When running a search in Compliance Accelerator or Discovery Accelerator the message 'Archive and index out of sync (archive is being updated)' is generated.

Problem

When running a search in Compliance Accelerator (CA) or Discovery Accelerator (DA) the message 'Archive and index out of sync (archive is being updated)' is generated.

Information Message

Archive and index out of sync (archive is being updated)

Cause

Expected behavior for an out of sync index:

The expected behavior is that all search applications will show that an archive and index are believed to be out of sync at the time of the search at the same time updates are being done to the index.  There is a good chance that when the search is repeated, the results will come back 'in sync'.  However, if the archive/index is very busy or the overall system is very busy, then there is the chance it will come back again saying it is out of sync.

CA and DA had an issue wherein searching an Enterprise Vault index while it was being updated caused the search to complete or fail.  Discovery Accelerator failed to notify that the index was being updated-and hence that some results may be missing from the overall completed search. Any index volume that completed successfully would return items matching the search criteria but the our of sync index volume would return 0 results as the volume was not searchable.

Special note to the above information: Current index volumes can be in a updating status while CA or DA searches are running and not be in a failed or rebuilding status.  The 'Archive and index out of sync' message is presented on these index volumes when there are no items matching any of the search criteria in the index volume at the time the search is run.  For such index volumes, the search creator should evaluate if the search should be run again at a later time to allow the index volume to complete its updating.  See Article 100050399 for more information about this condition.

Fixes have been made available where two new configuration settings are present that can choose to report errors when there is a problem with an archive's index. These settings, which are on the System Configuration > Search page, are as follows: 

• Items being deleted from it (through WebApp, Outlook or Storage Expiry),

• An administrator electing to rebuild an index.

In addition a sequence number validation is performed when the index volume is first loaded for searching.  If the numbers are inconsistent a synchronize operation is performed and that may or may not find items to action.

A static archive may not stay out of sync, even if Compliance Accelerator or Discovery Accelerator does not discover it.

Any search submitted from another search application would also generate a "catch up" to happen. Also, if it's general indexing lag, then the index/archive may go "in sync" over a period of time.

Deletions and rebuilds will cause a static (old) index volume to be updated.  If the highest index sequence number in an index volume somehow becomes lower than the highest index sequence number in the vault store database, then a synchronization will only be kicked off when the volume is next searched or updated.

If a search needs to be run again to make the search accurate, it may not be acceptable if searches are taking several hours to run.

On a healthy system there should not be much general index lag, apart from on the journal archives.  Compliance Accelerator should be used to search journal archives.  If Discovery Accelerator is used to search journal archives it will have a higher chance of showing that these indices are "out of sync" because there is more of a chance that indexing is behind for these types of archives.

In general, items are archived and indexed in a sequence that closely matches their time of arrival into the mailbox (subject to policy settings).  When searching an index for items in an old date range that is within the index volume, then the fact that the volume is being updated will affect the search results, which will be 0, as the index will be considered as not searchable when in the 'out of sync' condition.  Also, if items in the specified date range are being deleted during the search, then that will affect search results; previously this would have gone unnoticed.

Consider the situation where an index volume covers the entire years of 2000 to 2007.  When performing a search on the years 2002-2004 and there are some updates happening in "real time" on the current year, then the fact the search comes back as out of sync is expected behaviour.
 

Solution

Steps that should be taken when the error is generated:

1. Determine what indices the query is running against.
2. Determine if this is a normal or journal archive, and if it is an active archive.  A journal archive can be active, which would generate an out of sync message.  Whereas a normal mailbox archive typically won't be actively archiving items causing the index to have a back log and be out of sync with what's in the archive.  
3. Run a new query to query the archive(s) which were flagged as out of sync rather than running the entire search again. This will be faster, but may not be possible in some environments.
4. Run indexserver /summary, then a browser search to compare the number of items to see if there is any issue.  If the numbers for that archive match between indexserver /summary and a browser search, then the index and archive are both fine. (See the Related Documents section article 285414 for more information.)
5. Run the following SQL queries to check the JournalArchive and JournalDelete tables in the vault store database to determine if there is a backlog of operations.

Select count (*) as Rows
From JournalArchive
Where indexcommited = '0'

Select count (*) as Rows
From JournalDelete
Where indexcommitted = '0'

6. Use IndexCheck to check the indices. (See Article 100017351.)

Out-of-sync messages when running Compliance Accelerator or Discovery Accelerator searches may be received even though the archive and index in question were synchronized at the time.