veeam agent file restore triggers Windows disk reapair

Morgenstern72 · Mar 26, 2019 2:42 pm

Veeam Agent for MS Windows 3.0.0.748 - Free Edition
Windows 10 Pro 1803

After I close the Restore-Wizard (Restore File), regardless if I restored or not, I get messages from Windows "Restart to repair drive errors".
In the system eventlog I found errors on drive F:. My USB3 hub with card reader used F, but no sd card was inserted. I restarted the PC and nothing was repaired. I changed the drive letter, to Z:, restarted again and restored from veeam agent again: same error on the now not-existent F:-drive.

The restore went fine, I am just baffled about what veeam agent is trying to do on F:. Maybe a former registered hard disk from a former test with 2.0?

Code: Select all

Eventlog;
Log Name:      System
Source:        Ntfs
Date:          26.03.2019 15:28:45
Event ID:      137
Task Category: (2)
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      DESKTOP-xyz
Description:
The default transaction resource manager on volume F: encountered a non-retryable error and could not start.  The data contains the error code.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Ntfs" />
    <EventID Qualifiers="49156">137</EventID>
    <Level>2</Level>
    <Task>2</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2019-03-26T14:28:45.170208100Z" />
    <EventRecordID>153849</EventRecordID>
    <Channel>System</Channel>
    <Computer>DESKTOP-xyz</Computer>
    <Security />
  </System>
  <EventData>
    <Data>
    </Data>
    <Data>F:</Data>
    <Binary>1C0004000200300002000000890004C000000000320000C000000000000000000000000000000000320000C0</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Ntfs
Date:          26.03.2019 15:28:44
Event ID:      136
Task Category: (2)
Level:         Warning
Keywords:      Classic
User:          N/A
Computer:      DESKTOP-xyz
Description:
The default transaction resource manager on volume F: encountered an error while starting and its metadata was reset.  The data contains the error code.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Ntfs" />
    <EventID Qualifiers="32772">136</EventID>
    <Level>3</Level>
    <Task>2</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2019-03-26T14:28:44.689008700Z" />
    <EventRecordID>153848</EventRecordID>
    <Channel>System</Channel>
    <Computer>DESKTOP-xyz</Computer>
    <Security />
  </System>
  <EventData>
    <Data>
    </Data>
    <Data>F:</Data>
    <Binary>1C00040002003000020000008800048000000000040019C000000000000000000000000000000000040019C0</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Ntfs
Date:          26.03.2019 15:28:43
Event ID:      137
Task Category: (2)
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      DESKTOP-xyz
Description:
The default transaction resource manager on volume F: encountered a non-retryable error and could not start.  The data contains the error code.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Ntfs" />
    <EventID Qualifiers="49156">137</EventID>
    <Level>2</Level>
    <Task>2</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2019-03-26T14:28:43.659620100Z" />
    <EventRecordID>153847</EventRecordID>
    <Channel>System</Channel>
    <Computer>DESKTOP-xyz</Computer>
    <Security />
  </System>
  <EventData>
    <Data>
    </Data>
    <Data>F:</Data>
    <Binary>1C0004000200300002000000890004C000000000320000C000000000000000000000000000000000320000C0</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Ntfs
Date:          26.03.2019 15:28:43
Event ID:      136
Task Category: (2)
Level:         Warning
Keywords:      Classic
User:          N/A
Computer:      DESKTOP-xyz
Description:
The default transaction resource manager on volume F: encountered an error while starting and its metadata was reset.  The data contains the error code.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Ntfs" />
    <EventID Qualifiers="32772">136</EventID>
    <Level>3</Level>
    <Task>2</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2019-03-26T14:28:43.175334600Z" />
    <EventRecordID>153846</EventRecordID>
    <Channel>System</Channel>
    <Computer>DESKTOP-xyz</Computer>
    <Security />
  </System>
  <EventData>
    <Data>
    </Data>
    <Data>F:</Data>
    <Binary>1C00040002003000020000008800048000000000040019C000000000000000000000000000000000040019C0</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Ntfs
Date:          26.03.2019 15:28:42
Event ID:      137
Task Category: (2)
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      DESKTOP-xyz
Description:
The default transaction resource manager on volume F: encountered a non-retryable error and could not start.  The data contains the error code.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Ntfs" />
    <EventID Qualifiers="49156">137</EventID>
    <Level>2</Level>
    <Task>2</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2019-03-26T14:28:42.146451200Z" />
    <EventRecordID>153845</EventRecordID>
    <Channel>System</Channel>
    <Computer>DESKTOP-xyz</Computer>
    <Security />
  </System>
  <EventData>
    <Data>
    </Data>
    <Data>F:</Data>
    <Binary>1C0004000200300002000000890004C000000000320000C000000000000000000000000000000000320000C0</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Ntfs
Date:          26.03.2019 15:28:40
Event ID:      55
Task Category: None
Level:         Error
Keywords:      
User:          SYSTEM
Computer:      DESKTOP-xyz
Description:
A corruption was discovered in the file system structure on volume F:.

