Event ID 8228 — Volume Shadow Copy Service Operations

Event ID 8228 — Volume Shadow Copy Service Operations

Updated: January 27, 2011

Applies To: Windows Server 2008 R2

The Volume Shadow Copy Service (VSS) provides the ability to create a point in time image (shadow copy) of one or more volumes that can be used to perform backups. The service is also used during restores of applications.

Event Details

Product: Windows Operating System
ID: 8228
Source: VSS
Version: 6.1
Symbolic Name: VSS_ERROR_IXMLDOMDOCUMENT_PARSEERROR
Message: Fail to parse XML file. Reason %1 Line %2 Position %3 Errorcode %4 Problem text %5 %6

Resolve
Contact the backup software vendor

This event is usually caused by restoring from a backup that was created on a more recent Windows operating system version.

To resolve this issue, contact the backup software vendor for further support.

Verify

To verify that the Volume Shadow Copy Service (VSS) is operating correctly, retry the previous VSS operation.

Related Management Information

Volume Shadow Copy Service Operations

File Services

Related:

Event ID 8220 — Volume Shadow Copy Service Operations

Event ID 8220 — Volume Shadow Copy Service Operations

Updated: January 27, 2011

Applies To: Windows Server 2008 R2

The Volume Shadow Copy Service (VSS) provides the ability to create a point in time image (shadow copy) of one or more volumes that can be used to perform backups. The service is also used during restores of applications.

Event Details

Product: Windows Operating System
ID: 8220
Source: VSS
Version: 6.1
Symbolic Name: VSS_INFO_DELETION_TIMEOUT
Message: Ran out of time while deleting files. %1

Resolve

This is a normal condition. No further action is required.

Related Management Information

Volume Shadow Copy Service Operations

File Services

Related:

Event ID 8219 — Volume Shadow Copy Service Operations

Event ID 8219 — Volume Shadow Copy Service Operations

Updated: January 27, 2011

Applies To: Windows Server 2008 R2

The Volume Shadow Copy Service (VSS) provides the ability to create a point in time image (shadow copy) of one or more volumes that can be used to perform backups. The service is also used during restores of applications.

Event Details

Product: Windows Operating System
ID: 8219
Source: VSS
Version: 6.1
Symbolic Name: VSS_INFO_SCAN_TIMEOUT_INSTANCE
Message: Ran out of time while expanding file specification %1\%2. This was being done for the %3 subscriber. %4

Resolve

This is a normal condition. No further action is required.

Related Management Information

Volume Shadow Copy Service Operations

File Services

Related:

Event ID 4422 — Volume Shadow Copy Service Support

Event ID 4422 — Volume Shadow Copy Service Support

Updated: December 3, 2008

Applies To: Windows Server 2008 R2

The Microsoft Distributed Transaction Coordinator service (MSDTC) supports the Windows Volume Shadow Copy Service, a feature that is used by System Restore, Windows Complete PC Backup, and Windows Server Backup. Through this support, MSDTC guarantees transaction completeness without data corruption across backup and restore operations.

Event Details

Product: Windows Operating System
ID: 4422
Source: Microsoft-Windows-MSDTC
Version: 6.1
Symbolic Name: IDS_DTC_E_PROCESS_SYSTEM_RESTORE_SUCCESS
Message: MS DTC has processed a system restore event. As a result the transaction log has been reset and the identity of the transaction manager has been changed.%0

Resolve

This is a normal condition. No further action is required.

Related Management Information

Volume Shadow Copy Service Support

Application Server

Related:

Event ID 13 — Volume Shadow Copy Service Operations

Event ID 13 — Volume Shadow Copy Service Operations

Updated: January 27, 2011

Applies To: Windows Server 2008 R2

The Volume Shadow Copy Service (VSS) provides the ability to create a point in time image (shadow copy) of one or more volumes that can be used to perform backups. The service is also used during restores of applications.

Event Details

Product: Windows Operating System
ID: 13
Source: VSS
Version: 6.1
Symbolic Name: VSS_ERROR_STARTING_COM_SERVER
Message: Volume Shadow Copy Service information: The COM Server with CLSID %1 and name %2 cannot be started. [%3] %4

Resolve
Check that services are enabled and providers are operating properly

Note: This event can be caused by running backup software containing a 32-bit Volume Shadow Copy service (VSS) requester on a 64-bit version of Windows.

This event can indicate that the computer is low on resources or has incorrect COM registration information.

To resolve this issue, check that the COM+ Event System service is started and that the VSS service and Microsoft Software Shadow Copy Provider service are both enabled. You should also make sure that third-party installed VSS providers are operating properly. If a VSS provider is not operating properly, you should try reinstalling it. If that does not work, you should contact the provider vendor.

