQL Query will provide a count of the items associated with the archive.

USE <VaultStoreDatabaseName>
SELECT count(*) 
FROM view_Saveset_Archive_Vault
WHERE ArchivePointId = '<VaultEntryID_from_step_1>'

 

Note: As the deletion of an archive progresses, the count of items associated with the archive will decrease. Once this count reaches 0, the archive container is then removed from the EnterpriseVaultDirectory database.
 

How to check if archive has items on Legal Hold:

The following SQL Query will provide a count of items associated with an Archive and if items are on Legal Hold.
 

-- Replace <VaultStoreDatabaseName> with the Vault Store Database name
-- Replace <VaultEntryID> with the ArchiveID of the Archive in question

USE <VaultStoreDatabaseName>
SELECT Distinct 
    count(idtransaction) AS "Number of Items"
    ,VSAV.ArchivePointId
    ,VSAV.RetentionCategoryIdentity
    ,CASE WHEN VH.SavesetIdentity is null THEN 'Not on Legal Hold' ELSE 'On hold' END AS OnHold_DA

FROM view_saveset_archive_vault VSAV
    LEFT OUTER JOIN view_Holds VH on VH.SavesetIdentity = VSAV.SavesetIdentity
WHERE VSAV.ArchivePointID = '<VaultEntryID>'
GROUP BY VSAV.ArchivePointId, VSAV.RetentionCategoryIdentity, VH.SavesetIdentity

 

Note:  See 100022415 under Related Articles for further details regarding DA Legal Holds.
 

How to determine if the RetentionCategoryIdentity refers to a Retention Category which is set to restrict deletions:

Run the following SQL query utilizing the RetentionCategoryIdentity of the transaction(s):
 

USE EnterpriseVaultDirectory
Select RetentionCategoryName, OnHold, RetentionCategoryIdentity
FROM RetentionCategoryEntry
WHERE RetentionCategoryIdentity = '<RetentionCategoryIdentity_from_Saveset>'

-- OnHold of 1 = Items with retention not allowed to be deleted.
-- OnHold of 0 = Items with retention are allowed to be deleted.
 

How to determine if an Archive is 'Of Interest':

See 100007041 under Related Articles for details on how to determine if an Archive is 'Of Interest' within EV Discovery Accelerator.

 

 

Was this content helpful?