Diagnosing Failures in Windows Server Backup - Part 1 (VSS/SPP Errors)

Diagnosing Failures in Windows Server Backup - Part 1 (VSS/SPP Errors)

  • Comments 2
  • Likes

Many customers have asked questions in our forums on how to understand and troubleshoot errors reported by Windows Server Backup. While we document the event IDs logged by Windows Server Backup (for example, see http://technet.microsoft.com/en-us/library/cc734488(WS.10).aspx), we do not document the error codes (HRESULT) displayed by Windows Server Backup. This series of articles clarifies these errors codes to help system administrators troubleshoot Windows Server Backup errors.

 

Windows Server Backup relies on multiple layers in the operating system to function. It can show errors when any of those layers report an error. If the origin of the error is inside Windows Server Backup, Windows Server Backup provides direct recommendations on resolutions. The challenge in troubleshooting is when the problem is in a layer not in Windows Server Backup, but which emerges and is shown by Windows Server Backup.

 

In this article, I’ll show you how to troubleshoot errors displayed by Windows Server Backup, when the origin of the error is in an underlying layer such as Volume Shadow Copy Service (VSS), Shared Protection Point (SPP), or other applications that plug into VSS framework. (For more information about troubleshooting VSS, see http://technet.microsoft.com/en-us/library/cc734243(WS.10).aspx )These issues map to following error codes: 0x8004*, 0x81001*, 0x807800A1, 0x8078006B, 0x8078008A and 0x8078001F-0x80780025. For a detailed list of these errors refer to Appendix A  below in this article. This article applies to Windows Server 2008 and Windows Server 2008 R2.

 

Below are the steps that you should follow to troubleshoot errors where the cause is reported by an underlying layer to Windows Server Backup. Typically this involves using Event Viewer. To open Event Viewer, click Start, click Run, and then type:

eventvwr

General Troubleshooting Steps:

1.      Check the event log for failure events logged by Windows Server Backup.

·         How: Open Event-Viewer and review at the logs at: Windows Logs\Application where the source is Backup.

2.      Identify which application or layer caused the issue.

·         How: The event in previous step will usually indicate which layer or application caused the failure. For example, where VSS  is the cause, you will see a message such as Check VSS event log for details.” .Check the event log of the problem application reported by the failure event.

3.      Analyze events belonging to the application to understand the root cause. The events may point to issues in a different application.

·         How: Search for events logged by the application found in step 2. For example, for errors caused by I VSS, this means, searching for all events where the value in the Source column is VSS.

4.      Repeat step 2 and step 3 until you get to the root cause of the problem. Correct the problem.

 

Following this method to troubleshoot errors, I will walk you through a customer reported issue where we need to do two iterations to get to root cause. You can use this example to understand how to apply the steps above. Or, if you are lucky and get the same error as in this example, you can use it directly. J

 

Sample Issue:

When running Windows Server Backup, you receive the following error: A Volume Shadow Copy Service operation failed.

C:\TEMP>wbadmin start backup -include:d:,i: -backuptarget:f: -quiet

wbadmin 1.0 - Backup command-line tool

(C) Copyright 2004 Microsoft Corp.

 

Retrieving volume information...

This will back up volume NTFSTest(D:),Local Disk(I:) to f:.

The backup operation to F: is starting.

Creating a shadow copy of the volumes specified for backup...

The backup operation stopped before completing.

Summary of the backup operation:

------------------

 

The backup operation stopped before completing.

Detailed error: A Volume Shadow Copy Service operation failed.

 

Troubleshooting Steps:

·         Step 1: Check the event log for failure events logged by Windows Server Backup.

On checking the Backup application event log, the following message is found:

The backup operation that started at '?2009?-?07?-?09T06:30:12.721000000Z' has failed because the Volume Shadow Copy Service operation to create a shadow copy of the volumes being backed up failed with following error code '2155348129'. Please review the event details for a solution, and then rerun the backup operation once the issue is resolved.

 

·         Step 2: Identify which application or layer caused the issue.

From the backup event it is evident that the issue is caused by a VSS error.

 

·         Step 3: Analyze events belonging to the application to understand the root cause.

On checking the VSS application event logs, the following warning event is found:

A VSS writer has rejected an event with error 0x800423f3, The writer experienced a transient error.  If the backup process is retried,

the error may not reoccur.

. Changes that the writer made to the writer components while handling the event will not be available to the requester. Check the event log for related events from the application hosting the VSS writer.

 

Operation:

   PrepareForSnapshot Event

 

Context:

   Execution Context: Writer

   Writer Class Id: {66841cd4-6ded-4f4b-8f17-fd23f8ddc3de}

   Writer Name: Microsoft Hyper-V VSS Writer

   Writer Instance ID: {25785983-e057-4b58-8d90-d0a7ef6c1a22}

   Command Line: C:\Windows\system32\vmms.exe

   Process ID: 10632

 

·         Back to Step 2: Identify which application or layer caused the issue.