The exact nature of the corruption is unknown.  The file system structures need to be scanned and fixed offline.

Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Ntfs" Guid="{DD70BC80-EF44-421B-8AC3-CD31DA613A4E}" />
    <EventID>55</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2019-03-26T14:28:40.131233300Z" />
    <EventRecordID>153844</EventRecordID>
    <Correlation />
    <Execution ProcessID="4" ThreadID="10204" />
    <Channel>System</Channel>
    <Computer>DESKTOP-xyz</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="DriveName">F:</Data>
    <Data Name="DeviceName">\Device\VirtualDiskVolume5</Data>
    <Data Name="CorruptionState">0x19</Data>
    <Data Name="HeaderFlags">0x822</Data>
    <Data Name="Severity">Critical</Data>
    <Data Name="Origin">File System Driver</Data>
    <Data Name="Verb">Force Full Chkdsk</Data>
    <Data Name="Description">The exact nature of the corruption is unknown.  The file system structures need to be scanned and fixed offline.
</Data>
    <Data Name="Signature">0x6c3cf718</Data>
    <Data Name="Outcome">Pseudo Verb</Data>
    <Data Name="SampleLength">0</Data>
    <Data Name="SampleData">
    </Data>
    <Data Name="SourceFile">0x42</Data>
    <Data Name="SourceLine">11699</Data>
    <Data Name="SourceTag">347</Data>
    <Data Name="AdditionalInfo">0xd000042b</Data>
    <Data Name="CallStack">Ntfs+0x1acd7f, Ntfs+0x1a984, Ntfs+0x1a730, Ntfs+0x1256a8, Ntfs+0xcd7e7, Ntfs+0xcce9b, ntoskrnl+0x98e89, FLTMGR+0x7207, FLTMGR+0x3aed0, ntoskrnl+0x98e89, ntoskrnl+0x4fcfdb, ntoskrnl+0x4fc68a, ntoskrnl+0x58d526, ntoskrnl+0x1ba743</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Ntfs
Date:          26.03.2019 15:28:40
Event ID:      55
Task Category: None
Level:         Error
Keywords:      
User:          SYSTEM
Computer:      DESKTOP-xyz
Description:
A corruption was discovered in the file system structure on volume F:.

A corruption was found in a file system index structure.  The file reference number is 0x100000000001b.  The name of the file is "<unable to determine file name>".  The corrupted index attribute is ":$I30:$INDEX_ALLOCATION".

Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Ntfs" Guid="{DD70BC80-EF44-421B-8AC3-CD31DA613A4E}" />
    <EventID>55</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2019-03-26T14:28:40.131179600Z" />
    <EventRecordID>153843</EventRecordID>
    <Correlation />
    <Execution ProcessID="4" ThreadID="10204" />
    <Channel>System</Channel>
    <Computer>DESKTOP-xyz</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="DriveName">F:</Data>
    <Data Name="DeviceName">\Device\VirtualDiskVolume5</Data>
    <Data Name="CorruptionState">0x19</Data>
    <Data Name="HeaderFlags">0x822</Data>
    <Data Name="Severity">Critical</Data>
    <Data Name="Origin">File System Driver</Data>
    <Data Name="Verb">Index Entry</Data>
    <Data Name="Description">A corruption was found in a file system index structure.  The file reference number is 0x100000000001b.  The name of the file is "&lt;unable to determine file name&gt;".  The corrupted index attribute is ":$I30:$INDEX_ALLOCATION".
</Data>
    <Data Name="Signature">0xd119d410</Data>
    <Data Name="Outcome">Spot Verifier Bypassed On Critical</Data>
    <Data Name="SampleLength">0</Data>
    <Data Name="SampleData">
    </Data>
    <Data Name="SourceFile">0x17</Data>
    <Data Name="SourceLine">227</Data>
    <Data Name="SourceTag">137</Data>
    <Data Name="AdditionalInfo">0x10000000</Data>
    <Data Name="CallStack">Ntfs+0x182c41, Ntfs+0xd65c7, Ntfs+0xbcab7, Ntfs+0x23cf, Ntfs+0xb421c, Ntfs+0x125860, Ntfs+0x1255b6, Ntfs+0xcd7e7, Ntfs+0xcce9b, ntoskrnl+0x98e89, FLTMGR+0x7207, FLTMGR+0x3aed0, ntoskrnl+0x98e89, ntoskrnl+0x4fcfdb, ntoskrnl+0x4fc68a, ntoskrnl+0x58d526, ntoskrnl+0x1ba743</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Ntfs
Date:          26.03.2019 15:28:40
Event ID:      98
Task Category: None
Level:         Error
Keywords:      (2)
User:          SYSTEM
Computer:      DESKTOP-xyz
Description:
Volume F: (\Device\VirtualDiskVolume5) needs to be taken offline to perform a Full Chkdsk.  Please run "CHKDSK /F" locally via the command line, or run "REPAIR-VOLUME <drive:>" locally or remotely via PowerShell.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Ntfs" Guid="{3FF37A1C-A68D-4D6E-8C9B-F79E8B16C482}" />
    <EventID>98</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000002</Keywords>
    <TimeCreated SystemTime="2019-03-26T14:28:40.130961700Z" />
    <EventRecordID>153842</EventRecordID>
    <Correlation />
    <Execution ProcessID="11760" ThreadID="5848" />
    <Channel>System</Channel>
    <Computer>DESKTOP-xyz</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="DriveName">F:</Data>
    <Data Name="DeviceName">\Device\VirtualDiskVolume5</Data>
    <Data Name="CorruptionActionState">3</Data>
  </EventData>
</Event>

Post by **Dima P.** » Mar 26, 2019 4:24 pm this post

Hello Morgenstern72,

Can you please check the following:

1. Device is not registered under known removable storage devices (Menu > Settings > Known removable storage devices link)
2. Any change you are baking up data from this device?
3. Could it be set as a target from your backup job?

Thank you in advance!

Morgenstern72 · Post by **Morgenstern72** » Mar 26, 2019 4:32 pm this post

1. Device is not registered under known removable storage devices (Menu > Settings > Known removable storage devices link)
I dont have that, but "Manage registered storage devices": I see two USB drives, A: and B:, from which one I use

2. Any change you are baking up data from this device?
Objects to backup -> No F: drive to be seen

3. Could it be set as a target from your backup job?
I backup daily to A: without any problems.

Post by **Dima P.** » Mar 26, 2019 6:40 pm this post

Thanks for the clarification. Since there is no link to the mentioned drive I am out of ideas. Kindly, open a support case and share your case ID with us. Cheers!

John Snow1 · Post by **John Snow1** » Apr 28, 2019 2:51 pm this post

I get the same error "After I close the Restore-Wizard (Restore File), regardless if I restored or not, I get messages from Windows "Restart to repair drive errors"."

This is a File backup only to a network share
https://gyazo.com/c48acf1af052579d4a88446c6ca9c865

Post by **Dima P.** » May 02, 2019 4:03 pm this post

Hello and welcome to the community,

Unfortunately I do not have any information to share since I did not get a case reference from a previous user. If possible please open a support case and share the ID with the community. Cheers!

Post by **mamosorre84** » Aug 07, 2019 2:45 pm this post

Hi,

I get the same message on Windows 10 after restore.

