Windows – VSS error–Event ID 25

July 11, 2017

Recently I got an Error Event ID 25 and the System State backup failed!

image

Event ID 25 : …Shadow Copy Storage could not grow in time…

Debugging :

Use this command vssadmin list shadowstorage /for=D:

image

It showed some storage limitations for the VSS on the D: drive.

Also check the Backup Logs: %windir%\logs\WindowsServerBackup

image

Opening the last log I see that there are no errors and the log suddenly stops …

image

Solution :

I checked the settings and indead there was a limitation set…

image

image

So I changed it to unlimited and solved Smile

But make sure that you have enough disk capacity before you set it to unlimited !!

image

Because it can grow fast !

In case this does not work you can use these alternatives :

The following command on the host in order to place the shadow copy on another disk; drive letters need to be changed accordingly:

vssadmin add shadowstorage /For=D: /On=E: /MaxSize=UNBOUNDED
vssadmin resize shadowstorage /For=D: /On=E: /MaxSize=UNBOUNDED

Or you can modify the System Performance by Adjusting the Page File to 1.5 times the amount of RAM:

  1. Open System in Control Panel.
  2. On the Advanced tab, under Performance, click Settings.
  3. On the Advanced tab, under Virtual memory, click Change.
  4. Under Drive [Volume Label], click the drive that contains the paging file you want to change.
  5. Under Paging file size for selected drive, click Custom size, and type a new paging file size in megabytes in the Initial size (MB) or Maximum size (MB) box, and then click Set.

This will have only an effect after a REBOOT !

Advertisements

Windows – SBS Server Restarts itself Event ID 1012

March 31, 2017

After investigating the issue the Event ID 1011 and 1012 showed these results ?

image

image

The main reason was that we added a second Domain controller to the Domain where an SBS server was running.

As you probably know, you have a service called SBCore or “SBS Core Services”.

Which executes the following Process: \WINDOWS\system32\sbscrexe.exe

If you kill it, it just restarts – and if you try and stop it you are told Access Denied.

image

SOLUTION :

Tools you’ll need is : Process Explorer

1. If you fire up Process Explorer, you can select the process and Suspend it, now we can start to disable the thing.

image

2. Run regedit and expand the nodes until you reach the following hive / key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SBCore

Right click this, hit permissions and give the “Administrators” group on the local machine full access.

(don’t forget to replace permissions on child nodes).

F5 in regedit and you’ll see all of the values and data under this key.

image

Select the “Start” DWORD and change it from 2 to 4

This basically sets the service to the “Disabled” state.

3. Next, adjust the permissions on the file C:\WINDOWS\system32\sbscrexe.exe.

So that EVERYONE account is denied any sort of access to this file.

image

Then go back to Process Explorer, and kill the sbscrexe.exe process, if it doesn’t restart.

If that doesn’t work use this method.

taskkill /fi "Services eq SBcore" /F
image
Result should look like this …
image

Enjoy!


Windows – How to Debug NTFS Disk Corruption Event ID 55

March 16, 2016

 

clip_image002

Event ID 55 Analysis resulted in the following :

Hardware Diagnostics

No hardware issues reported ?

clip_image004

Chkdsk

Running chkdsk did not report any errors ?

EventLog

After analyzing the Eventlog I saw a pattern coming back.

The Event ID came back 3 times a day with approx. 8 hours in between :

5.45 AM /  13.45 PM  / 21.45 PM

This lead me to the fact that it had something to do with the VSS ?

VSSAdmin

Check for errors.

clip_image006

No Errors reported ?

So next I cleaned all the VSS copies and pushed the CREATE NOW button.

clip_image008

I saw again the NTFS events ID 55 ?

Next I checked the VSS Settings, to see the available capacity.

clip_image010

SOLUTION :

Check the available disk capacity and the size allocated for VSS.

=> C drive had 90 Gb available and the size allocated for VSS was 95 Gb ?

Once I changed the size below the available disk capacity and run the create Shadow Copy again.

No errors were reported in the event log

An Other issue can be that this related to a corrupt Shadow Copy

Use these steps to debug and fix

1. Open an elevated cmd prompt

2. Diskshadow> List Shadows All

3. Look out for the GUID of the shadow copy to be deleted  or if you are deleting all, just put “Delete Shadows ALL“.

Like this Delete shadows ID  {6c63605e-96aa-46ce-8d70-9f98b415208d}

4. Check again Diskshadow> List Shadows All

PS :

1. Using “Vssadmin delete shadows …” command does work for shadows or snapshots created by backup software.

These shadow copies may not show up or be visible using the GUI.

Check to ensure no backup is running (see this in the date stamp on the shadows)

image

An other option is just to run the chhkdsk /f command

2. Here is how to fix an Event 55 Error on \System Volume Information

https://www.dell.com/support/article/be/fr/bedhs1/sln290554/event-id-55-ntfs-the-file-system-structure-on-the-disk-is-corrupt-and-unusable?lang=en

Which fixed our issue …

Events appeared always at the same time every day …

image

after a CHECK disk event in verify mode (= Windows Backup)

image

Another fix that we had on a different server …

After a long struggle and debugging we found out that the error appeared always during a backup window.

So finally we found out that there was a conflict in the schedule that runs to create VSS snapshot, the same time the backup was running.

image

Once we rescheduled the VSS Snapshot on the C drive it error was gone Smile

On an other server we had disable the VSS on the C: drive completely to get rid of the error 55.

No use to have a VSS running on the C: drive anyhow ?

So it all depends on the situation and kind of backup software that is running on the machine.

More info here for potential reasons of Event ID 55

VSS driver Issue ? https://support.microsoft.com/nl-be/kb/2754784

Symantec Backup Exec Issue ?https://www.veritas.com/support/en_US/article.TECH71661

Step by step guide to help ?

http://www.omerovic.nl/wordpress/2013/12/troubleshooting-event-55-file-system-structure-disk-corrupt/

Bottom line is that 9 out of 10 these errors are related to Backup and VSS snapshots. And not that much to real disk errors Smile

Enjoy !


Windows – System State Backup fails – Error 2155348129 Event ID 521

June 3, 2014

See Event Log Event ID 521 Backup – Error Code 2155348129.

The reason that there was an SP1 upgrade run on the SP SEARCH Express

-> inconsistent osearch14 VSS Writer

image

Basically “vssadmin list writers” allowed me to see that “SPSearch4 VSS Writer” was holding everything up with an “inconsistent shadow copy” error, and a few quick Google searches later I was all good.

Hopefully that helps you get to where you need to be.

In case anyone else gets here due to backup failing with SBS 2011 even on a clean install with all patches, the cause is due to the SharePoint server Search service pack1. To resolve run the

“SharePoint 2010 Products Configuration Wizard” after that you should be able to re run vssadmin and see all errors are cleared.

See also here

My issue was caused by SP1 on SharePoint 2010. After I ran the following command (twice), from a command prompt on the SharePoint Server the backups started to work:

http://blogs.technet.com/b/sbs/archive/2011/07/06/potential-issues-after-installing-sharepoint-foundation-2010-sp1.aspx

Run the SP Configuration Wizard

clip_image002

image

check again using vssadmin list writers as admin

And you can see that the errors have gone.

clip_image006

If this does not work try stopping the MS SQL server VSS Writer and try again to make a system state backup.

clip_image002[100]