FilterManager and NTFS errors in event log

[scidoner]

Hi everyone

I'm not sure if this is allowed here, but I can't find anything about it online and just really want to see if anyone else is getting the same problem.

For the past few weeks I have been getting errors in my event log with timestamps corresponding to the time Veeam backups run.

The first is from FilterManager:

Code: Select all

Filter Manager failed to attach to volume '\Device\HarddiskVolume30'.  This volume will be unavailable for filtering until a reboot.  The final status was 0xc03a001c.

The next is from NTFS:

Code: Select all

The file system structure on the disk is corrupt and unusable. Please run the chkdsk utility on the volume \\?\Volume{a1615482-e616-11e2-a46e-001b21d2ac32}.

These volumes don't exist after Veeam runs so I'm assuming its the volumes that Veeam uses to take snapshots in order to do the backup.

Specifically the errors seem to relate to the backup of a VM running Windows Server 2012 (going by the time that Veeam starts the backup for this VM, and relating it to the timestamps on the events logged).

Has anyone else experienced this issue?

[veremin]

May I ask you to check whether you experienced this issue when a given job was started or when a VB&R snapshot was taken? Thanks.

[veremin]

Anyway, I do believe that it’s something related to temporary snapshots. VSS snapshots are being created during backup run. From the operating system perspective, they are nothing but local volumes. At some stage these snapshots were temporarily mounted, and Filter Manager tried to attach the filter driver registered to the new "volume" and failed. This resulted in the corresponding errors.

So, I think, you shouldn’t be concerned with these issues.

Thanks.

[scidoner]

I managed to narrow it down It was caused by the Windows Search service trying to hook into new volumes for indexing. Turns out the VSS volumes are in a "disabled" state so it doesn't work. I disabled the WSearch service - no more errors.

But yes I agree nothing to worry about anyway - I'm just anal about red in my event logs!

Thanks for your reply!

[foggy]

Glad you've nailed it quickly, thanks for sharing!

[scidoner]

Unfortunately I'm still getting this one:

Code: Select all

The file system structure on the disk is corrupt and unusable. Please run the chkdsk utility on the volume \\?\Volume{a1615482-e616-11e2-a46e-001b21d2ac32}.

I've run chkdsk on all of my Windows VMs - they are all clean as a whistle....

[veremin]

Then, it stands to reason to contact our support team and let them investigate it directly. Thanks.

[scidoner]

Then, it stands to reason to contact our support team and let them investigate it directly. Thanks.

Thanks
I think the issue might be caused by the different NTFS versions (NT 6.1 Hyper-V host, NT 6.2 virtual machine) and thus I believe it is a false positive.

What I am going to do is copy my VHDs in a safe place, delete them, then perform a restore in Veeam. After that, and after verifying the machines come online, I will run a file system check on the guests. If that passes, I will ignore the error because clearly the backups are working!

If they fail then I'll contact the support team.

Cheers!

[veremin]

Also, possible way to go. Additionally, please be aware that the upcoming version of VB&R will provide an automatic way of testing backup data – SureBackup for Hyper-V. So, stay tuned.

Thanks.

[scidoner]

Also possible way to go. Additionally, please be aware that the upcoming version of VB&R will provide an automatic way of testing backup data – SureBackup for Hyper-V. So, stay tuned.

Thanks.

COOL.