The Journal Task logs Event ID 3071 indicating it is corrupt

book

Article ID: 100030001

calendar_today

Updated On:

Description

Error Message

1. Event ID 3071 may be generated if a message is considered corrupt.  To determine if the message is corrupt, perform the steps below.

Event Type: Error 
Event Source: Enterprise Vault 
Event Category: Journal Task 
Event ID: 3071 
Description: 
The following message could not be archived by the Journaling Service as it may be corrupt. 
Title: %1
Mailbox: %2 

An error occurred whilst moving the message to the 'Enterprise Vault Journaling Service\Failed to copy' folder. The message has been marked as "Do Not Archive", and no further attempts will be made to archive this message.
V-437-3071
 

2. These events can also be caused when a journal mailbox cannot be synchronized and the following Event ID will be logged:

Event Type:    Error
Event Source:    Enterprise Vault
Event Category:    Agent Client Broker
Event ID:    3333
Computer:    Server1
Description:
This mailbox has duplicate entries in the directory and cannot be processed.
LegacyDN:
/o=Dome/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Recipients/cn=EVJournaMbx
V-437-3333

Resolution

Solution 1: 

  1. Drag the message to the desktop and then double-click on the message.
Note: If the message(s) cannot be found in the mailbox, proceed to the section below Step 3.
  1. If the message opens, drag the message from the desktop to the Inbox folder and the Exchange Journaling task will try to archive the message again.

Note: Delete the corrupt version from the Failed to copy folder.

  1. If the message does not open, the message is corrupt.  To determine why the message is corrupt, contact Microsoft for assistance.

The message in question is corrupted to the point that it will not be seen in Outlook, but Enterprise Vault can see it. The only option is to create a new Journal Mailbox and configure Exchange and Enterprise Vault to point to it.

 
Steps to configure a new journal mailbox for archiving:

  1. Request your Microsoft Exchange administrator to create a new journal mailbox and set it to be the journal mailbox target for Exchange.
  2. Add the new journal mailbox to the Exchange Server journal mailbox targets in the Enterprise Vault Administration Console.
Enterprise Vault > Directory on <EV_Server> > > Targets > Exchange > <Domain> > <Exchange_Server> > Journal Mailbox
  1. Configure the new target to the existing Journal archive.
  2. Wait for the old Journal Mailbox to empty, then remove it as a target in the Enterprise Vault Administration Console.
  3. Ask your Exchange Administrator to remove the old journal mailbox from the Exchange server

Solution 2: 

Event ID 3333 mentions a duplicate entry in the directory database.

  1. Run the SQL query below: ​
SELECT * from ExchangeMailboxEntry where LegacyMbxDN = <mailbox name from event>
  1. If there are multiple entries, open a support case for further assistance. 

Issue/Introduction

Event ID 3071 which states "The following message could not be archived by the Journaling Service as it may be corrupt." is logged while the Journal Task is running.
Powered by Wolken Software