Event 3492 is logged by the Mailbox Archiving Task
Article ID: 100032531
Updated On:
Description
Error Message
Log Name: Veritas Enterprise Vault
Source: Enterprise Vault
Event ID: 3492
Task Category: Archive Task
Level: Error
Computer: EVSERVER1.EV.Local
Description:
The archiving task stopped processing the following mailbox. Search folders are needed in the mailbox to enable the archiving task to process the large number of items in the folder indicated. Use the SearchFolderManager tool to create the mailbox search folders for the archiving task to use. The archiving task will process this mailbox on the next scheduled archiving run.
Mailbox: /o=First Organization/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Recipients/cn=7ff373c8719049debc1aafcd47bfb08b-Vault
Folder: Inbox
Items: 45000
V-437-3492
Notes
By default, EV uses views when archiving items. When an Exchange 2013/2016 mailbox folder contains excessive amount of items, the restrictions used by EV to parse the contents consume a lot of resources on the Exchange Server which impacts the performance of both Exchange and Enterprise Vault.
The Microsoft "recommended way" to persist restrictions, is to use search folders to list the contents rather than the previous way of using views. To this end, it was determined that EV had to manage the creation and deletion of search folders when necessary, so as not to overburden the Exchange Server with search folders. This was done as follows:
- FolderSearchManager was created to scan a single mailbox. For any folder containing over a certain number of items, it creates a search folder(s) that is now a requirement for Enterprise Vault. Additionally, FolderSearchManager will delete search folder(s) if the number of items has dropped below a certain level. The creation/deletion thresholds is configurable via registry values and be used by the archiving task. FoldersearchManager will also check whether any existing search folders have been orphaned and delete those for which the mailbox folder has been deleted.
- When archiving a folder (either manual or background archiving), the archive task will check the number of items in the folder against the thresholds configured in the registry.
- If the number of items in the folder is less than the deletion threshold, the existing search folder will be deleted allowing restricted views to take place and lessen the use of search folders when necessary so as not to overburden the Exchange Server.
- If the number of items in the folder is higher than the deletion threshold but lower than the creation threshold, then an existing search folder will be used to list items. If none exist, then a restriction view (rather than a search folder) will be used on the mailbox folder.
- If the number of items in the folder is higher than the creation threshold, then an existing search folder will be used to list items.
- If the required search folder does not exist then an event will be logged indicating that this mailbox requires search folders and processing of the mailbox will be halted (to prevent excessive load on the Exchange Server).
Note: If processing is halted, then the state of the archiving report for the mailbox will be undefined.
- Mailbox synchronization will check whether any existing search folders have been orphaned and delete those for which the mailbox folder has been deleted. This will reduce load on the Exchange Server when the search folder(s) are no longer required.
Enterprise Vault 14.4.1 and later version has search folder manager integrated in archiving task. Refer JIRA: EV-63895
Resolution
For each mailbox logged via a 3492 event, run the SearchFolderManager tool against the Legacy Mailbox DN of that mailbox. This Legacy Mailbox DN is also logged in the 3492 event message.
The following 32-bit DWORD registry entries can be created and assigned values if their default values need to be overridden. If these registry entries are not present, then the default value for SearchFolderCreationThreshold is 40,000 and the default value for SearchFolderDeletionThreshold is 30,000.
HKey_Local_Machine\Software\Wow6432Node\KVS\Enterprise Vault\Agents\SearchFolderCreationThreshold
HKey_Local_Machine\Software\Wow6432Node\KVS\Enterprise Vault\Agents\SearchFolderDeletionThreshold
The Archive Task will have to be restarted to apply the new settings.
The Archive Task will perform the following steps when processing the folders of each mailbox.
- If the number of items in the folder is higher than the SearchFolderCreationThreshold value then a search folder is required on this folder.
- If a search folder already exists on the folder and it is consistent with the expected software version and policy settings, then this search folder will be used to enumerate items in the folder.
- If an appropriate search folder does not exist then an event 3492 will be logged in the Enterprise Vault event log indicating that the mailbox requires a search folder. Processing of the mailbox will stop in order to avoid putting the Exchange server under excessive load.
- If the number of items in the folder is lower than the SearchFolderDeletionThreshold value then any existing search folder will be deleted on this folder and a restricted view will be used to enumerate items in the folder.
- If the number of items in the folder is higher than the SearchFolderDeletionThreshold value but lower than the SearchFolderCreationThreshold value then a search folder is not required for the folder that is being processed. However, if a search folder already exists on the folder and it is consistent with the expected software version and policy settings then the existing search folder will be used to enumerate items in this folder. If an existing search folder is not present then a restricted view is used to enumerate items in this folder.
Running SearchFolderManager.exe
Method 1: Run manually at the Command Prompt as the Vault Service Account
The syntax for the SearchFolderManager.exe tool is:
Note: Use quotation marks if the Mailbox DN contains spaces (which is usually the case).
Example:
Note that the -User portion of the last /cn portion of the outputs and commands in all of the screen shots in this Article is an example for a user. The -User portion may not be included in all environments and should not be used where it does not exist.
The Mailbox DN for a mailbox can be obtained from the 3492 event, via the Find Archive or Folder... option that is displayed when holding down Ctrl and Shift keys and right-clicking the Archives node in the Vault Admin Console, or by querying a user's Active Directory object for the legacyExchangeDN property using a tool such as ADSIEdit.
Method 2: Run automatically using a script
Click on the link attached PowerShell script to see a PowerShell script named 'RunSearchFolderManagerForAllMailboxesWith3492Events.txt' which can be used to run SearchFolderManager automatically for all mailboxes listed in the server's 3492 events. Note that the link to the PowerShell script may open the file in a separate browser tab and copy the lines in that tab and paste them into a text file that should be saved with the script name "RunSearchFolderManagerForAllMailboxesWith3492Events.ps1".
The script's -StartDate and -EndDate parameters can be used to limit the range of event log entries against which SearchFolderManager will be run.
Note: RunSearchFolderManagerForAllMailboxesWith3492Events.txt script is not required to be executed for Enterprise Vault version 14.4.1 and later as we have integrated the search folder manager with Exchange mailbox archiving task.
Issue/Introduction
This behavior is in response to the poor performance and Outlook connectivity problems experienced in Exchange environments where folders with high item counts are present and EV is using Restricted Views to query items in mailbox folders. A new tool called SearchFolderManager.exe is now available which will create Search Folders on affected mailboxes, allowing the Mailbox Archiving Task to use the Search Folders to query high item count folders, which yields better performance than using Restricted Views.
Additional Information
