Event ID 4 (warning) and 137 (error) when opening file resto

[ThomasR]

Hey guys,

I'm using Veeam on my Server 2012, when I try to do a file restore via the agent tray everything works great, but while I'm doing this windows logs the warning Event ID 4 (Quota, Datascrn) and error ID 137 (NTFS, transaction maanger on volume couldnt be started). Apparently it cant connect to a certain volume.

Does anyone know if this is normal behaviour?

[Dima P.]

Hello ThomasR.

To be honest this is the fist time I see such issue. Can you please change the exact location (event hive) and text of these events? Thank you in advance.

[ThomasR]

Hello ThomasR.

To be honest this is the fist time I see such issue. Can you please change the exact location (event hive) and text of these events? Thank you in advance.

unfortunatly the logs are in german. Ill try to translate though

Code: Select all

SERVER4Warning Microsoft-Windows-FilterManagerSystem21.08.2018 19:18:40
The filesystemfilter "Datascrn" (Version 6.2, ‎2012‎-‎07‎-‎26T04:29:13.000000000Z)couldnt connect to Volume "\Device\VirtualDiskVolume11" . The filter returned a non-default last status "0xC0000010". This condition should be handled by this filter and / or the supporting applications. Contact the manufacturer if this condition persists.

Also this with same ID
The file system filter "Quota" (Version 6.2, 2012 - 07 - 26T04: 29: 14.000000000Z) could not connect to the volume "\ Device \ VirtualDiskVolume11". The filter returned a non-default last status "0xC0000010". This condition should be handled by this filter and / or the supporting applications. Contact the manufacturer if this condition persists.

Then this:

SERVER137Error NtfsSystem21.08.2018 19:11:55
On volume "\\? \ Volume {047add58-a50b-11e8-94ce-44a84240e5ec}", the Transaction Resource Manager failed to start because of an unrepeatable error. The error code is included in the data.

Obviously you know better than me, but is it possible that maybe veeam locks up the volume on which the backups are stored? This could probably cause these errors?
But these errors shouldnt appear only on my system then..

[Dima P.]

Thomas,

Thanks for sharing. Checking with QA team.

[mcbsys]

Any update on this? I am encountering the same errors, plus Ntfs 136, on SBS 2011 (based on Server 2008 R2). I've been asked to restore 228GB of files from a four-month-old backup stored on a NAS drive. I have opened the backup in Explorer and initiated a copy / paste there. Twice now, the Backup Browser has crashed, leaving the C:\VeeamFLR folder empty, meaning I have to start over. This is accompanied by the NTFS 137 error in Event Viewer. I see now that there is a Copy To... option. Does that bypass the need for the virtual drive? That might be more reliable...

Here are the error details:

Code: Select all

Log Name:      System
Source:        Ntfs
Date:          3/29/2019 1:18:41 PM
Event ID:      136
Task Category: (2)
Level:         Warning
Keywords:      Classic
User:          N/A
Computer:      SBS2011SVR.mydomain.local
Description:
The default transaction resource manager on volume \\?\Volume{83913938-5252-11e9-9f15-6cc217846d54} encountered an error while starting and its metadata was reset.  The data contains the error code.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <EventData>
    <Data>
    </Data>
    <Data>\\?\Volume{83913938-5252-11e9-9f15-6cc217846d54}</Data>
    <Binary>1C00040002003000020000008800048000000000040019C000000000000000000000000000000000040019C0</Binary>
  </EventData>
</Event>

-------------------------------------------------------------------------------------------------------------
Log Name:      System
Source:        Microsoft-Windows-FilterManager
Date:          3/29/2019 1:18:43 PM
Event ID:      4
Task Category: None
Level:         Warning
Keywords:      
User:          SYSTEM
Computer:      SBS2011SVR.mydomain.local
Description:
File System Filter 'Quota' (Version 6.1, ‎2009‎-‎07‎-‎13T16:25:47.000000000Z) failed to attach to volume '\Device\VirtualDiskVolume6'.  The filter returned a non-standard final status of 0xc0000010.  This filter and/or its supporting applications should handle this condition.  If this condition persists, contact the vendor.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <EventData>
    <Data Name="FinalStatus">0xc0000010</Data>
    <Data Name="DeviceVersionMajor">6</Data>
    <Data Name="DeviceVersionMinor">1</Data>
    <Data Name="DeviceNameLength">5</Data>
    <Data Name="DeviceName">Quota</Data>
    <Data Name="DeviceTime">2009-07-13T16:25:47.000000000Z</Data>
    <Data Name="ExtraStringLength">26</Data>
    <Data Name="ExtraString">\Device\VirtualDiskVolume6</Data>
  </EventData>
</Event>

-------------------------------------------------------------------------------------------------------------
Log Name:      System
Source:        Microsoft-Windows-FilterManager
Date:          3/29/2019 1:18:43 PM
Event ID:      4
Task Category: None
Level:         Warning
Keywords:      
User:          SYSTEM
Computer:      SBS2011SVR.mydomain.local
Description:
File System Filter 'Datascrn' (Version 6.1, ‎2009‎-‎07‎-‎13T16:25:43.000000000Z) failed to attach to volume '\Device\VirtualDiskVolume6'.  The filter returned a non-standard final status of 0xc0000010.  This filter and/or its supporting applications should handle this condition.  If this condition persists, contact the vendor.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <EventData>
    <Data Name="FinalStatus">0xc0000010</Data>
    <Data Name="DeviceVersionMajor">6</Data>
    <Data Name="DeviceVersionMinor">1</Data>
    <Data Name="DeviceNameLength">8</Data>
    <Data Name="DeviceName">Datascrn</Data>
    <Data Name="DeviceTime">2009-07-13T16:25:43.000000000Z</Data>
    <Data Name="ExtraStringLength">26</Data>
    <Data Name="ExtraString">\Device\VirtualDiskVolume6</Data>
  </EventData>
</Event>

-------------------------------------------------------------------------------------------------------------
Log Name:      System
Source:        Ntfs
Date:          3/29/2019 1:58:18 PM
Event ID:      137
Task Category: (2)
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      SBS2011SVR.mydomain.local
Description:
The default transaction resource manager on volume C:\VeeamFLR\SBS2011SVR\Volume1 encountered a non-retryable error and could not start.  The data contains the error code.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <EventData>
    <Data>
    </Data>
    <Data>C:\VeeamFLR\SBS2011SVR\Volume1</Data>
    <Binary>1C0004000200300002000000890004C000000000220000C000000000000000000000000000000000220000C0</Binary>
  </EventData>
</Event>

[Dima P.]

mcbsys,

Please submit a support case to investigate the recovery issue. Once done, please do not forget to share the case ID, thank you!

[mcbsys]

Case ID 03492095.

[cheekycharly]

I get the same thing logged in event viewer on my Windows Server 2012 Standard.

Only looking at the log today after the whole system became unresponsive today for the first time ever. We installed Veeam Agent on this only a week ago so I am concerned.