Event 3492 is logged by the Mailbox Archiving Task

Problem

As a result of the issue described in article (Mailbox archiving performance can be significantly degraded if one or more mailboxes has a large number of items in a single folder) the Mailbox Archiving Task in Enterprise Vault (EV) 12.0.1 and later versions now logs an event 3492 for every mailbox that has a folder with an item count greater than 40,000 items by default. 

This behavior is in response to the poor performance and Outlook connectivity problems experienced in Exchange environments where folders with high item counts are present and EV is using Restricted Views to query items in mailbox folders. 

A new tool called SearchFolderManager.exe is now available which will create Search Folders on affected mailboxes, allowing the Mailbox Archiving Task to use the Search Folders to query high item count folders, which yields better performance than using Restricted Views.

Error Message

Log Name:      Veritas Enterprise Vault
Source:        Enterprise Vault
Event ID:      3492
Task Category: Archive Task
Level:         Error
Computer:     EVSERVER1.EV.Local

Description:
The archiving task stopped processing the following mailbox. Search folders are needed in the mailbox to enable the archiving task to process the large number of items in the folder indicated. Use the SearchFolderManager tool to create the mailbox search folders for the archiving task to use. The archiving task will process this mailbox on the next scheduled archiving run.

Mailbox: /o=First Organization/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Recipients/cn=7ff373c8719049debc1aafcd47bfb08b-Vault
Folder:    Inbox
Items:     45000

V-437-3492

Solution

For each mailbox logged via a 3492 event, run the SearchFolderManager tool against the Legacy Mailbox DN of that mailbox.  This Legacy Mailbox DN is also logged in the 3492 event message. 

The following 32-bit DWORD registry entries can be created and assigned values if their default values need to be overridden.  If these registry entries are not present, then the default value for SearchFolderCreationThreshold is 40,000 and the default value for SearchFolderDeletionThreshold is 30,000.

HKey_Local_Machine\Software\Wow6432Node\KVS\Enterprise Vault\Agents\SearchFolderCreationThreshold
HKey_Local_Machine\Software\Wow6432Node\KVS\Enterprise Vault\Agents\SearchFolderDeletionThreshold

The Archive Task will have to be restarted to apply the new settings.  

The Archive Task will perform the following steps when processing the folders of each mailbox.

1. If the number of items in the folder is higher than the SearchFolderCreationThreshold value then a search folder is required on this folder.  
   1. If a search folder already exists on the folder and it is consistent with the expected software version and policy settings, then this search folder will be used to enumerate items in the folder.
   2. If an appropriate search folder does not exist then an event 3492 will be logged in the Enterprise Vault event log indicating that the mailbox requires a search folder.  Processing of the mailbox will stop in order to avoid putting the Exchange server under excessive load.

2. If the number of items in the folder is lower than the SearchFolderDeletionThreshold value then any existing search folder will be deleted on this folder and a restricted view will be used to enumerate items in the folder.

3. If the number of items in the folder is higher than the SearchFolderDeletionThreshold value but lower than the SearchFolderCreationThreshold value then a search folder is not required for the folder that is being processed.  However, if a search folder already exists on the folder and it is consistent with the expected software version and policy settings then the existing search folder will be used to enumerate items in this folder.  If an existing search folder is not present then a restricted view is used to enumerate items in this folder.

Running SearchFolderManager.exe

Method 1: Run manually at the Command Prompt as the Vault Service Account

The syntax for the SearchFolderManager.exe tool is:

<Veritas Enterprise Vault Installation Folder>\SearchFolderManager.exe <Mailbox DN>

Note: Use quotation marks if the Mailbox DN contains spaces (which is usually the case).

Example:

Note that the -User portion of the last /cn portion of the outputs and commands in all of the screen shots in this Article is an example for a user.  The -User portion may not be included in all environments and should not be used where it does not exist.

The Mailbox DN for a mailbox can be obtained from the 3492 event, via the Find Archive or Folder... option that is displayed when holding down Ctrl and Shift keys and right-clicking the Archives node in the Vault Admin Console, or by querying a user's Active Directory object for the legacyExchangeDN property using a tool such as ADSIEdit.

Method 2: Run automatically using a script

Click on the link attached PowerShell script to see a PowerShell script named  'RunSearchFolderManagerForAllMailboxesWith3492Events.txt' which can be used to run SearchFolderManager automatically for all mailboxes listed in the server's 3492 events.  Note that the link to the PowerShell script may open the file in a separate browser tab and copy the lines in that tab and paste them into a text file that should be saved with the script name "RunSearchFolderManagerForAllMailboxesWith3492Events.ps1".


The script's -StartDate and -EndDate parameters can be used to limit the range of event log entries against which SearchFolderManager will be run.

Note: RunSearchFolderManagerForAllMailboxesWith3492Events.txt script is not required to be executed for Enterprise Vault version 14.4.1 and later as we have integrated the search folder manager with Exchange mailbox archiving task.