Tuesday, May 6, 2014

Critical Error: Event ID 27; Event Source Volsnap; Windows 7 : The shadow copies of volume C: were deleted because the shadow copy storage could not grow in time.

If you are getting Critical Error with Event ID: 27; Event Source: Volsnap;  in the event log with following pop-up




with either explanation; 

  1. The shadow copies of volume C: were aborted during detection because a critical control file could not be opened.
  2. The shadow copies of volume C: were deleted because the shadow copy storage could not grow in time.  Consider reducing the IO load on the system or choose a shadow copy storage volume that is not being shadow copied.
and you click More Information link: Event Log Online Help, it yields disappointing results (re image below).


So here's some information to find information for this event id, particularly running on Windows x64 7, 8, 8.1 systems. 

Root Cause Analysis




  1. Windows 7 includes a feature to automatically save computer's system files and settings as versions and is called System Protection

    Windows 8, 8.1
     in addition to System Protection, the feature has been extended to included versioning user's files and documents and is called
    File History. An excellent article from Windows Engineering Team about File History can be found here and how to enable it.

    Both of these services use Volume Shadow "Copy" Service (VSS), which can generate Volsnap errors, with the same message as in the table below.
    In Win 7/8+, System Protection Tab of System Properties window, available in Control Panel icon named System.

    So check if you System Protection/File History is Enabled and has enough space to function.


  2. Allot of these errors seem to be related to Virtual machines lockup or freeze when performing a backup of the Hyper-V host and virtual machines using Windows Server Backup. So on this Windows 7 or Windows 8 this could be using Virtual PC or VMWare.

    This is usually caused by a VM that has shadow storage for a data partition on a partition that is not local (i.e.  the shadow storage for d: is on c:).  Since Hyper-V reverts one VHD at a time, this can cause volsnap to abort snapshot discovery.  If the affected partition isn't part of the system state, then the Hyper-V writer will ignore the error.

    The 3rd party backup is probably including a different subset of the child partitions. The issue may with third party backup software.

    Please verified all the settings for the Hyper-v host to backup running VM's and initiated the backup using Windows Server Backup, then to see whether the same issue still exists.

    http://social.technet.microsoft.com/Forums/windowsserver/en-US/2a434be6-9b61-4f7d-a74b-b7707d30c655/server-backup-errors-on-hyperv-r2?forum=windowsbackup

  3. Another major cause for this error is SQL Server which uses VSS.

    i.  VSS errors for SQL Server cause failing backups here.

    ii. Time-out errors occur in Volume Shadow Copy service writers here.

  4. Checking errors of the Volume Shadow Copy from command line, use the following

    Vssadmin List Shadows Lists existing volume shadow copies, the time the shadow copy was created, and its location.
    Vssadmin List ShadowStorage Lists the volume shadow storage space currently in use, the space that is reserved for future use (labeled as allocated), and the maximum space that might be dedicated. This space is used to store changes while a shadow copy is active. The following sample output was generated using a computer that currently had about 3GB of files stored in a shadow copy, but that might allocate as much as 6.4GB.
    Vssadmin List Volumes Lists volumes that are eligible for shadow copies.

    See how to Manage Volume Shadow Copy Service from CMD line here.

  5. Sometimes this error is paired with another VolSnap error, since it Event ID 27, is blocking VSS functions, other errors are likely to occur for VSS operations.



    > Check the event log to see if you can find another Event ID with VolSnap and check the below table for a match. In the image above, it
    Event ID 25 which has an entry in the below table of the Diff Area Integrity Event Errors.
    Microsoft has laid out event id errors in a very large tree see
    hereNote: The title are linked to parts of the Events and Errors hierarchy for event log.
Applies To: Windows Server 2008,  but matches Windows 7, Windows 8+ errors

The Diff Area is the storage space that Shadow Copies of Shared Folders allocates on a volume for maintaining the snapshots of the contents of shared folders. A snapshot is a block-level set of information that represents the differences between the current content and content from a previous point in time. The integrity of existing and new snapshots depends on the integrity of the Diff Area.

Events

Event IDSourceMessage
1
VolSnap
The shadow copy of volume %2 could not create a diff area file on volume %3
2
VolSnap
The shadow copy of volume %2 could not be created because volume %3, which is specified as part of the diff area, is not an NTFS volume or an error was encountered while trying to determine the file system type of this volume.
3
VolSnap
The shadow copy of volume %2 could not lock down the location of the diff area file on volume %3.
VolSnap
The shadow copies of volume %2 were aborted because of an IO failure on volume %3.
VolSnap
The shadow copies of volume %2 were aborted because volume %3, which contains a diff area file for this shadow copy, was force dismounted
VolSnap
There was insufficient disk space on volume %3 to create the shadow copy of volume %2.  Diff area file creation failed.
VolSnap
There was insufficient disk space on volume %3 to grow the diff area for shadow copies of %2.  As a result of this failure all shadow copies of volume %2 are at risk of being deleted.
VolSnap
The shadow copies of volume %2 were aborted because the diff area file could not grow in time.  Consider reducing the IO load on this system to avoid this problem in the future.
VolSnap
The oldest shadow copy of volume %2 was deleted to keep disk space usage for shadow copies of volume %2 below the user defined limit.
VolSnap
The shadow copies of volume %2 were aborted because the diff area file failed to grow.
VolSnap
The shadow copies of volume %2 were aborted because the diff area file could not grow due to a user imposed limit.
VolSnap
There was a user imposed limit that prevented disk space on volume %3 from being used to grow the diff area for shadow copies of %2.  As a result of this failure all shadow copies of volume %2 are at risk of being deleted.
VolSnap
The shadow copies of volume %2 were aborted because volume %3 has been dismounted.
VolSnap
When preparing a new volume shadow copy for volume %2, the shadow copy storage on volume %3 did not have sufficiently large contiguous blocks.  Consider deleting unnecessary files on the shadow copy storage volume or use a different shadow copy storage volume

I did find Event ID 27, but source is VSS and VolSnap and therefore message does not apply.

