Tuesday, July 23, 2013

Enterprise vault Indexing problem – event id 41021



Problem:

Enterprise Vault v10.0.2.

We noticed getting the event id 41021:
Log Name:      Symantec Enterprise Vault
Source:        Enterprise Vault
Date:          7/22/2013 11:32:37 AM
Event ID:      41021
Task Category: Monitoring
Level:         Warning
Keywords:      Classic
User:          N/A
Computer:      VAULTSERVER.MYDOMAIN.com
Description:
There are 524628 archived items in Vault Store 'VAULTNAME' that are waiting to be indexed.

There may be a problem with Enterprise Vault indexing.

You can use the System Status feature in the Administration Console to help you resolve this issue.


All Indexes appear to be Healthy and Online.
Synchronizing the Index in question was looping.

Solution:

By looking into the earlier events (1 week earlier) – we noticed Index Failure events for the most recent volume of the Index in question.  Even though at the time of the event id 41021 the index volume appear to be healthy, it apparently was not.
We started “rebuild” just the most recent volume of the index and it completed with 12 hours and all problems got cleared.