Event Type: Error
Event Source: Enterprise Vault
Event ID: 4143
Description:
Insufficient Diskspace is available on drives %1 and %2 for the Enterprise Vault to run Enterprise Vault will now be shutdown; to correct this problem, delete any unwanted files and restart Enterprise Vault
V-437-4143
Any file name that begins with viv_ (there are many) will be stored in the %temp% folder. Enterprise Vault (EV) 64-bit Indexing leverages the IBM Velocity Indexing engine which by default makes use of the Windows\Temp folder. However, those files are discarded once EV is finished with them and some are left behind with a 0KB or 1KB file size.
When there is an influx of these files that are large in size, it's an indicator that there is some type of indexing issue which could be:
a. Failed index volumes attempting to be rebuilt and having issues
b. A large backlog of items waiting to be indexed, often indicated with Event ID 41022
c. StorageCrawler errors in the event logs with a reference to indexing
Note: ElasticSearch indexing does not use these files. It is only the 64-bit Velocity indexes that need to be checked.