But the category "Volume Shadow Copy Service Operations
" seems like a likely place for the
"The shadow copies of volume C: were aborted during detection because a critical control file could not be opened." error.

Files Services - Volume Shadow Copy Service - Volume Shadow Copy Service Operations
http://technet.microsoft.com/en-us/library/cc734545(v=ws.10).aspx

The Volume Shadow Copy Service (VSS) provides the ability to create a point in time image (shadow copy) of one or more volumes that can be used to perform backups. The service is also used during restores of applications.

Events

Event IDSourceMessage
VSS
Volume Shadow Copy Service information: The COM Server with CLSID %1 and name %2 cannot be started. [%3] %4
VSS
The user name %1 specified in registry (%2) does not map to a real user name. The entry is ignored. It must have a valid username as name, be of type REG_DWORD, and value either '0' or '1'. %3
VSS
The value with name %1 specified in registry (%2) is not of type REG_DWORD. The entry is ignored. It must have a valid username as name, be of type REG_DWORD, and value either '0' or '1'. Value '0' denies the username from running any VSS writer. Value '1' is used to allow it. %3
VSS
The value with name %1 specified in registry (%2) of value (%3) cannot be interpreted. The entry is ignored. It must have a valid username as name, be of type REG_DWORD, and value either '0' or '1'. Value '0' denies the username from running any VSS writer. Value '1' is used to allow it. %4
VSS
Volume Shadow Copy Service error: The EventSystem service is disabled or is attempting to start during Safe Mode. The Volume Shadow Copy service cannot start while in safe mode. If not in safe mode, make sure that EventSystem service is enabled. CLSID:%1 Name:%2 [%3] %4
VSS
Volume Shadow Copy Service error: The Volume Shadow Copy infrastructure cannot be used during Safe Mode. %1
VSS
Volume Shadow Copy Service error: Writers will not receive events since the COM+ database is corrupted. This might happened if an error occurred during Windows setup. The error returned from CoCreateInstance on class with CLSID %1 and Name %2 is [%3] %4
VSS
Volume Shadow Copy Service error: Either the COM+ Event System service (EventSystem) or the COM+ System Application service (COMSysApp) is disabled. Please enable the service and try again. %1
VSS
Volume Shadow Copy Service error: The Volume Shadow Copy service (VSS) is disabled. Please enable the service and try again. %1
VSS
Volume Shadow Copy Service error: The Microsoft Software Shadow Copy Provider (SWPRV) service is disabled. Please enable the service and try again. %1
VSS
Volume Shadow Copy Service error: Unexpected error querying for the IVssWriterCallback interface. hr = %1. This is often caused by incorrect security settings in either the writer or requestor process. %2
VSS
Volume Shadow Copy Service error: Writer with name %1 and ID %2 attempted to subscribe in safe mode. %3
VSS
Volume Shadow Copy Service error: The process that hosts the writer with name %1 and ID %2 does not run under a user with sufficient access rights. Consider running this process under a local account which is either Local System, Administrator, Network Service, or Local Service. %3
VSS
The VSS service is shutting down due to idle timeout. %1
VSS
The VSS service is shutting down due to shutdown event from the Service Control Manager. %1
VSS
Volume Shadow Copy Service error: Error on creating/using the COM+ Writers publisher interface: %1 [%2]. %3
VSS
Volume Shadow Copy Service error: Error calling a routine on a Shadow Copy Provider %1. Routine details %2 [hr = %3]. %4
VSS
Volume Shadow Copy Service error: The system may be low on resources. Unexpected error at background thread creation (_beginthreadex returns %1, errno=%2).
VSS
Volume Shadow Copy Service error: The I/O writes cannot be flushed during the shadow copy creation period on volume %1. The volume index in the shadow copy set is %2. Error details: Open[%3], Flush[%4], Release[%5], OnRun[%6].
VSS
Volume Shadow Copy Service error: The I/O writes cannot be held during the shadow copy creation period on volume %1. The volume index in the shadow copy set is %2. Error details: Open[%3], Flush[%4], Release[%5], OnRun[%6].
VSS
Volume Shadow Copy Service error: Writer %1 did not respond to a GatherWriterStatus call.
VSS
Volume Shadow Copy Service error: An internal inconsistency was detected in trying to contact shadow copy service writers. Please check to see that the Event Service and Volume Shadow Copy Service are operating properly. %1
VSS
Volume Shadow Copy Service error: Volume/disk not connected or not found. Error context: %1. %2
VSS
Volume Shadow Copy Service error: The shadow copy could not be committed - operation timed out. Error context: %1.
VSS
Volume Shadow Copy Service warning: VSS was denied access to the root of volume %1. Denying administrators from accessing volume roots can cause many unexpected failures, and will prevent VSS from functioning properly. Check security on the volume, and try the operation again. %2

No comments:

Post a Comment