With Enterprise Vault (EV) you can sometimes see strange behavior in the event logs. For example, reoccurring 29014 errors with an interesting host name or Vault ID:
Type: Error Date: 3/30/2017 Time: 2:21:07 PM Event: 29014 Source: Enterprise Vault Category: Web Application (WP) User: N/A Computer: EV-EVMV.domain.com Description: Storage DCOM error. Reason: No such host is known. (0x80072af9) Reference: Get storage object: Computer name [1154E5E3E65F2304DB411ED0C4D9DFA8E1110000-EV (1)], Context [VaultID: 1154E5E3E65F2304DB411ED0C4D9DFA8E1110000-EV (1)]
Take note of the (1) at the end of the names.
The archive itself seems fine. A quick look at its SQL entries shows everything looking normal:
Use EnterpriseVaultDirectory select * from [dbo].[ExchangeMailboxEntry] where DefaultVaultId = '1154E5E3E65F2304DB411ED0C4D9DFA8E1110000-EV' Use EnterpriseVaultDirectory select * from [dbo].[Root] where VaultEntryId = '1154E5E3E65F2304DB411ED0C4D9DFA8E1110000-EV' Use EVVSMailboxVS_3 select * from [dbo].[ArchivePoint] where ArchivePointID = '1154E5E3E65F2304DB411ED0C4D9DFA8E1110000-EV' Use EVVSMailboxVS_3 select * from [dbo].[Vault] where VaultID = '1154E5E3E65F2304DB411ED0C4D9DFA8E1110000-EV'
A dtrace will show:
246900 14:21:07.535 [2960] (w3wp) <7636> EV:L {VaultCoCreateInstanceEx} Attempt [1] to create COM object failed. CLSID [{F019A230-FF92-11D1-8C20-0000F87502DE}] Server Name [1154E5E3E65F2304DB411ED0C4D9DFA8E1110000-EV (1)] Elapsed [0.001s] Result [The RPC server is unavailable. (0x800706ba)]
246901 14:21:07.736 [2960] (w3wp) <7636> EV:H VaultCoCreateInstanceEx GetMachineNameUsingHostNameHelper failed. Server Name [1154E5E3E65F2304DB411ED0C4D9DFA8E1110000-EV (1)] Error [No such host is known. (0x80072af9)]
246902 14:21:07.736 [2960] (w3wp) <7636> EV~E Event ID: 29014 Storage DCOM error. |Reason: No such host is known. (0x80072af9) |Reference: Get storage object: Computer name [1154E5E3E65F2304DB411ED0C4D9DFA8E1110000-EV (1)], Context [VaultID: 1154E5E3E65F2304DB411ED0C4D9DFA8E1110000-EV (1)] |For more information, see Help and Support Center at http://entced.symantec.com/entt?product=ev&language=english&version=11.0.1.0&build=11.0.1.3598&error=V-437-29014
246903 14:21:07.736 [2960] (w3wp) <7636> EV:H {GetStorageObject} Status: [No such host is known. (0x80072af9)]
246904 14:21:07.736 [2960] (w3wp) <7636> EV:H {CAutoStorageOnline::CreateStorageOnlineByComputerName} Status: [No such host is known. (0x80072af9)]
246905 14:21:07.736 [2960] (w3wp) <7636> EV:H {CAutoStorageOnline::CreateStorageOnlineByVaultId} (Exit) Status: [Exception]
246906 14:21:07.736 [2960] (w3wp) <7636> EV:H {CAutoStorageOnline::GetVaultRange:#1388} _com_error exception: [No such host is known. (0x80072af9)]
246907 14:21:07.736 [2960] (w3wp) <7636> EV:H {CAutoStorageOnline::GetVaultRange} (Exit) Status: [No such host is known. (0x80072af9)]
246908 14:21:07.737 [2960] (w3wp) <7636> EV-H {Common.DTraceExceptionAndVEID} Exception: No such host is known. (Exception from HRESULT: 0x80072AF9) Info:VEID:1154E5E3E65F2304DB411ED0C4D9DFA8E1110000-EV (1) Diag:HRESULT: 80072af9 Type:System.Runtime.InteropServices.COMException ST: at KVS.EnterpriseVault.Interop.AutoStorageOnlineClass.IAutoStorageOnline3_GetVaultRange(String bstrArchiveID, UInt32& apArchPointId, UInt32& apHighSeq, UInt32& apItemsSize, UInt32& apRetCountItems, DateTime& apItemCreationDate, DateTime& apItemModifiedDate, DateTime& oldestItem, DateTime& newestItem, UInt32& lowestSeqNum, UInt32& highestSeqNum, DateTime& oldestArchDate, DateTime& youngestArchDate)| at DesktopClientCacheWeb.GetVaultInformation.CreateResults(String archiveId, HttpResponse pResponse) Inner:None
Also, within the IIS logs you will see a 500 status for the user at the time of the errors.
Using the Vault ID and IIS logs you can find the user and look up their workstation name. UNC to the Vault Cache location (i.e. C:\Users\xxxxxx\AppData\Local\KVS\Enterprise Vault\xxxxxxxxxxxx) and you will find multiple MDC files. One with the correct name, and another with the (1) at the end, which is the root of the 29014 errors flooding the event logs.
If you look at the date and time on the MDC file, it should correspond to the date and time of the 29014 error in the Event Logs.
This looks similar to: https://www.veritas.com/support/en_US/article.000019599 however, the errors are different and there are no 6281 errors in the Event Logs. And since there are multiple MDC files (one normal and one with (1)) you can’t simply rename per this technote.
The file with (1) at the end will let you delete it as it won’t be locked. You’ll want to monitor the end-users’ Vault Cache for synchronization and to see if resets or full rebuilds are needed.
EV can always surprise you with different errors, even in a healthy environment. If you are experiencing any errors in your environment or would like an Enterprise Vault Health Check and Enterprise Vault Best Practice Check, reach out to our specialists today!
