Event ID 41008 is occurring when there are few items in the WatchFile table of the vault store database.

Problem

Event ID 41008 is occurring when there are few items in the WatchFile table of the vault store database.

Error Message

Event Type: Warning
Event Source: Enterprise Vault
Event Category: Monitoring
Event ID: 41008
Computer: EVVAULT01
Description:
There are XXXXXX savesets that have not yet been backed up or replicated for Vault Store 'Mailbox Vault Store'.
Review your procedures and make any changes needed to ensure that backups happen in a timely fashion.
If you are using an EMC Centera, check the size of the Centera replication queue.

V-437-41008

Cause

This issue can occur if regular maintenance is not being performed on the Enterprise Vault (EV) SQL databases.  The indexes on the tables need to be maintained regularly to ensure the correct numbers are being reported.

Solution

1. Run the following query to determine if there are rows that still list this number as a part of the index.
   
   Use Vault_Store_DB_Name
   Select * from sysindexes where rows = 'Number-of-items-from-event'
   
   NOTE: Replace the value for Number-of-items-from-event by the number reported in the 41008 event. 
    
2. Run the following query to determine the number of items in the WatchFile table.
   
   Use Vault_Store_DB_Name
   Select count (*) from Watchfile
   
   This will return the number of items that are currently being monitored.  
    
3. Run the following query to determine the size of the JournalArchive table.  
   
   Use Vault_Store_DB_Name
   usps_gettablesize JournalArchive
   
   This will return the approximate size of the table.

• SQL maintenance should be run to ensure the numbers are being reported properly.  Refer to 100022023 under Related articles. 
• If all of the queries are similar in reported size, then backup procedures on the vault store partition location should be reviewed. Refer to 100022359 under Related articles.
• If using Centera, the replication queue should be checked.