How to reapply Legal Holds on only those items that failed

book

Article ID: 100019828

calendar_today

Updated On:

Description

Error Message

For Discovery Accelerator (DA) 9.0, beginning with Service Pack (SP) 4 Cumulative Hotfix (CHF) 2, and DA 10.0 SP2, beginning with CHF2:

- Event ID 562

Discovery Accelerator has identified some cases in which it could not apply legal hold to certain items.
It will make repeated attempts to apply legal hold to these items.  If you continue to receive this error
message for the next few days, contact Symantec Technical Support.
The following cases contain items to which Discovery Accelerator could not apply legal hold:
list_of_cases

 

Cause

Various reasons exist that can prevent items from being placed on legal hold. Such reasons can include, but not be limited to, the following:

  1. The Enterprise Vault server hosting items to be placed on hold being in Read Only mode.
  2. The Vault Store containing the items to be placed on hold being in Backup Mode.
  3. The Enterprise Vault Storage Service controlling the Vault Store containing the items to be placed on hold not running (i.e., the service is stopped or the EV server is down).
  4. The StorageOnlineOpns process on the EV server hosting the items to be placed on hold being hung.

When the placement of a legal hold fails, the LegalStatus column in the DA Customer database's tblIntDiscoveredItems table is filled with a value of 425 and the LegalError column is filled with the KVSSavesetID of the failed item and a failure status code.  This error code can be translated into the failure cause description through reference to technical article TECH61297 (see the Related Articles section below).

The following versions of DA are the first versions that will automatically retry failed hold items until they have been successfully placed on Legal Hold:

9.0 Service Pack (SP) 4, Cumulative Hotfix 2 (CHF2) [9.0.4CHF2]

10.0 Service Pack (SP) 2, Cumulative Hotfix 2 (CHF2) [10.0.2CHF2]

10.0 Service Pack (SP) 3, Cumulative Hotfix 1 (CHF1) [10.0.3CHF1]

All older DA versions will not automatically retry those failed items to place holds on them.  Instead, those versions rely upon a DA reviewer to notice the 'Failed Items' count in the list of Cases in the DA Client to know there were items that failed to be placed on hold, then to notify the DA administrator to investigate why the holds placement failed, resolve the cause or causes, then manually retry to place the olds using the steps in the Solution section below or by removing the Case from holds, letting all holds be removed, then placing the Case on hold again.

 

Resolution

DA 9.0 SP4 Cumulative Hotfix 2 (9.0.4CHF2) and 10.0 SP2 CHF2 introduce an automatic failed holds retry feature will attempt to apply holds on all failed items that fail with the LegalStatus of 425.  Items that fail to have holds applied with LegalStatus 427 have been identified as no longer existing in the Vault Store, so those items will not be retried.  If the automatic failed holds retry continues to fail to place holds on any items, an Event ID 562 error will be thrown into the Veritas Enterprise Vault Event Log on the DA server for every 12 hours failed items continue to exist.  DA 9.0.4CHF2 is available through TECH200520 and DA 10.0.2CHF2 is available through 000087443 (see the Related Articles section below).
 
Notes:
  1. To apply CHF2 or later CHF for DA 9.0.4, Discovery Accelerator must be upgraded to version 9.0 SP4, then CHF2 or a later CHF can be applied.
  2. To apply CHF2 or later CHF for DA 10.0.2, Discovery Accelerator must be upgraded to version 10.0 SP2, then CHF2 or a later CHF can be applied.
  3. To apply CHF 1 or later CHF for DA 10.0.3, Discovery Accelerator must be upgraded to version 10.0 SP3, then CHF2 or a later CHF can be applied.
  4. DA 10.0, 10.0.1, 10.0.2, 10.0.2CHF1, and 10.0 SP3 do not contain the failed holds automatic retry as they were either released or their code base was finalized before the 10.0.2CHF2 was released.
  5. Enterprise Vault versions 9.0.3 and greater, and 10.0.1 and greater, have a troubleshooting feature named Backtrace that is disabled by default.  If Backtrace has been enabled for troubleshooting any issues, it can cause the StorageOnlineOpns process used to apply and remove Legal Holds to enter a hung state.  Before attempting to reapply failed holds using the steps below when running any version of EV that has or has had Backtrace enabled, ensure Backtrace is fully disabled.  To disable Backtrace,
    1. Set the Enabled registry entry to 0 (for 64-bit OS, the Enabled registry value for Backtrace can be found in 'HKEY_LOCAL_MACHINE\Software\Wow6432Node\KVS\Enterprise Vault\Backtrace').
    2. Stop the Enterprise Vault Storage Service.
    3. Use Task Manager to ensure all StorageOnlineOpns.exe processes have stopped, using the End Process option to end any process as needed.
    4. Then start the Enterprise Vault Storage Service. 
 
