Have you used Windows 2008 and Windows 2008 R2 Hyper-V; created a snapshot, deleted it and then wondered why the snapshot files are still hanging around? Like to know what to expect and the EventIDs that are associated with snapshot removal?
Likely you will be familiar with .vhd files which are the disk storage files in currently released versions of Hyper-V. It is also possible for other organisations to leverage the .vhd format. Snapshot information is saved in a .avhd & .xml configuration file so that they contain the difference in activity in relation to the linked .vhd file. This is why they are called differencing disks too.
Ben Armstrong has posted several times on the underlying mechanics behind deleting snapshots and what goes on in the plumbing. If you don't currently subscribe to Ben’s blog I would highly recommend that you do so via the RSS feed here. If you search for snapshot information on his blog you will find:
That will tell you what you expect in terms of the underlying mechanics of how snapshots are removed etc. What EventIDs should you then look for in the event logs? TechNet has most of this covered off in the Virtual Machine Snapshot Operation section.
Feedback is also provided via the Hyper-V interface, as shown in the image below. This will track progress as a percentage. Note that this is not shown via the SCVMM summary pane, and to monitor snapshot deletion you can monitor for the associated event IDs.
Monitoring for completion of the merge is the critical aspect here. If the VM is powered on before the merge has completed in Windows 2008 and Windows 2008 R2 the merge is then aborted and the process of merging the differencing disk is stopped. The net result of this is that the .avhd file persists on disk and continues to consume disk space.
This is one of the reasons that snapshots are to be used judiciously in production environments. Another reason is that different vendors or product groups may or may not support Hypervisor based snapshots when their application is installed. Exchange is an example that does NOT support Hypervisor based snapshots. You will see this sort of wording around the product support requirements “
Some hypervisors include features for taking snapshots of virtual machines. Virtual machine snapshots capture the state of a virtual machine while it's running. This feature enables you to take multiple snapshots of a virtual machine and then revert the virtual machine to any of the previous states by applying a snapshot to the virtual machine. However, virtual machine snapshots aren't application aware, and using them can have unintended and unexpected consequences for a server application that maintains state data, such as Exchange. As a result, making virtual machine snapshots of an Exchange guest virtual machine isn't supported.”
The Hyper-V merge events are located under:
Applications and Services Logs\Windows\ Hyper-V-VMMS\Admin
Deleting a snapshot results in EventID 19070 when the merge process starts and EventID 19080 when the merge has completed.
'E2K3-DC' background disk merge has been started. (Virtual machine ID D1205407-384D-4A0B-8028-765611B07537)
'E2K3-DC' background disk merge has been finished successfully. (Virtual machine ID D1205407-384D-4A0B-8028-765611B07537)
If the merge is interrupted this will result in EventID 19091 which has the following event text:
Background disk merge has been interrupted. (Virtual machine ID %2)
In case you are interested in events for other Hyper-V aspects, the Hierarchy of Managed Entities contains the EventIDs associated with the various components.
Windows Server 2012 Hyper-V will support live snapshot merge so having to power off VMs to merge .avhd files should minor issue in the future!
If you would like to have Microsoft Premier Field Engineering (PFE) visit your company and assist with the topic(s) presented in this blog post, then please contact your Microsoft Premier Technical Account Manager (TAM) for more information on scheduling and our varied offerings!
If you are not currently benefiting from Microsoft Premier support and you’d like more information about Premier, please email the appropriate contact below, and tell them you how you got introduced!
For all other areas please use the US contact point.
Hello Roderick. Nice post and informative blog. I have a situation where an AVHD file grew to consume almost all of the hard drive space for a specific VM. I have 3 questions regarding recovery (merge AVHD):
1. Do all files (C, D drive VHD plus AVHD) need to be on the same physical drive in order to successfully complete a merge? In this case, I temporarily relocated the C drive VHD file to another physical drive to achieve some temporary space.
2. If the C drive is 50GB, D drive is 400GB, and AVHD is 200GB, is the total space required 650GB (C+D) PLUS the 200GB merge working file, or 850GB to successfully complete the merge in this case?
3. If I need to move all files to the same drive, is exporting the only way to move them? Or can I just copy them when the VM is turned off?
Many thanks in advance!
> The Hyper-V merge events are located under:> Applications and Services Logs\Windows\ Hyper-V-VMMS\AdminYea... this makes it perfectly clear. Everybody knows where applications and services logs are located. No need to elaborate on the location.