I think is related to the Veeam FLR functionality, the mounted backup files are recognized as new partition (mount point)..isn't it?

Marco

Post by **Dima P.** » Aug 08, 2019 11:30 am this post

Marco,

Please raise a case and we will troubleshoot this issue together with the support team. Thank you!

jbelton · Post by **jbelton** » Aug 08, 2019 5:55 pm this post

Hi.. just wanted to chime in as well. This is happening to me too. Here's what I was doing.

OS: Windows 10 Pro 1809
Used Veeam 3.0.1 to create backup a while ago.
Upgraded to Veeam 3.0.2.
Opening the backup and copying a file out of the backup using the Veeam UI results in these NTFS errors. Lots of them in Windows' Event Viewer.
However, modification date of Veeam backup files has not changed after closing backup. So nothing has changed since the backup was created.

Possible bug on Windows 10 1809 when opening old backups in Veeam 3.0.2, or just a bug in Veeam 3.0.2 in general?

Post by **Dima P.** » Aug 09, 2019 10:20 am this post

jbelton,

It was not confirmed by QA department as a bug and, unfortunately, we do not have a single support case to start the investigation (we need application logs and maybe other troubleshooting information is required to confirm this behavior on our side). If you confirm the same behavior please raise a support ticket and share the case ID. Thank you in advance!

Eaton · Post by **Eaton** » Aug 16, 2019 11:40 pm this post

Hi, I am seeing this too. I opened a support case as suggested and got this back today.

This is Veeam Support with a system generated courtesy notification. Unfortunately, due to high Support Team load we were unable to process your request and it has been archived automatically.

Veeam Support Case #03714491

Post by **Dima P.** » Aug 18, 2019 11:55 am this post

Hello Eaton,

Thank you for raising the support case! I'll ask support folks to reopen the case on Monday and ask QA folks to review your debug logs as well. Stay tuned.

Eaton · Aug 19, 2019 4:12 pm

Thanks, Dima. Got a reply this morning.
By the way, there is an issue with the header of your support messages. Appears name placeholders are not filled in - you may want to look into it.
Example: https://i.imgur.com/XYsFxCy.png

Post by **Dima P.** » Aug 20, 2019 6:39 pm this post

Good catch, thank you! Asked our support and web teams to investigate this issue. Cheers!

Eaton · Post by **Eaton** » Aug 22, 2019 4:13 pm this post

Dima, I'm not having much luck with your support system:
They asked for logs and I provided via FTP and emailed back letting them know the logs are uploaded.
Then later I get a response saying they are still waiting for me to reply to them.
I respond again letting them know I did respond, and that logs are uploaded.
And now, still no response...

What's going on, can they not get my emails?

Post by **Dima P.** » Aug 23, 2019 2:49 pm this post

Eaton,

I've check your case details and, unfortunately, cannot see the email in the question (only two last replies appears in the history) - maybe it was bounced back? I do see that that folks confirmed that they've received the logs, so please keep working with them an let us know if you need any further assistance. Cheers!

Eaton · Sep 05, 2019 4:04 pm

Support Case #03714491 has concluded:

During File-Level restoration the following Windows Events ( id55, id136) can be found:

Warning 9/2/2019 1:49:59 PM Ntfs (Ntfs) 136 (2)
The default transaction resource manager on volume F: encountered an error while starting and its metadata was reset. The data contains the error code.

Error 9/2/2019 1:51:41 PM Ntfs (Ntfs) 55 None
A corruption was discovered in the file system structure on volume F:.
A corruption was found in a file system index structure. The file reference number is 0x100000000001b. The name of the file is "<unable to determine file name>". The corrupted index attribute is ":$I30:$INDEX_ALLOCATION".

Error 9/2/2019 1:51:41 PM Ntfs (Ntfs) 55 None
A corruption was discovered in the file system structure on volume F:.
The exact nature of the corruption is unknown. The file system structures need to be scanned and fixed offline.

During FLR Veeam Agent gets access to the backup data using VDK driver (vdk.sys). VDK driver mounts backup data as a virtual mount point in “read-only” mode (Usually C:\VeeamFLR\MachineName\Volume0)
Therefore, Windows cannot access NTFS partitions on read-only volumes and throws said above Windows Events.
Even though Windows Events have “Warning” and “Error” severity status, there is no impact on the system or system disks and they can be easily ignored.