To perform these procedures, you must have membership in Administrators, or you must have been delegated the appropriate authority.

Check that the COM+ Event System service is started

To check that the COM+ Event System service is started:

  1. Click Start, click Administrative Tools, and then click Services.
  2. In the results pane, double-click COM+ Event System.
  3. In Service status, make sure that the status is Started. If the status is not Started, click Start.
  4. Ensure that Startup type is set to Automatic.
  5. Click OK.

Check that the VSS service is enabled

To check that the VSS service is enabled:

  1. Click Start, click Administrative Tools, and then click Services.
  2. In the results pane, double-click Volume Shadow Copy.
  3. Ensure that Startup type is set to Manual.
  4. Click OK.

Check that the Microsoft Software Shadow Copy Provider service is enabled

To check that the Microsoft Software Shadow Copy Provider service is enabled:

  1. Click Start, click Administrative Tools, and then click Services.
  2. In the results pane, double-click Microsoft Software Shadow Copy Provider.
  3. Ensure that Startup type is set to Manual.
  4. Click OK.

Make sure that third-party installed VSS providers are operating properly

To make sure that third-party installed VSS providers are operating properly:

  1. Open an elevated Command Prompt window. Click Start, click All Programs, click Accessories, right-click Command Prompt, and then click Run as administrator.
  2. Type diskshadow at the command prompt, and then press Enter.
  3. Type list providers, and then press Enter.
  4. If a provider is missing from the list of registered providers, try reinstalling it.
  5. For each provider in the list, use the DiskShadow tool’s add and create commands to create a shadow copy of the volume for which the provider is responsible. If a provider is unable to create a shadow copy, contact the provider vendor if it is not Microsoft. If a Microsoft provider is unable to create the shadow copy, contact Microsoft Customer Service and Support. For more information, see http://go.microsoft.com/fwlink/?LinkId=102491. You should provide the entire event log message as it appears in the Event Viewer.

For more information about the DiskShadow tool, including usage examples, see http://go.microsoft.com/fwlink/?LinkID=117722.

Verify

To verify that the Volume Shadow Copy Service (VSS) is operating correctly, retry the previous VSS operation.

Related Management Information

Volume Shadow Copy Service Operations

File Services

Related:

Event ID 774 — System State Recovery

Event ID 774 — System State Recovery

Updated: January 27, 2011

Applies To: Windows Server 2008

You can use the wbadmin start systemstaterecovery command to recover the system state for a computer.

Event Details

Product: Windows Operating System
ID: 774
Source: Microsoft-Windows-Backup
Version: 6.0
Symbolic Name: ADMIN_SYSTEM_STATE_RESTORE_GENERIC_FAILURE_EVENT
Message: The System State Restore started at ‘%1’ failed with errors. Error reported ‘%2′(%3). Please rerun recovery once the issue is resolved.

Resolve
Review event details for solutions for failed recovery

If the system state recovery fails, review the details for the applicable events to find out why the recovery operation failed. Then re-run the recovery.

To do this, follow these general steps:

  1. Find the applicable events in Event Viewer, and then review the details for those events to find out why the recovery operation failed. For more information, see “Review event details in Event Viewer.”
  2. Confirm that the location to perform the recovery to is online.
  3. After resolving any errors that you find in performing the steps above, re-run another application recovery. Fore more information, see “Recover the system state using the command line.”

To perform these procedures, you must have membership in Backup Operators or Administrators, or you must have been delegated the appropriate authority.

Review event details in Event Viewer

To review event details for an application recovery in Event Viewer:

  1. Open Event Viewer. Click Start, click Administrative Tools, and then click Event Viewer.
  2. In the left pane, double-click Applications and Service Logs, double-click Microsoft, double-click Windows, double-click Backup, and then click Operational.
  3. In the right pane, click the Details tab, and then click XML View.
  4. Click an event in the list.
  5. Review <Data Name=”WritersInfo”> to see the error code (XML Node: HResult) and detailed error code (XML Node: DetailedHResult), along with other details about the application component whose recovery failed. If HRest corresponds to a Volume Shadow Copy Service (VSS) error, then review the VSS event logs to find more information on the error and how to resolve it.
  6. Review <Data Name=”RestoreSuccessLogPath”>. If NoOfFilesFailed is greater than zero (>0), then review the failed file log list referred to in the event details to determine what files failed with what system errors.
  7. Review error messages for the error codes, as described in “Review error messages in the Windows Server Backup snap-in.”

Recover the system state using the command line

Note: If you are using BitLocker Drive Encryption to protect your server and you need to perform a system state recovery, make sure to reapply BitLocker Drive Encryption. This will not happen automatically—it must be enabled explicitly. For instructions, see the Windows BitLocker Drive Encryption Step-by-Step Guide (http://go.microsoft.com/fwlink/?LinkId=93107).

