EVConverterSandbox.exe may crash intermittently, generating event ID 1000 in the Application log

book

Article ID: 100009440

calendar_today

Updated On:

Description

Error Message

Type: Error
Event: 1000
Source: Application Error
Category:  Application Crashing Events
User: N/A
Description: Faulting application name: EVConverterSandbox.exe, version: 9.0.4.1097, time stamp: 0x4fee1131
Faulting module name: SCCTA.DLL_unloaded, version: 0.0.0.0, time stamp: 0x4e0a9e07
Exception code: 0xc0000005
Fault offset: 0x663b2224
Faulting process id: 0x4888
Faulting application start time: 0x01cdc75807a16dcb
Faulting application path: C:\Program Files (x86)\Enterprise Vault\EVConverterSandbox.exe
Faulting module path: SCCTA.DLL
Report Id: ae4eb1b7-334c-11e2-a942-0026554de1dc
 

Resolution

As a workaround, the registry values listed below can be increased.  However, prior to putting this workaround in place the TMP and TEMP variable locations for the Vault Service Account should be adjusted to ensure that they are hosted on a disk that has a large amount of free disk space, as the increase in the timeout value will allow large items that would have exceeded the timeout period (and been discarded from the conversion process) to be fully converted.  Large and complex items temporarily take up a significant amount of disk space when being converted.

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\KVS\Enterprise Vault\     (64 Bit)

HKEY_LOCAL_MACHINE\SOFTWARE\KVS\Enterprise Vault\   (32 Bit)

"ConversionTimeout"

"ConversionTimeoutArchiveFiles"

Both these values have a default value of 10 minutes.  Increase them by 30-minute increments until the Event ID 1000 events are no longer logged for EVConverterSandbox.exe.  A service restart is not required for these changes to take effect.
 

Issue/Introduction

The EVConverterSandbox.exe process may crash intermittently when converting large or complex files for indexing. This is a result of the default conversion timeout of 10 minutes being exceeded. The Faulting Module Name logged in the event may vary but will be followed by "_unloaded" as per the example in the Error section of this article.

Additional Information

ETrack: 3060370