Eaton · Sep 05, 2019 4:05 pm

I then asked if there was a way to stop the messages and apparently there is not, and that this behavior is expected and has no impact on the system.

So, just ignore the messages seems to be the advice (for now).

perjonsson1960 · Oct 11, 2019 2:10 pm

Folks,

I also got the message "Restart to repair drive errors" in the lower right corner of the screen when I started a Restore Guest Files operation on a restore point from a virtual VMware machine. And in the Event Viewer these errors were logged:

-----
A corruption was discovered in the file system structure on volume SYSTEM.
The exact nature of the corruption is unknown. The file system structures need to be scanned and fixed offline.
-----
Volume SYSTEM (\Device\HarddiskVdkVolume12) needs to be taken offline to perform a Full Chkdsk. Please run "CHKDSK /F" locally via the command line, or run "REPAIR-VOLUME <drive:>" locally or remotely via PowerShell.
-----

I don't even know which volume it refers to... Or is SYSTEM the system disk, i.e. C: ?

We are running Veeam B&R 9.5 Update 4b on Windows Server 2016, version 1607, build 14393.3204. The latest installed cumulative update from Microsoft is 2019.09 (KB4516044).

Am I just to ignore this error for now, you say?

Sincerely,
Per Jonsson
Sweden

perjonsson1960 · Oct 11, 2019 2:23 pm

I see now that it must be the system disk C:, because it talks about NTFS in the event log, and the other two volumes are using ReFS.
When I run the disk check from within Windows, it says that "You don't need to scan this drive - We haven't found any errors on this drive".
This is an annoying contradiction...

Post by **Dima P.** » Oct 11, 2019 5:16 pm this post

Hello Per,

Despite the fact that this issues looks similar I'd recommend you to raise a support case just to confirm that your data is safe and this is not a possible data corruption issue. Cheers!

perjonsson1960 · Oct 15, 2019 12:33 pm

Support case #03813793.

perjonsson1960 · Oct 18, 2019 12:33 pm

Folks,

In our case it turns out that the NTFS error was due to restore point data corruption. It was triggered when the restore point was mounted in the C:\VeeamFLR folder. And C: is an NTFS volume, while the restore point was stored on a ReFS volume. At first it was natural to think that there were some errors on the NTFS volume, but after running "chkdsk /f /r" on the volume, and no errors were found, we knew that this was not the case.

We were using the Reverse Incremental backup mode, and that mode is doing a LOT of synthetic operations, and thereby increasing the chance/risk of data corruption. We were recommended to switch to forward incremental, and we have now done that. And we create synthetic fulls once a week.

PJ

R&D Forums

veeam agent file restore triggers Windows disk reapair

Re: veeam agent file restore triggers Windows disk reapair

Re: veeam agent file restore triggers Windows disk reapair

Re: veeam agent file restore triggers Windows disk reapair

Re: veeam agent file restore triggers Windows disk reapair

Re: veeam agent file restore triggers Windows disk reapair

Re: veeam agent file restore triggers Windows disk reapair

Re: veeam agent file restore triggers Windows disk reapair

Re: veeam agent file restore triggers Windows disk reapair

Re: veeam agent file restore triggers Windows disk reapair

Re: veeam agent file restore triggers Windows disk reapair

Re: veeam agent file restore triggers Windows disk reapair

Re: veeam agent file restore triggers Windows disk reapair

Re: veeam agent file restore triggers Windows disk reapair

Re: veeam agent file restore triggers Windows disk reapair

Re: veeam agent file restore triggers Windows disk reapair

Re: veeam agent file restore triggers Windows disk reapair

Re: veeam agent file restore triggers Windows disk reapair

Re: veeam agent file restore triggers Windows disk reapair

Re: veeam agent file restore triggers Windows disk reapair

Re: veeam agent file restore triggers Windows disk reapair

Re: veeam agent file restore triggers Windows disk reapair

Re: veeam agent file restore triggers Windows disk reapair

Who is online