Veeam marked file for rename action.

[Ramon1988]

Goodmorning,

This is not a big problem, but just something I am trying to figure out in between.

For monitoring our servers we use Solarwinds – N-able, this also check the if the server needs a reboot and why. I notice that every time when Veeam starts it’s daily back-up, it creates a file, which it also flags for rename in the register.

If you wait for the back-up to complete – or just cancel it, the file gets removed automatically, but the file does not get “unflagged” in the registry.

The file I am talking about it the “SYSTEM.{*}” file, located in the C:\Windows\System32\Config\ folder. It’s created and deleted by the VeeamGuestHelper process.

The registry value that’s being flagged is the “PendingFileRenameOperations”, located in HKLM\SYSTEM\CurrentControlSet\Control\Session Manager.

I added some screenshots I was able to get using Windows Audit.

Also my Veeam Support case ID is "01882188".






Regards,
Ramon

[JeanHuveneers]

Hi Ramon,

Yeah, We have seen this behavior too. Very annoucing because some installers also check this 'reboot required' status of Windows and force you to reboot before the installer can run.
Veeam, can you please fix this behaviour and make sure Veeam cleans-up all traces after a back-up job.

Regards,

Jean

[foggy]

I'm not sure if anything can be done on the Veeam side here, since it is Windows itself who marks files located in system folders as pending for removal upon their removal by application and we are not able to change this behavior.

[JeanHuveneers]

Sorry for my late respose, I didn't get a notification.
That is a fast way out of the discussion. We have tested with other VSS-based back-up's, they don't leave this trace.
For me it seems it has to do something with the VeeamAgent behavior which causes Windows to get confused.

[Mike Resseler]

Hi Jean,

I did a couple of tests in my own environment to simulate the behavior. Unfortunately, I cannot reproduce it. I do need to say that everything in my environment is server 2016 and I don't have a 2012 to see. You already stated that you don't see this with your 2008 servers which makes me believe we need to look into that direction. So a couple of questions:

1. What version of VBR are you using (including updates if applicable)
2. Is this on every 2012 server? Is this also on 2012 R2 servers? Are they all patched?
3. I assume these 2012 servers are not the hosts but VMs. Any specific software they are running or is it random for every application running on those VMs?

PS: I looked through the support case that is closed but I can't see the images anymore, I think they are expired?

Thanks
Mike

[Ramon1988]

Hi,

I added answers to your questions.

1. What version of VBR are you using (including updates if applicable)
We are using VBR 9.5.0.711.

2. Is this on every 2012 server? Is this also on 2012 R2 servers? Are they all patched?
Issue happens on all 2012 servers. Windows Server 2012 and Windows Server 2012 R2. All servers a frequently updated and are up-to-date at this moment.

3. I assume these 2012 servers are not the hosts but VMs. Any specific software they are running or is it random for every application running on those VMs?
Correctly, these are all different types. Some are DC, some are terminal servers and some are specific database servers.

I wanted to reupload my pictures, but my Photobucket account ain't working. Have to try this again at a later time.

Kind regards,
Ramon

[Ramon1988]

Hi,

Is there any update regarding my issue?

Regards,
Ramon