Microsoft KB Archive/826936

= Time-out errors occur in Volume Shadow Copy service writers, and shadow copies are lost during backup and during times when there are high levels of input/output =

Article ID: 826936

Article Last Modified on 12/3/2007

-

APPLIES TO


 * Microsoft Windows Small Business Server 2003 Standard Edition
 * Microsoft Windows Server 2003, 64-Bit Datacenter Edition
 * Microsoft Windows Server 2003, Enterprise x64 Edition
 * Microsoft Windows Server 2003, Datacenter Edition (32-bit x86)
 * Microsoft Windows Server 2003, Enterprise Edition (32-bit x86)
 * Microsoft Windows Server 2003, Standard Edition (32-bit x86)
 * Microsoft Windows Server 2003, Web Edition

-



Important This article contains information about how to modify the registry. Make sure that you back up the registry before you modify it. Make sure that you know how to restore the registry if a problem occurs. For more information about how to back up, restore, and modify the registry, click the following article number to view the article in the Microsoft Knowledge Base:

256986 Description of the Microsoft Windows registry



SYMPTOMS
This hotfix addresses two specific symptoms:
 * Time-out errors occur in Volume Shadow Copy service writers.
 * Shadow copies are lost during backup and during times when there are high levels of input/output.

Time-out errors occur in Volume Shadow Copy service writers
Sometimes, during the backup process, some Volume Shadow Copy service writers might fail because of time-out errors that cause the backup to fail. A Volume Shadow Copy service writer is a program or a service that uses Volume Shadow Copy service to save information to a shadow copy storage area. For example, when you use the NTBackup program, the backup may not be successful, and you may receive the following error message:

Error returned while creating the volume shadow copy: 800423f4 (or the values 800423f2 or 800423f3)

To diagnose the Volume Shadow Copy service writer problem, run the vssadmin command immediately after the backup failure:
 * 1) Click Start, and then click Run.
 * 2) Type vssadmin list writers.

This command lists the Volume Shadow Copy service writers and the current state of each writer. For example, the output might indicate that the Microsoft SQL Server Desktop Engine (MSDE) or the Microsoft Active Directory directory service writer failed. You may experience time-out errors on several writers, including the MSDE writer, the SQL writer, the New Technology Directory Service (NTDS) writer, the Windows Internet naming system (WINS) writer, the Dynamic Host Configuration Protocol (DHCP) writer, the Remote Storage writer, the certification authority writer, and the Microsoft Exchange writer. The following is sample output:

C:\>VSSADMIN LIST WRITERS

[...]

Writer name: 'NTDS'

Writer Id: {b2014c9e-8711-4c5c-a5a9-3cf384484757}

Writer Instance Id: {26ed439f-4a52-481d-963d-5db5b695d9e7}

State: [10] Failed

Last error: Retryable error

Additionally, certain time-out errors can be identified by looking in the application event log. Some examples:

Event ID: 12290

Description:

Volume Shadow Copy Service warning: ESENT ERROR {b2014c9e-8711-4c5c-a5a9-3cf384484757} NTDS: -2402. hr = 0x00000000.

Event ID: 2004

Description:

Shadow copy 6 time-out (20000 ms).

Shadow copies are lost during backup and during times when there are high levels of input/output
Another related symptom is that shadow copies of shared network folders may have been deleted. When this problem occurs, the following event error is logged:

Event Type: Error

Event Source: VolSnap

Event Category: None

Event ID: 25

Description:

The shadow copies of volume  were aborted because the diff area file could not grow in time. Consider reducing the IO load on this system to avoid this problem in the future.

In the message,  is the name of the volume that is scheduled for backup.



CAUSE
The symptoms that are described earlier in this article may occur for one of the following reasons:
 * Volume Shadow Copy service writer time-out
 * Shadow copy deletion
 * Large audit log

Volume Shadow Copy service writer time-out
You may experience a problem that causes certain Volume Shadow Copy service writers to time out during a lengthy shadow copy creation. This problem occurs especially on computers that have slow hard disks, low memory, or low CPU speed; or on computers that have the disk write cache disabled (for example, on a domain controller computer).

Shadow copy creation includes a complex sequence of inter-process calls. The inter-process calls make sure that all the important Volume Shadow Copy service writers (programs such as SQL, Exchange Server, operating system services, and others) flush their data buffers during shadow copy creation. Also, some Volume Shadow Copy service writers, like the Exchange writer, wait to write for a predefined time interval so the shadow copy can be created during the time interval. The writers wait to write so the contents of the shadow copy will be consistent with their data buffers. However, if there is low CPU speed, high memory usage, or high input/output levels, you may experience the following behaviors:
 * The writers do not flush their data buffers.
 * The writers do not wait the time interval before they write.

When this problem occurs, shadow copy creation fails.

Important Volume Shadow Copy service writers may fail with similar errors because of other conditions. These conditions include a lack of disk space or improper configuration of the computer. This hotfix addresses only the specific timeout errors that might randomly occur in Volume Shadow Copy service writers during backup. You are strongly advised to review the event log for any other potential Volume Shadow Copy service errors that might generate a writer failure.

Shadow copy deletion
You may also experience a problem in the Volsnap.sys driver that causes shadow copy deletion when there is a high level of input/output, especially when the disk write cache is disabled (for example, on a domain controller computer).

By default, the shadow copy provider that is included in Microsoft Windows Server 2003 is used to create shadow copies for backup purposes. The shadow copies are implemented by using a copy-on-write implementation. The differences are also copied in the shadow copy storage area. In Volume Shadow Copy service, you can use the shadow copy management tool, or you can use the vssadmin command.