From the VSS event it is evident that the issue is caused by Hyper-V error.

 

·         Step 3: Analyze events belonging to the application to understand the root cause.

On checking HyperV application event logs at Applications and Services Logs\Microsoft\Windows\Hyper-V-VMMS, the following warning event is found:

Failed to create the backup of virtual machine 'TestVM'. (Virtual machine ID XXXX)

 

·         Back to Step 2: Identify which application or layer caused the issue.

From the Hyper-V event it is evident that the issue is caused by a virtual machine named TestVM.

 

·         Step 3: Analyze events belonging to the application to understand the root cause.

On checking the application event logs inside the guest machine, TestVM, the following VSS event is found:

There is not enough disk space to create the volume shadow copy on the storage location. Make sure that, for all volumes to be backup up, the minimum required disk space for shadow copy creation is available. This applies to both the backup storage destination and volumes included in the backup.

Minimum requirement: For volumes less than 500 megabytes, the minimum is 50 megabytes of free space. For volumes more than 500 megabytes, the minimum is 320 megabytes of free space.

        Recommended: At least 1 gigabyte of free disk space on each volume if volume size is more than 1 gigabyte.

 

·        Step 4: Correct the problem.

The above error indicates that freeing up space on the physical volume hosting TestVM will solve the issue.

 

Appendix A

 

Windows Server Backup Error List

 

HRESULT

HRESULT (in hex)

Error Message

2155348129

0x807800A1

A Volume Shadow Copy Service operation failed. Please check "VSS" and "SPP" application event logs for more information.

2155347999

0x8078001F

Windows Backup cannot find the shared protection point.

2155348000

0x80780020

Windows Backup cannot find the shadow copy of the source volume.

2155348001

0x80780021

Windows Backup timed-out before the shared protection point was created.

2155348002

0x80780022

Windows Backup failed to create the shared protection point.

2155348003

0x80780023

The on-disk writer metadata file is corrupted.

2155348004

0x80780024

The specified Windows installation point does not contain a system ID file.

2155348005

0x80780025

The operation to create the shared protection point was canceled.

2155348075

0x8078006b

Windows Backup failed to create the shared protection point on the source volumes.

2155348106

0x8078008a

Error: The read operation from the volume shadow copy on one of the source volumes failed. Make sure all the volumes included in the backup operation are available and accessible, and then retry the operation.

 

VSS Error List

 

HRESULT

HRESULT (in hex)

Error Message

2147754996

0x800423F4

The writer experienced a non-transient error.  If the backup process is retried, the error is likely to reoccur.

2147754806

0x80042336

The writer experienced a partial failure. Check the component level error state for more information.

2147754995

0x800423F3

The writer experienced a transient error.  If the backup process is retried, the error may not reoccur.

2147754992

0x800423F0

The shadow-copy set only contains only a subset of the volumes needed to correctly backup the selected components of the writer.

2147754754

0x80042302

A Volume Shadow Copy Service component encountered an unexpected error.
Check the Application event log for more information.

2147754796

0x8004232C

The specified volume is nested too deeply to participate in the VSS operation.

2147754777

0x80042319

A writer did not respond to a GatherWriterStatus call.  The writer may either have terminated or it may be stuck.  Check the System and Application event logs for more information.

2147754769

0x80042311

The given XML document is invalid.  It is either incorrectly-formed XML or it does not match the schema.

 

SPP Error List

 

HRESULT

HRESULT (in hex)

Error Message

2164261121

0x81000101

The creation of a shadow copy has timed out. Try this operation again.

2164261126

0x81000106

The backup process failed due to an internal error. For more information view the event log.

2164261128

0x81000108

Windows cannot create a shadow copy on the specified disk. Please choose another disk.

 

Note: The above error codes may change in future Windows releases. The messages above are for illustration purposes only and, depending on Window version, may not map to the messages shown in the actual product.

 

Post by Chirag Gupta

Your comment has been posted.   Close
Thank you, your comment requires moderation so it may take a while to appear.   Close
Leave a Comment
  • A link is incorrect.

    please change...

    http://technet.microsoft.com/en-us/library/cc734243(WS.10).aspx.)

    ...to...

    http://technet.microsoft.com/en-us/library/cc734243(WS.10).aspx

  • Any idea what 2164261129 means?  Why are these codes not documented? There doesn't seem to be any point in having error numbers if it's not available to use.

    In my case I'm getting "The backup of the volume was stopped before the backup started running" and the only thing in the eventlog is "Backup started at '11/16/2009 3:30:13 AM' failed as Volume Shadow copy operation failed for backup volumes with following error code '2164261129'. Please rerun backup once issue is resolved.”

    There are NO other events in the eventlog for this time period which makes troubleshooting frustrating to say the least!

    Also the error numbers are 10 digits long so Google and Bing think they are phone numbers - hard to search for backups when it keeps returning results for Cleveland. I'm tempted to call Charlene Brown in Cleveland to see if *she* knows why ;-)