Overview

This article provides details on the meaning of the "Warning: GFI Archiver did not archive any emails between 11 and 12 today." message that is received by administrators.

Diagnosis

By default, Archiver performs this check every weekday (Monday to Friday) between 11:00 and 12:00 (noon).

When Archiver detects that emails are not being archived, an automated email is sent to the administrator notifying him on the issue. There are many different reasons why email is not being archived, for example, because of a wrong configuration, a problem with Microsoft Exchange or simply because emails have not been received in that particular period.

With that being said, the main question to ask will always be "Why did mail not get written to the database?". The most common reasons for this will be shown below as well as actions to be taken. 

Environment

GFI MailArchiver 2013 R2 or newer

Solution

As indicated above the Warning itself is not necessarily related to an error and instead is an indicator that the system should be checked to determine if there is indeed an issue. 

Low or No Mail Flow

In some cases Archiver may be processing mail as normal but for smaller customers, i.e. with a spam filter, may not receive a valid mail within this time period and all mail was blocked as Spam. As no mail reached the Exchange server and therefore the Journal mailbox, no mail was placed in to the Archive Stores during this time period, triggering the alert. In these scenarios there is nothing to do but await further legitimate mail to make it to the Exchange server, where once a copy has been sent to the Journal, Archiver will pull it as normal. 

To check if emails were downloaded and queued for archiving during the respective timeframe, from GFI Archiver, navigate to the Home > Archive Flow graph and overview if any items were found.

SQL Server is down/Connectivity Issues

As the warning is an indicator of being unable to write mail to the Archive Stores, if the issue is not low mail flow, the connectivity to the SQL server should be verified. If the network connectivity has been lost or the wrong credentials are in use we may not be able to write the content to the Archive store. 

When Archiver is unable to write the content to the stores during the specified time period it will trigger the warning. This will additionally be accompanied by emails being found in the Archiver\Core\Queue directory. This directory can be checked to see if the mail is still flowing or is stuck in the queue. If there are a large amount of emails in the queue it is a good indicator that we are unable to write the content to the database.

This can also occur if new databases are not being created properly, which can be related to the New Archive Store Settings or the credentials used when connecting to SQL. If the credentials are incorrect, adjust them here to allow the store to be created, after which mail should archive without further hold. 

Other Factors

The common occurrences above will resolve the vast majority of the instances of this warning but there are additional items to consider. Emails may fail to be parsed, due to corruption or other environmental factors which then as a result are unable to be written to the database. In these instances it will be required to Gather Troubleshooting Logs for Archiver. This will allow agents to review the logging for the data sources, following the thread to the Archive Store and determining the fault location.

Changing the Date and Time When Archiver Checks If Email Is Being Archived

Additionally the time that the check occurs can be adjusted if it does not fit the best time of day for your environment.

Note: This procedure requires to edit files manually. If edited incorrectly it can leave the server in a non-operational state. Please keep backups of any file which is edited throughout this article before saving any changes to them.

Changing the Weekend Days

1. Open the folder:
   • GFI MailArchiver 2014 or newer: ..\InstallationFolder\Core\Data
   • GFI MailArchiver 2013 R2: ..\InstallationFolder\Core2\Data
2. Open product.config in Notepad.
3. Locate the following key: <add key="DaysOff" value="Saturday|Sunday" />
4. Change the value according to your desired configuration. Allowed values are: Monday, Tuesday, Wednesday, Thursday, Friday, Saturday, Sunday

Changing the Time

Note: It is not recommended to change this setting.

1. From the start menu, select Run and type: services.msc
2. Stop the GFI Archiver Core service.
3. Locate the GFI Archiver installation folder and open ..\Core\Data\MArcSettings.xml in Notepad.
4. Locate the following block:
   

   <Notifications>
   <Archiving Enabled="true">
   <Start>11</Start>
   <End>12</End>
   </Archiving>
   </Notifications>

5. Change the Start or End values to the desired hour (0 to 24).
6. Save and start the GFI Archiver Core service.

Note: When upgrading to a newer version of GFI Archiver, the product.config file mentioned in this section will be overwritten with a default version making the changes void and ineffective. It is therefore suggested to keep a record of this procedure and follow it once again directly after upgrading to keep this functionality intact.

Testing

Due to the nature of the notification the only way to test this is to allow the alert to attempt to be triggered again. The process above for changing the time can be used to trigger a check on the next available hour. Alternatively wait until the next day at the specified time and look to determine whether the warning has re-occurred.