We are using Veeam Backup version 3.0.1
ESX 3.5.0 153875 cluster
HP EVA 4400 fiber SAN
And we are backing up a Windows Server 2008 file server running DFS replication that has one 20GB disk and one 300GB disk.
In the Windows Event Log at the start of the backup there is an entry that states:
Code: Select all
Log Name: System
Source: Service Control Manager
Date: 4/21/2009 2:34:24 AM
Event ID: 7036
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: fileserver.domain.com
Description:
The VeeamVssSupport service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Service Control Manager" Guid="{555908D1-A6D7-4695-8E1E-26931D2012F4}" EventSourceName="Service Control Manager" />
<EventID Qualifiers="16384">7036</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2009-04-21T06:34:24.000Z" />
<EventRecordID>27900</EventRecordID>
<Correlation />
<Execution ProcessID="0" ThreadID="0" />
<Channel>System</Channel>
<Computer>fileserver.domain.com</Computer>
<Security />
</System>
<EventData>
<Data Name="param1">VeeamVssSupport</Data>
<Data Name="param2">running</Data>
</EventData>
</Event>
Code: Select all
Log Name: System
Source: Microsoft-Windows-User-PnP
Date: 4/21/2009 2:53:06 AM
Event ID: 20001
Task Category: None
Level: Information
Keywords:
User: SYSTEM
Computer: fileserver.domain.com
Description:
Driver Management concluded the process to install driver FileRepository\volsnap.inf_b06f2d33\volsnap.inf for Device Instance ID STORAGE\VOLUMESNAPSHOT\HARDDISKVOLUMESNAPSHOT5 with the following status: 0.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-User-PnP" Guid="{eea178e3-e9d4-41ca-bb56-cede1a476629}" />
<EventID>20001</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000000</Keywords>
<TimeCreated SystemTime="2009-04-21T06:53:06.643Z" />
<EventRecordID>27901</EventRecordID>
<Correlation />
<Execution ProcessID="4040" ThreadID="672" />
<Channel>System</Channel>
<Computer>fileserver.domain.com</Computer>
<Security UserID="S-1-5-18" />
</System>
<UserData>
<InstallDeviceID xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="http://manifests.microsoft.com/win/2004/08/windows/userpnp">
<DriverName>FileRepository\volsnap.inf_b06f2d33\volsnap.inf</DriverName>
<DriverVersion>6.0.6001.18000</DriverVersion>
<DriverProvider>Microsoft</DriverProvider>
<DeviceInstanceID>STORAGE\VOLUMESNAPSHOT\HARDDISKVOLUMESNAPSHOT5</DeviceInstanceID>
<SetupClass>{533C5B84-EC70-11D2-9505-00C04F79DEAF}</SetupClass>
<RebootOption>false</RebootOption>
<UpgradeDevice>false</UpgradeDevice>
<IsDriverOEM>false</IsDriverOEM>
<InstallStatus>0</InstallStatus>
<DriverDescription>Generic volume shadow copy</DriverDescription>
</InstallDeviceID>
</UserData>
</Event>
Code: Select all
Log Name: System
Source: Service Control Manager
Date: 4/21/2009 2:53:28 AM
Event ID: 7036
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: fileserver.domain.com
Description:
The VeeamVssSupport service entered the stopped state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Service Control Manager" Guid="{555908D1-A6D7-4695-8E1E-26931D2012F4}" EventSourceName="Service Control Manager" />
<EventID Qualifiers="16384">7036</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2009-04-21T06:53:28.000Z" />
<EventRecordID>27902</EventRecordID>
<Correlation />
<Execution ProcessID="0" ThreadID="0" />
<Channel>System</Channel>
<Computer>fileserver.domain.com</Computer>
<Security />
</System>
<EventData>
<Data Name="param1">VeeamVssSupport</Data>
<Data Name="param2">stopped</Data>
</EventData>
</Event>
Code: Select all
Log Name: Application
Source: Desktop Window Manager
Date: 4/21/2009 2:43:20 AM
Event ID: 9003
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: fileserver.domain.com
Description:
The Desktop Window Manager was unable to start because a composited theme is not in use
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Desktop Window Manager" />
<EventID Qualifiers="16384">9003</EventID>
<Level>4</Level>
<Task>0</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2009-04-21T06:43:20.000Z" />
<EventRecordID>2009</EventRecordID>
<Channel>Application</Channel>
<Computer>fileserver.domain.com</Computer>
<Security />
