Error Message

Numerous event ID 7110's may appear in the event log:

Event ID: 7110 An invalid SIS part was encountered while doing watch file scan. Following further information is available. | Partition Name = Express Vault Store Ptn20 | VaultStoreEntryId = 13055AEA8B5CB31418C25253E9A272C951210000EmailArchive | FileTransactionId = 90B00EA6749AE94CF1B81F4365250BF1 | Invalid Reason = Verification failed for sis part when post processing Saveset with TID = [E0B7981E232E893F97834179670DC371].|Following sis part details are available:|  FPDistinctionByte = [186]|  FPHashPart1 = [1823365392]|  UniqueId = [0]. |For more information, see Help and Support Center at http://entced.symantec.com/entt?product=ev&language=english&version=11.0.1.0&build=11.0.1.3527&error=V-437-7110


The event id 7110 will stop and complete with the following event ID:

Event ID: 29054 Watch file scan has found more than 100 invalid savesets within 120 seconds for the Vault Store with Entry Id '13055AEA8B5CB31418C25253E9A272C951210000EmailArchive'. The scan for this Vault Store will be stopped.  |For more information, see Help and Support Center at http://entced.symantec.com/entt?product=ev&language=english&version=11.0.1.0&build=11.0.1.3527&error=V-437-29054

Dtrace of storagefilewatch will show the following:

Extracting 2016\06-22\E\016\E016D23B48452F10001FF939A4C8E941~A6~E94A3C37~00~1.DVSSP from collection I:\Mount Points\EVStor 27\Journal Partition 6\2016\06-22\E\Collection105735.CAB
{CCabinet::ExtractFileFrom(Entry)                                                                                                                                             {CCabinet::ExtractFromCab(Entry)                                                                                                                                               
{CCabinet::ExtractFromCab:#215} Setting last-access time for Collection file I:\Mount Points\EVStor 27\Journal Partition 6\2016\06-22\E\Collection105735.CAB. hr = 0x00000000      
{EVCommandExecutor::ExecuteCommand(Entry)                                                                                                                                        {FDICommand::Execute(Entry)                                                                                                                                                      {fdi} (Entry)                                                                                                                                                                    
{OpenCabReadOnly(Entry)                                                                                                                                                          {`anonymous-namespace'::CabReadImpl::ValidateFileList:#244} File list size: 12491. Number of Files:157.                                                                           
                                                                                                                                            
{ExtractData:#141} Failed writing I:\Mount Points\EVStor 27\Journal Partition 6\2016\06-22\E\016\E016D23B48452F10001FF939A4C8E941~A6~E94A3C37~00~1.ARCHDVSSP: errno = 28           
{ExtractFileCommand::Execute:#61} _com_error exception: [Catastrophic failure(0x8000ffff)]                                                                                       
{ExtractFileCommand::Execute} (Exit) Status: [Catastrophic failure  (0x8000ffff)]                                                                                                  
                                                                                                                         
{EVCommon::DeleteFileW:#926} FileName = I:\Mount Points\EVStor 27\Journal Partition 6\2016\06-22\E\016\E016D23B48452F10001FF939A4C8E941~A6~E94A3C37~00~1.ARCHDVSSP                 
{EVCommandExecutor::ExecuteRecoverWithRetry} (Exit) Status: [Success]                                                                                                      

In this particular case there was a journal vault store and a mailbox vault store.
All partitions have collections enabled and mailbox archiving occurs after an item reaches 6 moths in age.
StorageFileWatch is attempting to to call remote sis parts from the journal vault store that have been collected. However, at a certain point it starts throwing event ID 7110 until it reaches 100 failures in 120 seconds and aborts the storagefilewatch run prematurely. As a result 'New items awaiting back up or replication' begins to fall behind.

As the remote sis parts have to be extracted from CAB files it was determined that the partition that the remote sis parts resided on was out of space. This prevent the sis parts from being successfully extracted from the CAB files and failing verification.

Added necessary space to the vault store partition that was out of space in order to allow CAB extractions to complete. Then set and clear back up mode on the vault store. Monitor the EV Status window to ensure that 'New items awaiting back up or replication' clears the back log.

'New items awaiting backup or replication' count in Enterprise Vault (EV) status module increases on a daily basis.
Event logs show numerous Event ID's 7110 after bringing a vault store out of back up mode or a restart of the storage service. The event ID's 7110's will stop with and event ID 29054.