Event ID 42086 thrown and the Info column of index volumes can display the error "Some items could not be searched" in Compliance Accelerator (CA) or Discovery Accelerator (DA) searches.

book

Article ID: 100008094

calendar_today

Updated On:

Description

Error Message

From the Enterprise Vault Event Log on the CA or DA) Server:

Source : Enterprise Vault
Event ID : 42086
Task Category : None
Level : Warning
Keywords : Classic
Description:
APP AT – CustomerID:2 – Warning:
Some items could not be searched:
Archive:’Journal1’
ID:174441945702828468103EB38AEAmailarchive
Index Volume:215
Search ID:10
Description:
Items or content missing from the index.
Reason: Items or content missing from the index.
V-437-42086

In the Info column of the CA or DA client display of the Searches page, Search Details panel, the following is an example from an internal lab environment:

Some items could not be searched:
Archive:  "Journal 1"
ID: 174441945702828468103EB38AEAmilarchive
Index Volume: 215
Search ID: 10

Figure 1: Sample screen shot of the error displayed in the CA or DA client from an internal lab environment.

 

Cause

When an item cannot be indexed:

  1. An entry is entered into the Vault Store database for the item noting the item could not be indexed.
  2. For 32-bit index volumes, a file named IndexMissing.log is created or updated in the physical folder for the index volume containing that item.
  3. For 64-bit and Elastic Search (ES) index volumes, an entry is created in the ItemAdditionStatusLog table, also in the Vault Store database, indicating the reason for the item index failure.

When the failed item is successfully indexed, the Enterprise Vault (EV) Vault Store (VS) database containing information about the item is updated as well as the IndexMissing.log file or ItemAdditionStatusLog table entry.  When the last failed item has been fully indexed in 32-bit index volumes, the IndexMissing.log file is supposed to be deleted by the repair processing.

When a CA or DA search is run against an index volume that has items that failed to be indexed, or has the IndexMissing.log file present in 32-bit index volumes, the Info column for the index volume in the search will contain a message such as Items or content missing or Some items could not be searched.  These messages are not errors, but informational notices that the index volume could have contained additional items to match the search criteria, but the search could not confirm that due to the failed item(s).  The search would have returned all hits that matched the search criteria in the index volume, if any exist.

These informational notices prevent the automatic acceptance of the search results into the review set of the CA Department or DA Case, but the search can be accepted manually.

Some examples of reasons items may not be indexed are, but not limited to, the following:

  1. The item is encrypted and EV has no process to decrypt the item prior to it being archived and then indexed.
  2. The item is or contains a file attachment of a type that EV cannot convert into plain text or HTML prior to being indexed.
  3. The item can not be retrieved from storage to be indexed.

For a listing of missing item cause codes for the 32-bit indexed items, see Technical Article 100002035 in the Related Articles section.

Resolution

These informational notices can be ignored once the failed to index item(s) has been investigated and determined to not be related to the search criteria.  If the item(s) does contain relevant data to the search, the index volume should attempt to be repaired to see if the missing item(s) can be added to the index.

See the About the Synchronize wizard section of the EV Administrartor's Gude for more information and perform a Synchronize operation on the Index:

If the investigation into these notices uncovers that there is no failed to index item left in the Index Volume, the following actions can be executed to prevent these notices from occurring unless any new items that cannot be indexed are added to the index volume.

For 32-bit index volumes:

  • Rename or delete the IndexMissing.log file in the physical folder for the index volume that is referencing this error.
    • Note: This should only be done after an index repair has been successfully completed or the failed to index archived item(s) is/are no longer available from the Vault Store location
  1. From the CA or DA client's Departments or Cases tab | All Cases listing pane, click on the CA department or DA case.
  2. Select the Searches tab.
  3. Select the search that reported this issue.
  4. In the Search Details pane, change the Show: field selection to either Top 2000 archive indexed by hits or 2000 failed/error archive indexes to see any index volume(s) reporting the issue.
  5. Identify and note the Archive(s) that correspond to the issue reported.
  6. Open Vault Administration Console.
  7. Go to and expand the Archives folder.
  8. Click on the appropriate archive type folder, such as Exchange Journal to populate journal archive(s) or Exchange Mailbox to populate​ Exchange archive(s), respectively.
  9. Right click on the archive in question.
  10. Select the Properties option.
  11. Go to the Advanced tab.
  12. In the Archive ID section, note the Archive ID (for example, 116BC6BA5C4E8AD46AAA708462D916CFF1110000EVLab).
  13. Identify the Index's location by following the instructions in the How to Identify Index Location information below.
  14. Using File Explorer, go to the Index Location found above and search for the Archive ID found previously in Step 12.
  15. In this folder, search for the file named IndexMissing.log.
  16. If the file is present, examine the file's content for any SaveSetID entries that may be present.
  17. Confirm that any listed SaveSetID values are not in the Vault Store location.
    1. Note: Vault Store location can be identified by going to the properties of the Vault Store's partition in the Vault Administration Console.
  18. If the file contains no SaveSetID values or any listed SaveSetID values are found to no longer be in the Vault Store location, rename or delete the IndexMissing.log file.
  19. Repeat these steps for all Index Volumes that contain an invalid IndexMissing.log file.
  20. Either close File Explorer or change its focus to list the contents of some other folder (not an index volume folder).
  21. On the CA or DA server, restart the Enterprise Vault Accelerator Manager Service.
  22. CA or DA searches should run successfully after all index volumes with missing items are either repaired or their invalid IndexMissing.log files have been renamed or deleted.
How to identify index location:
 
This can be done from Enterprise Vault Administration ConsoleEnterprise Vault | Directory on {EV_Server} | {EV site name} | Enterprise Vault Servers | {EV_Server} | ServicesEnterprise Vault Indexing ServiceIndex Locations.

For more information about missing items in 64-bit index volumes:

Refer to Technical Article 100039323 in the Related Articles section for more information.

 

Issue/Introduction

When performing a Search in Compliance Accelerator (CA) or Discovery Accelerator (DA), the Info column for index volumes can display the message: Some items could not be searched: Archive:’archivename’. and the Veritas Enterprise Vault Event Log can have Event ID 42086 errors thrown.