Error Message

Violation of PRIMARY KEY constraint 'PK_tblHashToAnalysedItem_'.
Cannot insert duplicate key in object 'dbo.tblHashToAnalysedItem_(CaseID>'. The duplicate key value is (, )

The tblHashToAnalysedItems table is one of several tables created when a DA Case is enabled for Analytics. The table name is suffixed with an underscore (_) followed by the CaseID value. The information added to this table are the DiscoveredItemID, HashID and VaultID for each item processed by the 'Data Collection' ingestion. The tblHashToAnalysedItem table has a primary key on the columns HashID, DiscoveredItemID, meaning only one entry can exist that has a specific HashID and DiscoveredID combination.

The error indicates an attempt was made by the ingestion processing to add an entry with the listed HashID and DiscoveredItemID to tblHashToAnalysedItems but that entry already exists. In other words, the item is being processed more than once. The cause of this re-processing is not currently known; however, a few possible causes can be deduced:

1. Re-processing of batches of items due to TCP Offload Engine (TOE), or one of its variants. Typically, Analytics Data Collection ingestion processes items in batches. TOE is known to cause issues with batch processing.
2. Re-processing of SQL transaction logs when errors occur while using SQL log shipping/mirroring. It may be that transaction logs were re-run during fail-overs or during a failed attempt to write the logs to a secondary/backup server/database/replica.
3. Manual edits of the data in the Analytics tables. Any manual edits to data in the Analytics tables are not supported.
4. Other unknown causes.

There are no current methods to remove the errant entry or to re-run the Data Collection ingestion processing for the failed items. The options are to either create a new DA Case or to re-run Analytics processing in the existing Case:

1. New DA Case.
1.1. Create a new DA Case with the same settings as in the original Case and add the required Role Assignments as in the original Case.
1.2. Review the original Case and note the Vault Stores and Archives selected in the Archives tab. Then select the same Vault Stores and Archives in the new Case.
1.3. Review the Searches with 'In Review' status in the original case and note their Search Criteria, along with any customised Vault Stores and Archives targeted by the Searches. Then recreate the Searches in the new Case and Accept them as needed.
1.4. Review the items in the Review Set for both Cases to confirm the same items have been captured in both Cases.
1.5. Once the required Searches have been run and Accepted, and the Review Set items have been confirmed, then enable Analytics in the new Case and allow the Analytics processing to complete.
1.6. Once Analytics has successfully completed in the new DA Case, a decision can be made to keep, Close or Delete the original Case.

2. Re-run Analytics processing in the existing Case.
2.1. Disable Analytics in the existing Case in the Analytics tab.
2.2. Run a SQL backup of the DA Customer database's data files (Full backup) and the transaction logs (Transaction Log backup). Here are some general steps to run SQL backups - please refer to your onsite SQL team for specific guidance before running SQL backups:
2.2.1. Open SQL Server Management Studio with an account having permissions to run SQL backups.
2.2.2. In Object Explorer, expand Databases and find the DA Customer database.
2.2.3. Right-click the DA Customer database, click on Tasks, then click on Back Up.
2.2.4. Select Full under Backup type in the General page. Configure the Destination and any other Media Options or Backup Options, per company process. Then run the Full backup.
2.2.5. Right-click the DA Customer database, click on Tasks, click on Back Up again.
2.2.6. Select Transaction Log under Backup type in the General page. Configure the Destination and any other Media Options or Backup Options, per company process. Then run the Transaction Log backup.
2.3. Once SQL data and transaction log backups are complete, then re-enable Analytics in the Analytics tab.