If the failed item or items exist in the Enterprise Vault (EV) Vault Store databases, the following is a method to attempt to reapply Legal Holds on only those items that failed during the initial or subsequent attempt(s).

To determine if the failure was due to missing items:
- for DA versions 8.0 and greater, look in the tblIntDiscoveredItems table for LegalStatus 427 or follow the instructions in 000034229 (see the Related Articles section below) to obtain the complete LegalError column contents if it is truncated before the last 4 characters of an error beginning with '-21472' are displayed.
- for DA versions prior to 8.0, run the following query against the Discovery Accelerator customer database:
  
SELECT DISTINCT LegalError FROM tblIntDiscovereditems

If the only error listed is 775 for DA versions prior to 8.0 or -2147220729 for DA versions 8.0 or greater - failed items are missing from the EV Vault Store databases and reapplying the failed items will not result in the items being placed on Legal Hold.


RESOLUTION:
- Steps to reapply failed legal holds by case
1) Change the XX on the first line with the appropriate CaseID number.  To find the CaseID, see article 000039183 in the Related Articles section below.
2) Stop the Customer Background Tasks
3) Run these SQL scripts against the Discovery Accelerator customer database

DECLARE @CaseID int SET @CaseID = XX
UPDATE tblCase SET LegalHoldStatus = 410, LegalHoldError = NULL
WHERE CaseID = @CaseID AND LegalHoldState = 400
UPDATE tblintDiscoveredItems SET LegalStatus = 420, LegalError = NULL, LegalHoldID = NULL 
WHERE CaseID = @CaseID AND LegalStatus NOT IN (420, 426)
GO

-- run after the above scripts complete
EXEC usp_LegalItem_UpdateSummary @CaseId = XX
 
4) Start the Customer background tasks
 
  • Note: if the Legal Hold error is 775 or -2147220729, the item is not available in the vault Store for the Legal Hold to be applied.
  • Note: run SQL maintenance on the customer database after applying legal holds (rebuild indexes, update statistics, shrink databases)

- Steps to reapply failed legal holds across entire customer database
1) Stop the Customer Background Tasks
2) Run these scripts against the Discovery Accelerator customer database
 
UPDATE tblCase SET LegalHoldStatus = 410,
LegalHoldError = NULL
WHERE LegalHoldState = 400
UPDATE tblintDiscoveredItems SET LegalStatus = 420,
LegalError = NULL, LegalHoldID = NULL 
WHERE LegalStatus <> 426
GO

-- run after the above scripts complete
EXEC usp_DiscoveryDiscoveredItemSummary_Recalculate

3) Start the Customer background tasks
 
  • Note: if the Legal Hold error is 775 or -2147220729, the item is not available in the vault Store for the Legal Hold to be applied.
  • Note: it is recommended to run SQL maintenance on the customer database after re-applying Legal Holds - please see 000040169 under Related Articles below.

 

Issue/Introduction

After applying Legal Hold on a Discovery Accelerator (DA) Case, some items may show as having failed the Legal Hold process. The number of failed items may be seen under the Errors column when selecting All Cases in the Cases tab, or in the Legal Holds section when selecting the Properties sub-tab of the Case.
Powered by Wolken Software