In the original released version of Windows Server 2003, the initial shadow copy storage area that is allocated for shadow copy creation is 100 megabytes (MB). However, the actual space that is used is much smaller. As time passes, the allocated space may increase as more data is modified on the original volume. However, when you have high input/output traffic on the original volume, the shadow copy storage area cannot grow fast enough to hold all the copy-on-write changes. This causes deletion of all the shadow copies on the original volume. This problem is more noticeable in domain controller configurations. By default, the disk write cache is disabled in domain controller configurations.

Important A similar problem is caused by defragmenting a volume with small cluster size, where all shadow copies are deleted, and where the event log error that is listed earlier in this article is logged. For additional information about losing shadow copies during a disk defragmentation, click the following article number to view the article in the Microsoft Knowledge Base:

312067 Shadow copies may be lost when you defragment a volume

Also, event error ID 2004 may be logged when there are corrupted NTFS file system volumes. To determine if this is the problem, run the Chkdsk.exe program with the /f switch.

Large audit log
Writer time-out errors might also appear during a system-state backup if the audit log is extremely large. It is best to back up or to clean the audit log periodically.



RESOLUTION
Important The hotfix that is described in the &quot;Hotfix information&quot; section is included in the update that is described in the following Microsoft Knowledge Base article:

833167 A Volume Shadow Copy Service (VSS) update package is available for Windows Server 2003

It is highly recommended that you install this update to resolve the problem described in this article and other VSS-related issues.

Hotfix information
To resolve this problem, obtain the latest service pack for Windows Server 2003. For more information, click the following article number to view the article in the Microsoft Knowledge Base:

889100 How to obtain the latest service pack for Windows Server 2003

Prerequisites
No prerequisites are required.

Restart requirement
You must restart your computer after you apply this hotfix.

Hotfix replacement information
This hotfix does not replace any other hotfixes.

File information
The English version of this hotfix has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in Coordinated Universal Time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time item in Control Panel.

Windows Server 2003, Microsoft Windows Small Business Server 2003
Date        Time   Version      Size       File name - 28-Aug-2003 19:37  5.2.3790.81  1,054,720  Esent.dll 28-Aug-2003 18:51  5.2.3790.81    271,360  Swprv.dll 28-Aug-2003 18:51  5.2.3790.81    116,736  Volsnap.sys 28-Aug-2003 18:51  5.2.3790.81    642,560  Vssvc.exe 12-Aug-2003 18:54                     271  Branches.inf 28-Aug-2003 19:50                  10,886  Kb826936.cat 28-Aug-2003 19:39                     354  Updatebr.inf 28-Aug-2003 19:39                   5,697  Update_rtmqfe.inf

Windows Server 2003, 64-bit editions
Date        Time   Version       Size       File name         Platform --- 28-Aug-2003 19:33  5.2.3790.80   2,604,544  Esent.dll         IA-64 28-Aug-2003 19:33  5.2.3790.80     698,368  Swprv.dll         IA-64 28-Aug-2003 18:51  5.2.3790.80     347,136  Volsnap.sys 28-Aug-2003 18:51  5.2.3790.80   1,751,040  Vssvc.exe         IA-64 12-Aug-2003 18:54                      271  Branches.inf 28-Aug-2003 19:49                   10,886  Kb826936.cat 28-Aug-2003 19:40                      354  Updatebr.inf 28-Aug-2003 19:40                    5,717  Update_rtmqfe.inf



MORE INFORMATION
Warning Serious problems might occur if you modify the registry incorrectly by using Registry Editor or by using another method. These problems might require that you reinstall the operating system. Microsoft cannot guarantee that these problems can be solved. Modify the registry at your own risk.

This hotfix makes some classes of writer (SQL, Active Directory, and others) less likely to experience time-out errors. In part, this hotfix is designed to improve the performance of the default shadow copy driver (Volsnap.sys) when there are high input/output levels. The hotfix also includes a larger initial size for the shadow copy storage area: 300 MB instead of 100 MB. Additionally, if a 300 MB initial size is not sufficient, and if shadow copies are still lost because of high input/output levels, this hotfix includes a way for you to configure the initial size of the shadow copy storage area when the shadow copy storage area is created. You can configure the initial size of the shadow copy storage area by using the configurable registry key setting that this hotfix provides.

Follow these steps, and then quit Registry Editor:  Click Start, click Run, type regedit, and then click OK. Locate and then click the following key in the registry:

 

 On the Edit menu, point to New, and then click DWORD value. Type MinDiffAreaFileSize, and then press ENTER. On the Edit menu, click Modify.</li> Type the size that you want for the shadow copy storage area, and then click OK.</li></ol>

The  registry key specifies the minimum size of the shadow copy storage area; the default setting is 300 MB, and the maximum setting is 3 gigabytes (GB). For an accurate setting, specify a value that is a multiple of 300 MB; otherwise, the next multiple of 300 MB will be chosen. A value of 300 is equal to 300 MB, and a value of 3,000 is equal to 3 GB.

Shadow copies may not function correctly if the value of the  registry key is larger than the maximum size of the shadow copy storage area. Before you apply the hotfix, run the vssadmin list shadowstorage command. Make sure that the Min Diff Area file is larger than 300 MB or that the Min Diff Area file is larger than the value that is specified in the registry. Also, make sure that you have at least 300 MB of free space on the shadow copy storage volume.

<div class="status_section">

STATUS
Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the &quot;Applies to&quot; section. This problem was first corrected in Windows Server 2003 Service Pack 1.

Additional query words: SBS ADS Win2k3 Win2003 VSS VSC service VSS &quot;Volume Shadow Copy&quot; MinDiffAreaFileSize

Keywords: kbhotfixserver kbbug kbfix kbqfe kbwinserv2003presp1fix KB826936

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.