SQLVDI errors after switch to new AV

[guitarfish]

I have 3 Windows Server 2012 VMs running SQL Server 2012 SP4. My nightly backup jobs started intermittently failing a few weeks ago, a few days after I switched to Sophos Endpoint Protection on the VMs.

Veeam error:
Unable to release guest. Error: VSSControl: Failed to freeze guest over network, wait timeout
Error: VSSControl: Failed to freeze guest over network, wait timeout
Windows App log shows numerous SQLVDI errors.

I went through KB1999 "How to configure antivirus exclusions to prevent interaction with Veeam Backup & Replication" and it looks like the only applicable thing is for me to exclude the folders C:\Windows\VeeamVssSupport and C:\Windows\VeeamLogShipper on Guest OS for VSS. I'm not running Sophos on the Veeam server, so there's nothing to exclude there.

I've been using Veeam for years and I can't recall have an issue with SQL until the switch in AV. I have a case open with Sophos but they are slow. Anyone have any info about this issue?

[foggy]

So did the issue show up after configuring exclusions?

[vClintWyckoff]

Also adding that MSFT has an support article dedicated to the topic of AV exclusions dependent upon which version of SQL Server. Please let us know what Sophos support suggests as well as the final outcome so other forum users can benefit.

[guitarfish]

So far, Sophos has directed me to disable the "Sophos Health Service" service, and the jobs succeed. I uploaded a ProcMon capture to them this morning, which was capturing events when the SQLVDI errors occurred. Sophos has been real slow on this case, like 1 communication every day or so.

[leebtish]

Hi guitarfish,

I was about to post a new topic on this but ran a search and found your thread. We are experiencing the same issue on several servers (not just SQL but Domain Controllers and IIS) and resolved it by disabling the Sophos Health Service. If you run this from an admin command prompt - "fltmc instances" you will see Sophos accessing VSS.

We see warnings in our app logs showing the following:

A VSS writer has rejected an event with error 0x800423f2, The writer's timeout expired between the Freeze and Thaw events.
. Changes that the writer made to the writer components while handling the event will not be available to the requester. Check the event log for related events from the application hosting the VSS writer.

FYI, this thread has a lot of background information. At the moment Sophos and speaking with Microsoft about the issue - https://community.spiceworks.com/topic/ ... 713?page=1

Lots of people complaining about the response times from Sophos support. According to Sophos they are accessing VSS correctly and the problem should not be happening. Hopefully between them and MS they can resolve the issue. I'm going to raise this as a case with Sophos as well.