Event ID 41309 logged in Windows Application Enterprise Vault (EV) Event logs
Article ID: 100053197
Updated On:
Description
Error Message
The following event id's will appear:
Type : Error
Date : 3/16/2022
Time : 4:27:34 AM
Event : 41309
Source : Enterprise Vault
Category : Index Admin Service
User : N/A
Computer : EV01.ev.local
Description:
The following error message occurred in the core indexing engine: Health of Elasticsearch Indexing engine cluster is [RED]. Check and fix, if the indices or shards are corrupted, insufficient disk space, out of memory issue.
V-437-41309
AND
Type : Error
Date : 3/16/2022
Time : 4:27:34 AM
Event : 41309
Source : Enterprise Vault
Category : Index Admin Service
User : N/A
Computer : EV01.ev.local
Description:
The following error message occurred in the core indexing engine: The following index/indices are in the [RED] state. Verify if the shards are corrupted, or there is insufficient memory or disk space.
ev01.ev.local_mb_3
V-437-41309
Cause
As the error indicates, there can be multiple causes of this issue. For the purposes of this article we will deal with the cause being corrupted shards. This particular type of corruption only applies to EV 14.2 and later as it is related only to the ElastisSearch indexing engine that was implemented in 14.2.
Resolution
To resolve one known cause of this issue, perform the following:
- Determine the location of the ElasticSearch Index in the properties of the EV Indexing Service in the Vault Administration Console (VAC). You will find the ElasticSearch index location on the 'Index Locations' tab.
- Browse to that location in Windows Explorer and search for 'corrupted_*.*'. Note: The apostrophes are not part of the search term.
- If a filename similar to 'corrupted_Qg1Qm48TT8SgmqJT17_utg' is found, then proceed to the next step. If it is not found, then contact Technical support.
- Stop the EV Indexing Service.
- Make a back up copy of the corrupted_* file you found and then delete the original.
- Start up the EV Indexing Service and verify the issue is no longer occurring.
Issue/Introduction
Event ID 41309 shows up in the event logs repeatedly every 5 minutes. The first occurrence of the events shows up 5 minutes after the Event ID 41302 is generated.
Note: Event ID 41302 indicates that the indexing service is up and fully functional.
Additional Information
