cancel
Showing results for 
Search instead for 
Did you mean: 

Shadow Copy Components - Error backing up Event Logs

rsxtc200
Level 3


Hello,

I am receiving some errors in the NetBackup Admin Console (v6.5.3) when trying to backup the Shadow Copy Components\ of a Windows Server 2003 R2 machine.  The operation is partially successful, but there appears to be problems reading the Event Log files.

The error I receive is:

Error bpbrm(pid=7684) from client XXX: ERR - failure reading file:  Shadow Copy Components:\Systems Service\Event Logs\Event Logs (BEDS 0xE000FEDF: A failure occurred reading an object.)

The two services, Microsoft Software Shadow Copy Provider and Volume Shadow Copy, are both running fine on the client until I try to do the backup job.  During the job, I see the following log messages in the client's Application log:

Event ID: 100, svchost (1052) The database engine 5.02.3790.3959 started.
Event ID: 2001, lsass (620) Shadow copy 1 freeze started.
Event ID: 101, svchost (1052) The database engine stopped.
Event ID: 2003, lsass (620) Shadow copy 1 freeze stopped.

Notes:  This is a DNS server.  One of our other DNS servers works just fine.  This is not a Small Business Server (SBS), SQL is not installed, and I have tried restarting the server.  I have also tried disabling and re-enabling the Shadow Copy on the C:\ drive.  Same result.

Thanks in advance.

6 REPLIES 6

PraveenCH
Level 4

Reduce the size of each event logs by going in to manage Event logs options and also tune the number of days to keep logs as per the admin requirements.

This happen because of huge size in Event logs which cannot be read by VSS.

 

--Praveen

rsxtc200
Level 3

Praveen,

Thank you for the suggestion.

The Security Log is 151 MB.  We are not allowed to delete any log information--they must be retained for five years.  You're saying that VSS cannot read an Event Log of this size?

Are there any other ways we can back up the logs?

 

rsxtc200
Level 3

I increased the log level to help troubleshoot and here are my findings.

We are backing up the Event Logs to a non-default location (E:\Event Logs\SecEvent.Evt, for example).  This changed was made in the Registry and this location must remain.

Turns out this is a bug, and here's the official article:  http://www.symantec.com/business/support/index?page=content&id=TECH69552

Rajesh_s1
Level 6
Certified

run this command and check whether the VSS writers are stable or not ,

'vssadmin list writers'  , if you run this command then it will display all the vss writers , check if the writers are stable or not . If any of the writers are in failed state then abously you will face issue in system state backup .

Another thing you can check try to take a syste state backup from windows native Ntbackup. If you are facing issue with this backup also then Netbackup will also fails .

 

Some time if you reboot the servers also some of the VSS writers will be in failed state which will keep giving you issue , you need to first make the writers stable and then proceed further.

 

 

rsxtc200
Level 3

Rajesh,

Thank you for providing those suggestions.  The VSS writers had no errors and are all Stable.

As for running Ntbackup, it completed successfully.

Rajesh_s1
Level 6
Certified

Thats geat then, so you mean to say that you are facing issue with Netbackup .

I am not sure whether you have increased the timeout settings for that client or not if not please increase the timeout settings and then test the backup (more than 2000)