Windows Event Log Errors & Warnings

[Nick-SAC]

Note: I haven’t opened a support ticket on this yet because I don’t think it’s actually a problem, i.e., I suspect it’s just Windows reacting to the appearance & disappearance of the “Hard Disks” and “Volumes” temporarily created in the normal course of the VB&R backup processes.


Infrastructure:

Backup Server
Physical : Server 2012-R2 SP1 with Hyper-V Host Roll
Primary Backup Repository = Internal HDDs
VB&R 9.5.0.1536 (all-in-one configuration)

Production Servers
Host: Physical : Server 2008-R2 SP1 : Hyper-V Host
VMs : Server 2008-R2 SP1 : Hyper-V Guests


Issue:
When running the backups from the Backup Server I’m getting a slew of Errors & Warnings in the Logs on the Production Server Host, specifically as shown below (in an actual chronological order and with the approximate number of instances per backup session):

================================================================

1x
Log Name: System
Source: Virtual Disk Service
Date: 5/12/2018 11:04:50 PM
Event ID: 9
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: <ComputerName>
Description:
Unexpected provider failure. Restarting the service may fix the problem. Error code: 80004005@02000014

-------------------------------------------------------------------------------------------------------

1x
Log Name: System
Source: VDS Basic Provider
Date: 5/12/2018 11:08:02 PM
Event ID: 1
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: <ComputerName>
Description:
Unexpected failure. Error code: D@01010004

-------------------------------------------------------------------------------------------------------

2x
Log Name: System
Source: volsnap
Date: 5/12/2018 11:10:40 PM
Event ID: 27
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: <ComputerName>
Description:
The shadow copies of volume \\?\Volume{4c937bnn-bd4e-11e5-8c66-ac220b8b292a} were aborted during detection because a critical control file could not be opened.

nn These 2 digits vary from instance to instance.

-------------------------------------------------------------------------------------------------------

10x
Log Name: System
Source: Microsoft-Windows-FilterManager
Date: 5/12/2018 11:10:45 PM
Event ID: 3
Task Category: None
Level: Error
Keywords:
User: SYSTEM
Computer: <ComputerName>
Description:
Filter Manager failed to attach to volume '\Device\Harddisk<#>\DR<##>'. This volume will be unavailable for filtering until a reboot. The final status was 0xc03a001c.

# These numbers vary but they are always numerically higher than the number of physical HDDs in the system.

-------------------------------------------------------------------------------------------------------

10x
Log Name: System
Source: Disk
Date: 5/12/2018 11:10:55 PM
Event ID: 51
Task Category: None
Level: Warning
Keywords: Classic
User: N/A
Computer: <ComputerName>
Description:
An error was detected on device \Device\Harddisk<#>\DR<##> during a paging operation.

# These numbers vary but they are always numerically higher than the number of physical HDDs in the system.

-------------------------------------------------------------------------------------------------------

4x
Log Name: System
Source: volsnap
Date: 5/12/2018 11:10:58 PM
Event ID: 16
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: <ComputerName>
Description:
The shadow copies of volume \\?...nn-nnnn-nnnn-ac220b8b292a} were aborted because volume \\?... nn-nnnn-nnnn-ac220b8b292a}, which contains shadow copy storage for this shadow copy, was force dismounted.

nn These digits vary from instance to instance.

-------------------------------------------------------------------------------------------------------

20x
Log Name: System
Source: Microsoft-Windows-FilterManager
Date: 5/12/2018 11:11:19 PM
Event ID: 3
Task Category: None
Level: Error
Keywords:
User: <ComputerName\UserName>
Computer: <ComputerName>
Description:
Filter Manager failed to attach to volume '\Device\HarddiskVolume<##>'. This volume will be unavailable for filtering until a reboot. The final status was 0xc03a001c.

## This number varies but it is always numerically higher than the number of actual Volumes in the system.

================================================================

So, is it okay to simply ignore these... or might it be cause for concern?

Thanks,
Nick

[foggy]

Hi Nick, I'd let our engineers take a look, just to be sure.

[Nick-SAC]

Thanks Foggy, I've got a support ticket opened with them now

Case # 03011866

Nick

[Nick-SAC]

In the interest of making this Topic thread useful to others, here’s one more thing I probably should have noted in my initial report...

During the VB&R Backups; in the VM Guest Event Logs, I will get anywhere from none to several dozen instances of the below Error which I also see outside of VB&R systems, e.g., when using MS Windows Server Backup and/or attaching/detaching a Pass-Thru HDD to the virtual SCSI Controller of a Windows 2008-R2 VM.

I didn’t mention it because it’s documented to be a non-issue (as seen here http://support.microsoft.com/kb/979391 ) which can be safely ignored... but perhaps it’s playing a part in triggering the aforementioned Errors & Warnings on the Hyper-V Host?

------------------------------------------------------------------
Log Name: System
Source: VDS Basic Provider
Date: 5/12/2018 11:03:48 PM
Event ID: 1
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: <ComputerName>
Description:
Unexpected failure. Error code: 490@01010004
------------------------------------------------------------------

[foggy]

Looks relevant to me. I'd appreciate if you share the results of support findings here. Thanks.

[Nick-SAC]

So after some 45 messages back & forth with Tech Support I finally got to a Senior Engineer who gave me definitive confirmation that this is what I originally suspected, in short; it’s just Windows reporting something it doesn’t expect & understand, the appearance & disappearance of the “Hard Disks” and “Volumes” temporarily created in the normal course of the VB&R backup processes — And it is not cause for concern.

Furthermore, the first Support Rep said, “the checkpoint technology that is in Hyper-V today was not in Server 2008. Instead, we take a volume shadow of the virtual discs and we mount them. Once they're mounted, we are able to back them up and once the backup is ran, the volume gets dismounted.”

FWIW, When I asked why, if this issue is inherent with WinServer 2008-R2 Hyper-V Hosts, it’s not documented anywhere, he replied, “The reason why the Server 2008 Hyper-V issues is not in our documentation or our forums is because our KB articles and our documentation is for our software.”

Frankly, IMO this type of issue should be documented as it would save everybody, including Veeam Support, a lot of wasted time & aggravation and I’m really surprised it isn’t given the absolutely superb Veeam User Guides & other documentation.

Nick