</System>
<EventData>
</EventData>
</Event>
Code: Select all
Log Name: Application
Source: Microsoft-Windows-Winlogon
Date: 4/21/2009 2:43:20 AM
Event ID: 4101
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: fileserver.domain.com
Description:
Windows license validated.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Winlogon" Guid="{DBE9B383-7CF3-4331-91CC-A3CB16A3B538}" EventSourceName="Winlogon" />
<EventID Qualifiers="16384">4101</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2009-04-21T06:43:20.000Z" />
<EventRecordID>2008</EventRecordID>
<Correlation />
<Execution ProcessID="0" ThreadID="0" />
<Channel>Application</Channel>
<Computer>fileserver.domain.com</Computer>
<Security />
</System>
<EventData>
<Data>0x00000000</Data>
<Data>0x00000001</Data>
</EventData>
</Event>
Code: Select all
Log Name: Application
Source: Microsoft-Windows-CertificateServicesClient
Date: 4/21/2009 2:43:20 AM
Event ID: 1
Task Category: None
Level: Information
Keywords:
User: ADVANCE\administrator
Computer: fileserver.domain.com
Description:
Certificate Services Client has been started successfully.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-CertificateServicesClient" Guid="{73370bd6-85e5-430b-b60a-fea1285808a7}" />
<EventID>1</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000000</Keywords>
<TimeCreated SystemTime="2009-04-21T06:43:20.409Z" />
<EventRecordID>2010</EventRecordID>
<Correlation />
<Execution ProcessID="3664" ThreadID="3220" />
<Channel>Application</Channel>
<Computer>fileserver.domain.com</Computer>
<Security UserID="S-1-5-21-54814608-1071128794-317593308-500" />
</System>
<EventData>
</EventData>
</Event>
Code: Select all
Log Name: Application
Source: Desktop Window Manager
Date: 4/21/2009 2:46:10 AM
Event ID: 9009
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: fileserver.domain.com
Description:
The Desktop Window Manager has exited with code (0x40010004)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Desktop Window Manager" />
<EventID Qualifiers="16384">9009</EventID>
<Level>4</Level>
<Task>0</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2009-04-21T06:46:10.000Z" />
<EventRecordID>2011</EventRecordID>
<Channel>Application</Channel>
<Computer>fileserver.domain.com</Computer>
<Security />
</System>
<EventData>
<Data>0x40010004</Data>
</EventData>
</Event>
Code: Select all
Log Name: Application
Source: ESENT
Date: 4/21/2009 2:53:07 AM
Event ID: 103
Task Category: General
Level: Information
Keywords: Classic
User: N/A
Computer: fileserver.domain.com
Description:
DFSRs (1792) \\.\D:\System Volume Information\DFSR\database_FAF0_88F2_F088_B683\dfsr.db: The database engine stopped the instance (0).
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="ESENT" />
<EventID Qualifiers="0">103</EventID>
<Level>4</Level>
<Task>1</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2009-04-21T06:53:07.000Z" />
<EventRecordID>2012</EventRecordID>
<Channel>Application</Channel>
<Computer>fileserver.domain.com</Computer>
<Security />
</System>
<EventData>
<Data>DFSRs</Data>
<Data>1792</Data>
<Data>\\.\D:\System Volume Information\DFSR\database_FAF0_88F2_F088_B683\dfsr.db: </Data>
<Data>0</Data>
</EventData>
</Event>
Code: Select all
Log Name: Application
Source: ESENT
Date: 4/21/2009 2:53:19 AM
Event ID: 102
Task Category: General
Level: Information
Keywords: Classic
User: N/A
Computer: fileserver.domain.com
Description:
DFSRs (1792) \\.\D:\System Volume Information\DFSR\database_FAF0_88F2_F088_B683\dfsr.db: The database engine (6.00.6001.0000) started a new instance (0).
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="ESENT" />
<EventID Qualifiers="0">102</EventID>
<Level>4</Level>
<Task>1</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2009-04-21T06:53:19.000Z" />
<EventRecordID>2013</EventRecordID>
<Channel>Application</Channel>
<Computer>fileserver.domain.com</Computer>
<Security />
</System>
<EventData>
<Data>DFSRs</Data>
<Data>1792</Data>
<Data>\\.\D:\System Volume Information\DFSR\database_FAF0_88F2_F088_B683\dfsr.db: </Data>
<Data>0</Data>
<Data>6</Data>
<Data>00</Data>
<Data>6001</Data>
<Data>0000</Data>
</EventData>
</Event>