Deletion of Vault Archives (Mailbox) and factors which may impact the deletion process in Enterprise Vault (EV) for Microsoft Exchange.

Problem

Details regarding the deletion of Enterprise Vault (EV) Archives and factors which may impact the deletion process in Enterprise Vault for Microsoft Exchange.

Solution

1. In order to delete an EV Archive, right-click on an Archive and select Delete (Figure 1).

Figure 1
 
 

Figure 2
 

• Continual archiving:
  
  During the Journal Archiving and Mailbox Archiving process, Updates and Inserts against the EnterpriseVaultDirectory, Vault Store Database(s) and Fingerprint Database occur. If a delete request is made, it will be queued in the same Queue as the archiving requests.  If there are numerous archive requests, a delete request may be delayed. 
   

• Backups:
  
  When Enterprise Vault is in a Backup Mode, items are not updated, inserted or deleted. Depending on the time windows allowed for nightly backups, deletion requests may be delayed significantly.
   

• Size and quantity of items in Vault Store:
  
  If there are a large number of items in the Mailbox archive, it will take time to locate and purge these from the database. This process will also be delayed due to the number of Index files and Data files that must be deleted. Due to the design of EV, these items are stored by the age or modified date of the email, not by the archive. The storage location must be searched for each item to be deleted. The greater number of total items in the storage location, the longer the trawl will take.
   
• SQL Fragmentation:
  
  The saveset entries associated with an archive are referenced within the Vault Store database.  As per best practices, regular SQL maintenance must be performed against the SQL indexes in order to keep especially large SQL table indexes from becoming fragmented.  High fragmentation can cause heavy queries to take longer than expected, cause SQL dead-locks, or fail entirely.
   

• Legal Holds:
  
  
  Enterprise Vault Discovery Accelerator (DA) has the option to place discovered items on 'Legal Hold'. Items on legal hold cannot be deleted from Enterprise Vault. Archives which have associated items on legal hold will not be deleted until all items associated with the archive are removed from legal hold and deleted by storage.  
   

• Archive being 'Of Interest' via Discovery Accelerator (DA):
  
  When performing case searches utilizing DA, all archives associated with an open case will be considered 'Of Interest' regardless if items are on Legal Hold. When an archive is of interest, the deletion process will delete all items associated with the archive which are not on legal hold and fail to delete the archive container when the number of items in the archive reach 0.
   
• Retention Category value "Prevent deletion of archived items in this category":
  
  Each Retention Category has an option to prevent deletion of items.  This option affects all deletion requests, including user-initiated and systematic deletions.
   

• Items stored to a Compliancy device (Ex. EMC Centera in Compliance/Governance mode, or NetApp Snaplock):
  
  With many Compliance devices, the retention category value is stored on the items themselves at the time of archival. When a deletion request is made, the compliance device will check the retention value on the item to verify the item may be deleted.  On compliance devices, if a delete request is performed prior to when the retention value expires, the device will deny the deletion request.
   

Method to monitor and track the deletion progress of an archive:

1. Record the ArchiveID (VaultEntryID) for the archive(s) in a 'Marked for Deletion' status.

USE EnterpriseVaultDirectory
SELECT ArchiveName, VaultEntryID, ArchiveStatus
FROM ArchiveView
WHERE ArchiveStatus = 4

-- Record the VaultEntryID value
 

2. The following SQL Query will provide a count of the items associated with the archive.

USE <VaultStoreDatabaseName>
SELECT count(*) 
FROM view_Saveset_Archive_Vault
WHERE ArchivePointId = '<VaultEntryID_from_step_1>'
 

Note: As the deletion of an archive progresses, the count of items associated with the archive will decrease. Once this count reaches 0, the archive container is then removed from the EnterpriseVaultDirectory database.
 

How to check if archive has items on Legal Hold:

The following SQL Query will provide a count of items associated with an Archive and if items are on Legal Hold.
 

-- Replace <VaultStoreDatabaseName> with the Vault Store Database name
-- Replace <VaultEntryID> with the ArchiveID of the Archive in question

USE <VaultStoreDatabaseName>
SELECT Distinct 
    count(idtransaction) AS "Number of Items"
    ,VSAV.ArchivePointId
    ,VSAV.RetentionCategoryIdentity
    ,CASE WHEN VH.SavesetIdentity is null THEN 'Not on Legal Hold' ELSE 'On hold' END AS OnHold_DA

FROM view_saveset_archive_vault VSAV
    LEFT OUTER JOIN view_Holds VH on VH.SavesetIdentity = VSAV.SavesetIdentity
WHERE VSAV.ArchivePointID = '<VaultEntryID>'
GROUP BY VSAV.ArchivePointId, VSAV.RetentionCategoryIdentity, VH.SavesetIdentity
 

Note:  See 100022415 under Related Articles for further details regarding DA Legal Holds.
 

How to determine if the RetentionCategoryIdentity refers to a Retention Category which is set to restrict deletions:

Run the following SQL query utilizing the RetentionCategoryIdentity of the transaction(s):
 

USE EnterpriseVaultDirectory
Select RetentionCategoryName, OnHold, RetentionCategoryIdentity
FROM RetentionCategoryEntry
WHERE RetentionCategoryIdentity = '<RetentionCategoryIdentity_from_Saveset>'

-- OnHold of 1 = Items with retention not allowed to be deleted.
-- OnHold of 0 = Items with retention are allowed to be deleted.
 

How to determine if an Archive is 'Of Interest':

See 100007041 under Related Articles for details on how to determine if an Archive is 'Of Interest' within EV Discovery Accelerator.