Error Message

EV Event Logs entry on the Accelerator server:

Log Name: Veritas Enterprise Vault
Source: Accelerator Service Processor
Event ID: 297
Level: Error
Description:
APP AT - Customer ID: X - Error processing Vault to Search off the queue: Searching Vault Thread - worker thread for index server: X (0)
Vault ID: X
Number of tries: 5
Cause:The search timed out.      (0x80041c71)

V-437-297

The following may also be seen in the EV Event Logs on the Accelerator Server:

Log Name: Veritas Enterprise Vault
Source: Enterprise Vault
Event ID: 4289
Level: Warning
Description:
Unable to connect to server 'EVSERVER' using Kerberos authentication.
Reason: The RPC server is unavailable.  (0x800706ba)
The DCOM connection was attempted with:
CLSID: {F4D3EB5B-C7C5-11D1-90DB-0000F879BE6A} (EnterpriseVault.DirectoryService.1)
Server name: EVSERVER
Server Principal Name: dcom/...
The connection was made using WinNT authentication. Check that the server name identifies a known server.
There may be a problem with Kerberos authentication or a security issue. An unknown server could indicate a man-in-the-middle attack.

V-437-4289

The following DTrace log entries may be seen (some lines may be repeated in the log):

[1234]    (AcceleratorService)    <3456>    EV:H    WinHttpRequest::OnCallback. WINHTTP_CALLBACK_STATUS_REQUEST_ERROR.
[1234]    (AcceleratorService)    <3456>    EV:H    WinHttpRequest::OnCallback. WINHTTP_CALLBACK_STATUS_REQUEST_ERROR - Result=5, Error=12002|
[1234]    (AcceleratorService)    <3456>    EV:H    WinHttpRequest::OnCallback exit. ERROR HR=0x8001011f.
[1234]    (AcceleratorService)    <5678>    EV:H    CIndexSearch2::PerformSearch Search failed with 'normal' error: hr=<0x80041c71>.
[1234]    (AcceleratorService)        EV-L    {VaultToSearch} Exception: <0x80041c71> Info:{CX} Last Error: The ARCHIVENAME (ID: . . .) Index Volume X for search ID X failed. The search will be retried. The error was :|<0x80041c71> Diag:HRESULT: 80041c71 Type:System.Runtime.InteropServices.COMException ST:   at KVS.EnterpriseVault.Interop.IndexSearch2Class.SearchToXML(String bsQuery, Int32 startResult, Int32 maximumResults, String reserved, String processingInstruction, Int32 xmlFormatOptions)|   at KVS.Accelerator.Search.VaultToSearch.SearchIndexVolume() Inner:None

[1234]    (AcceleratorService)        EV-H    {-} Exception: Error Search_Queues_ProcessVaultError Info:{AcceleratorEvent} {CX} Error processing Vault to Search off the queue: Searching Vault Thread - worker thread for index server: X (2)|Vault ID: 14|Number of tries: 5|Cause:<0x80041c71> Diag: Type:System.Exception ST: Inner:None
[1234]    (AcceleratorService)        EV-L    {VaultToSearch} {CX} Searching Vault Thread - worker thread for index server: 2 (2): search 14 update VaultSearchID 14 to usp_upd_SearchVault_Error

 

This issue can occur when certain network ports are blocked on the EV Indexing server servicing the Archive being Searched.

 

The EV Indexing server, and any associated firewalls and/or routers/network devices should be reviewed by the onsite network administration team to verify the required ports are open. The ports most specific to CA/DA Searches are ports 80 and 443. However, other ports may also cause this issue. Here is a list of the most common ports used by EV, CA and DA:

53    DNS for User and Computer Authentication, Name Resolution, Trusts.
80    HTTP client access and web search.
88    Kerberos for User and Computer Authentication, Forest Level Trusts.
135    DCOM.
137    NetLogon, NetBIOS Name Resolution for User and Computer Authentication.
139    DFSN, NetBIOS Session Service, NetLogon for User and Computer Authentication, Replication.
389    LDAP for Directory, Replication, User and Computer Authentication, Group Policy, Trusts.
443    HTTPS client access and web search.
445    Active Directory.
636    LDAP SSL for Directory, Replication, User and Computer Authentication, Group Policy, Trusts.
1024 - 65535    Dynamic DCOM.
1433, 1434    SQL server communications.
3268    LDAP GC for Directory, Replication, User and Computer Authentication, Group Policy, Trusts.
3269    LDAP GC SSL for Directory, Replication, User and Computer Authentication, Group Policy, Trusts.
5114    Official EV services port.
8085    CA/DA server to websites and server to client communications.
8086    CA/DA server to client communications.

 

 

Enterprise Vault (EV) Compliance Accelerator (CA) and Discovery Accelerator (DA) Searches fail and list a time out error with hex code 0x80041c71 for the affected Index Volume(s) under the Search Details 'Information' column. Retrying the Search results in the same behaviour. The EV Event Logs on the Accelerator server may show Event ID 297 entries as listed below. A DTrace on the Accelerator server of the AcceleratorService process during a Search may show entries as listed below.