To recover the system state by using the command line:

  1. Open a command prompt with elevated privileges. Click Start, point to All Programs, click Accessories, right-click Command Prompt, and then click Run as administrator.
  2. At the prompt, type: wbadmin start systemstaterecovery. Use parameters, as needed. (To view the parameters and help for this command, at a command line, type: wbadmin start backup /?).

    For example, to run a system state recovery of the backup from 04/30/2005 at 9:00 A.M. that is stored on the shared resource \\servername\share for server01, type: wbadmin start systemstaterecovery -version:04/30/2005-09:00 -backupTarget:\\servername\share -machine:server01.

Verify

To verify that a system state recovery was successful, after you perform the recovery, look for Event ID 242, which indicates that the recovery completed without errors.

To perform this procedure, you must have membership in Backup Operators or Administrators, or you must have been delegated the appropriate authority.

To verify that a system state recovery was successful:

  1. Open Event Viewer. Click Start, click Administrative Tools, and then click Event Viewer.
  2. In the left pane, double-click Applications and Service Logs, double-click Microsoft, double-click Windows, double-click Backup, and then click Operational.
  3. In the Event ID column, look for event 242.
  4. For this event, confirm that the the value in the Source column is Backup.

Related Management Information

System State Recovery

File Services

Related:

Event ID 755 — Backup Service Availability

Event ID 755 — Backup Service Availability

Updated: January 27, 2011

Applies To: Windows Server 2008 R2

For Windows Server Backup to be able to perform backups and recoveries, the Block Level Backup Engine service (wbengine) must be able to start and the global or local catalogs must not be corrupted. Wbengine enables Windows Server Backup to perform block-level backup and recovery operations. The global catalog is a file that Windows Server Backup uses to store the details about all of your backups (what volumes are backed up and where the backups are located). The local catalog is a file that Windows Server Backup creates to store details about the backups that are stored on a specific backup destination.

Event Details

Product: Windows Operating System
ID: 755
Source: Microsoft-Windows-Backup
Version: 6.1
Symbolic Name: BLB_SERVICE_COULDNOT_INSTALL_HANDLER_EVENT
Message: Installing the handler for Block level backup engine service failed with error code ‘%1’.

Resolve
Review Service Control Manager events in Event Viewer

Review Service Control Manager events for Windows Server Backup in Event Viewer in the Windows System event log.

To perform this procedure, you must have membership in Administrators, or you must have been delegated the appropriate authority.

To view the Windows Server Backup events in the Windows System event log:

  1. Open Event Viewer. Click Start, click Administrative Tools, and then click Event Viewer.
  2. In the left pane, expand Windows Logs, and then click System.
  3. To create a filtered view of just the Service Control Manager events, click Action, click Create Custom View, and in the Event sources drop-down list, select Service Control Manager Eventlog Provider, and then click OK.
  4. In Save Filter to Custom View, provide a name and description.
  5. In the left pane, expand Custom View, right-click the name of the custom view that you created, and then click Find.
  6. To find all the Service Control Manager Eventlog Provider events for Windows Server Backup, in Find what, type: Backup.
  7. Double-click the event, and then click Event Log Online Help for more information about how to fix the event.

Verify

To verify that Windows Server Backup is able to perform backup and recovery operations, you should verify that the Block Level Backup Engine service (wbengine) is able to start and that the global catalog and the local catalog have not been corrupted. The global catalog is the file that contains information about all your backups, and the local catalog is the file that contains information about backups saved to a specific destination.

To perform these procedures, you must have membership in Backup Operators or Administrators, or you must have been delegated the appropriate authority.

Verify that wbengine can start

To verify that wbengine can start:

  1. Open an elevated Command Prompt window. Click Start, point to All Programs, click Accessories, right-click Command Prompt, and then click Run as administrator.
  2. At the prompt, type: net start wbengine.
  3. View the text message to verify that the service starts or is already started.

Verify the local catalog

To verify that the local catalog stored on a backup destination exists and is not corrupted:

  1. Open an elevated Command Prompt window. Click Start, point to All Programs, click Accessories, right-click Command Prompt, and then click Run as administrator.
  2. At the prompt, type: wbadmin get versions -backuptarget:<backup destination drive letter>.
  3. Verify that command runs without errors.

Verify the global catalog

To verify that the global catalog on the boot volume exists and is not corrupted:

  1. Open an elevated Command Prompt window. Click Start, point to All Programs, click Accessories, right-click Command Prompt, and then click Run as administrator.
  2. At the prompt, type (with no parameters): wbadmin get versions.

    Without parameters this command shows all the backups you have taken that are stored in all locations—that is, information stored in the global catalog.

  3. Verify that the command runs without errors.

Related Management Information

Backup Service Availability

File Services

Related: