Article ID: 833167
Article Last Modified on 9/13/2007
APPLIES TO
- Microsoft Windows Server 2003, Standard Edition (32-bit x86)
- Microsoft Windows Server 2003, Enterprise Edition
- Microsoft Windows Server 2003, Web Edition
- Microsoft Windows Server 2003, 64-Bit Enterprise Edition
Introduction
A hotfix update to the Volume Shadow Copy service for Microsoft Windows Server 2003 is available. This update package addresses the following specific symptoms:
- Software shadow copies do not complete on large volumes that use a small cluster size
- Time-out errors occur in volume shadow copy service writers, and shadow copies are lost during backup or during instances of high input/output activity
- Plug and Play (PnP) surprise removal event is created when you delete a hardware shadow copy
- Shadow copies do not work in a cluster that has multiple Windows system paths or when the ADMIN$ share has been deleted
- A hardware shadow copy resource can be orphaned if you cancel a hardware shadow copy create operation
- An error 0x800700EA occurs when you try to import a hardware shadow copy
- A shadow copy may become corrupted on volumes that are very fragmented
- Hardware shadow copy shows a NULL device path
- Volumes may disappear when you run hardware shadow copies in a clustered environment
- A computer may stop responding if the Shadow Copies for Shared Folders option is turned on when you try to import hardware shadow copies
- Some VSS operations may not complete after a hardware shadow copy fails over in a clustered environment
- The Cluster service may not start after you upgrade to Microsoft Windows Server 2003
- VSS cannot create snapshots on logical unit numbers that are on Internet Small Computer System Interface (iSCSI) drives
- SQL MSDE Writer returns an error if the database is offline during a restore
SYMPTOMS
Software shadow copies do not complete on large volumes that use a small cluster size
When you try to create shadow copies on large volumes that have a small cluster size (for example, less than 4 kilobytes [KB]), or if you take snapshots of several very large volumes at the same time, the VSS software provider may use a larger paged pool memory allocation during the shadow copy creation than is required. If there is not sufficient paged pool memory available for the allocation, the shadow copy cannot complete and may cause the loss of all previous shadow copy tasks. When this problem occurs, the following error messages may also appear in the application event log:
Event Type: Error Event Source: VolSnap Event Category: None Event ID: 5 Description: The shadow copy of volume X: could not be created due to insufficient non-paged memory pool for a bitmap structure.
Event Type: Error Event Source: VolSnap Event Category: None Event ID: 20 Description: The shadow copies of volume X: were aborted because of a failed free space computation.
Event Type: Error Event Source: VolSnap Event Category: None Event ID: 28 Description: The shadow copy of volume X: could not be created due to a failure in creating the necessary on disk structures. Data: 0000: 00 00 00 00 02 00 58 00 ......X. 0008: 00 00 00 00 1c 00 06 c0 .......À 0010: 00 00 00 00 9a 00 00 c0 ....š..À 0018: 3d 00 00 00 00 00 00 00 =....... 0020: 00 00 00 00 00 00 00 00 ........
Note You may receive other events that are not described in this article. A value of 0xc000009a (STATUS_INSUFFICIENT_RESOURCES) in the NTSTATUS part of the event at offset 0x14 indicates a problem with the memory resource allocation.
Resolution This update fixes the memory allocation issue. You may still experience this symptom if you do not have sufficient memory available to perform the copy operation.
back to top
Time-out errors occur in volume shadow copy service writers, and shadow copies are lost during backup or during instances of high input/output activity
When you start a backup process, some Volume Shadow Copy service writers may receive time-out errors that cause the backup to fail. A Volume Shadow Copy service writer is a program or a service that uses the Volume Shadow Copy service to save information before a shadow copy is created. For example, when you use a backup program (such as NTBackup), the backup may not be completed, and you may receive the following error message:
To diagnose the Volume Shadow Copy service writer problem, run the vssadmin command immediately after the backup failure:
- Click Start, and then click Run.
- Type vssadmin list writers.
This command lists the Volume Shadow Copy service writers and the current state of each writer. For example, the output might indicate that the Microsoft SQL Server Desktop Engine (MSDE) or the Microsoft Active Directory writer failed. You may experience time-out errors on several writers, including the MSDE writer, the SQL writer, the NT Directory Service (NTDS) writer, the Windows Internet Naming System (WINS) writer, the Dynamic Host Configuration Protocol (DHCP) writer, the Remote Storage writer, the certification authority writer, and the Microsoft Exchange writer. The following is sample output:
C:\>VSSADMIN LIST WRITERS
[...]
Writer name: 'NTDS'
Writer Id: {b2014c9e-8711-4c5c-a5a9-3cf384484757}
Writer Instance Id: {26ed439f-4a52-481d-963d-5db5b695d9e7}
State: [10] Failed
Last error: Retryable error
Additionally, certain time-out errors can be identified by looking in the application event log. The following are two examples:
Event ID: 12290
Description:
Volume Shadow Copy Service warning: ESENT ERROR {b2014c9e-8711-4c5c-a5a9-3cf384484757} NTDS: -2402. hr = 0x00000000.
Event ID: 2004 Description: Shadow copy 6 time-out (20000 ms).
You may experience a problem that causes certain Volume Shadow Copy service writers to time out during a lengthy shadow copy creation. This problem occurs especially on computers that have slow hard disk drives, low memory, or low CPU speed. This problem may also occur on computers that have the disk write cache disabled (for example, on a domain controller computer).
Shadow copy creation includes a complex sequence of inter-process calls. The inter-process calls make sure that all the important Volume Shadow Copy service writers flush their data buffers during shadow copy creation. These programs include SQL, Exchange Server, operating system services, and other programs. Additionally, some Volume Shadow Copy service writers, like the Exchange writer, do not write during a predefined time interval. This waiting period permits the shadow copy to be created during the time interval. The writers wait to write so that the contents of the shadow copy will be consistent with their data buffers. However, if there is low CPU speed, high memory usage, or high input/output levels, you may experience the following behaviors:
- The writers do not flush their data buffers.
- The writers do not wait the time interval before they write.
When this problem occurs, shadow copy creation fails.
Important Volume Shadow Copy service writers may fail with similar errors because of other conditions. These conditions include a lack of disk space or improper configuration of the computer. This hotfix addresses only the specific time-out errors that might randomly occur in Volume Shadow Copy service writers during backup. Microsoft highly recommends that you review the event log for any other potential Volume Shadow Copy service errors that might generate a writer failure.
Another related symptom is that shadow copies of shared network folders may have been deleted. When this problem occurs, the following error message appears in the event log:
Event Type: Error Event Source: VolSnap Event Category: None Event ID: 25 Description: The shadow copies of volume VolumeName were aborted because the diff area file could not grow in time. Consider reducing the IO load on this system to avoid this problem in the future.
In the message, VolumeName is the name of the volume that is scheduled for backup.
You may also experience a problem in the Volsnap.sys driver that causes the shadow copy to be deleted wheninput/output is high. This problem may occur especially when the disk write cache is disabled (for example, on a domain controller computer).
By default, the shadow copy provider that is included in Microsoft Windows Server 2003 is used to create shadow copies for backup purposes. The shadow copies are implemented by using a copy-on-write implementation. The differences are copied in the shadow copy storage area. In the Volume Shadow Copy service, you can use either the shadow copy management tool or the vssadmin command.
In the original released version of Windows Server 2003, the initial shadow copy storage area that is allocated for shadow copy creation is 100 megabytes (MB). However, the actual space that is used is much smaller. As time passes, the allocated space may increase as more data is modified on the original volume. However, when input/output traffic is high on the original volume, the shadow copy storage area cannot grow fast enough to hold all the copy-on-write changes. This behavior causes deletion of all the shadow copies on the original volume. This problem is more noticeable in domain controller configurations. By default, the disk write cache is disabled in domain controller configurations.
Important A similar problem is caused by defragmenting a volume that has a small cluster size. In this situation, all shadow copies are deleted, and the event error that is listed in earlier this section is logged. For additional information about losing shadow copies during a disk defragmentation, click the following article number to view the article in the Microsoft Knowledge Base:
312067 Shadow copies may be lost when you defragment a volume
Additionally, event error ID 2004 may be logged when there are corrupted NTFS file system volumes. To determine whether this is the problem, run the Chkdsk.exe program with the /f switch.
Large Audit Log. Writer time-out errors might also appear during a system-state backup if the security (audit) log is extremely large. It is best to back up the system-state periodically, or to clear the log periodically.
Resolution This hotfix reduces the occurrence of this issue by permitting certain writers more time to prepare for the shadow copy process. This hotfix also changes the minimum initial shadow copy storage area from 100 MB to 300 MB.
back to top
Plug and Play (PnP) surprise removal event is created when you delete a hardware shadow copy
A hardware shadow copy is a shadow copy that is performed in a hardware storage array. Hardware shadow copies appear similar to and are treated similar to disks and logical unit numbers (LUNs) by Windows Server 2003. When a disk or an LUN is suddenly removed from a system, an event message is logged that details the surprise removal. Similarly, for hardware shadow copies, an event message is logged when shadow copies are deleted. When you delete a hardware shadow copy, the following error messages may also appear in the application event log:
Event Type: Error Event Source: PlugPlayManager Event Category: None Event ID: 12 Description: The device 'Manufacturer Model (C) SCSI Disk Device' (SCSI\Disk&Ven_Vendor&Prod_Product_(C)Vendor&Rev_2001\4&13376f61&0&1017) disappeared from the system without first being prepared for removal.
Event Type: Error Event Source: VSS Event Category: None Description: Volume Shadow Copy Service error: Unexpected error calling routine DeleteVolumeMountPoint. hr = 0x80070002
Resolution This update package resolves the issue by correctly removing the shadow copy volume and the disk devices.
back to top
When you turn on shadow copies for shared folders in a cluster, the shadow copy scheduled task may not complete when different nodes in the cluster have different Windows folder paths (for example, %windir%). For example, if the Windows installation path for node A is c:\winnt and the path for node B is c:\windows, the scheduled task may not work after failing over from node A to node B.
You may also receive the following error message when you try to schedule a shadow copy:
This issue may occur if the ADMIN$ share has been removed from a system, even in non-clustered scenarios.
Resolution This update package resolves these issues. Multiple Windows system paths are now detected, and the ADMIN$ share is no longer required when you schedule a shadow copy task.
back to top
A hardware shadow copy resource can be orphaned if you cancel a hardware shadow copy create operation
When you create a hardware shadow copy that will be automatically imported on the same computer where the shadow copy was created, the shadow copy resource may be orphaned if you cancel the operation. This symptom occurs only when the following conditions are true:
- When you use a hardware shadow copy that is configured to be automatically imported to the same computer (by using the autoimport context)
- When the hardware shadow copy is canceled when the shadow copy is created.
To delete the hardware resource, a user who has administrator credentials must delete the resource manually by using the management program of the storage device.
Resolution This update package resolves this issue by detecting whether an automatic import configuration exists.
back to top
An error 0x800700EA occurs when you try to import a hardware shadow copy
In some circumstances, a hardware shadow copy may not import. When this symptom occurs, you may receive the following event message:
Event Type: Error Event Source: VSS Event Category: None Event ID: 8193 Description: Volume Shadow Copy Service error: Unexpected error calling routine DeviceIoControl(IOCTL_VOLMGR_QUERY_HIDDEN_VOLUMES. hr = 0x800700ea.
Resolution This update package resolves this issue.
back to topA shadow copy may become corrupted on volumes that are very fragmentedOn a volume that is very fragmented and where shadow copy is turned on, the shadow copy may become corrupted.
Resolution This update package resolves this issue.
back to top
Hardware shadow copy shows a NULL device path
You may not be able to successfully create a hardware shadow copy. However, the shadow copy is reported as successful with a NULL device path. This issue may occur when the hardware storage device cannot create the shadow copy. However, the failure and the error code are masked. The requesting program reports a failure while trying to access the shadow copy.
Resolution This update package resolves this issue. The failure and the error code are correctly returned to the program.
back to top
Volumes may disappear when you run hardware shadow copies in a clustered environment
A volume may disappear when you run a hardware shadow copy and when the volume is part of a managed resource in a cluster. This problem occurs when the cluster disk driver does not pass some operations between the layers in the storage stack.
Resolution This update package resolves this issue. The cluster disk driver now passes the correct operations.
back to top
This symptom occurs when you use hardware shadow copies and when you follow these steps:
- You have turned on Shadow Copies for Shared Folders on the volume.
- You perform a hardware shadow copy on that volume.
- You import the hardware shadow copy.
- You break the hardware shadow copy (for example, you convert to a LUN).
- You configure the new LUN with read/write operation.
Resolution: This update package resolves this issue.
back to top
Some VSS operations may not complete after a hardware shadow copy fails over in a clustered environment
When a cluster fail-over occurs, some input/output tasks may not complete while the storage resources are in process to return online on another cluster node. When this symptoms occurs, the storage stack may detect some sectors of a hardware shadow copy as bad sectors. Some VSS operations do not complete, and you may receive the following event in the application log:
Event Type: Error
Event Source: VSS
Event Category: None
Event ID: 8193
Computer: Computer_name
Description:
Volume Shadow Copy Service error: Unexpected error calling routine
DeviceIoControl(IOCTL_VOLUME_SET_GPT_ATTRIBUTES).
hr = 0x80070057
Resolution This update package resolves this issue. The storage stack will retry the operations.
back to top
The Cluster service may not start after you upgrade to Microsoft Windows Server 2003
When you upgrade a cluster from Windows 2000 Server to Windows Server 2003, the service account may not be an explicit member of the local administrators group. In Windows Server 2003, the Cluster service hosts a VSS writer. The service may not start if the service account is not an explicit member of the local administrator group.
Resolution This updatepackage resolves this issue. The Cluster service account is added to the VSS custom account list.
back to top
VSS cannot create snapshots on logical unit numbers that are on Internet Small Computer System Interface (iSCSI) drives
When you try to create a snapshot on an LUN that is on an iSCSI volume, you may receive the following event message:
Source: VSS EventID: 8193 Description: Volume Shadow Copy Service Error: Unexpected error calling routine IVssLunInformation::SetBasicType hr=0x80070057.
Resolution This update package adds support for iSCSI hardware.
Note Microsoft recommends that you run Microsoft iSCSI Software Initiator version 1.02 or later. For more information about iSCSI drives, visit the following Microsoft Storage Technologies - iSCSI Web site:http://www.microsoft.com/windowsserversystem/storage/technologies/iscsi/default.mspxback to top
SQL MSDE Writer returns an error if the database is offline during a restore
When you try to restore a SQL database, the MSDE writer (as part of the VSS process) tries to communicate to the SQL instance. If you perform a restore operation while the SQL MSDE instance is not running, the MSDE writer cannot connect. The MSDE writer reports a failure to the backup application and causes the restore operation to fail. The following error message also appears in the application event log:
Event Type: Error Event Source: VSS Event Category: None Event ID: 6013 Description: Sqllib error: OLEDB Error encountered calling IDBInitialize::Initialize. hr = 0x80004005. SQLSTATE: 08001, Native Error: 17 Error state: 1, Severity: 16 Source: Microsoft OLE DB Provider for SQL Server Error message: [DBNETLIB][ConnectionOpen (Connect()).] SQL Server does not exist or access denied.
Resolution This update package resolves this issue.
RESOLUTION
Service pack information
To resolve this problem, obtain the latest service pack for Windows Server 2003. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
889100 How to obtain the latest service pack for Windows Server 2003
Hotfix information
A supported hotfix is now available from Microsoft. However, this hotfix is intended to correct only the problem that is described in this article. Apply this hotfix only to systems that are experiencing this specific problem. This hotfix might receive additional testing. Therefore, if you are not severely affected by this problem, we recommend that you wait for the next service pack that contains this hotfix.
To resolve this problem, submit a request to Microsoft Online Customer Services to obtain the hotfix. To submit an online request to obtain the hotfix, visit the following Microsoft Web site:
Note If additional issues occur or any troubleshooting is required, you might have to create a separate service request. The usual support costs will apply to additional support questions and issues that do not qualify for this specific hotfix. To create a separate service request, visit the following Microsoft Web site:
Prerequisites
No prerequisites are required.
Restart Requirement
You must restart your computer after you apply this hotfix.
Hotfix Replacement Information
This hotfix replaces the following hotfix:
826936 Time-out errors occur in Volume Shadow Copy Service writers, and shadow copies are lost during backup and during times when there are high levels of input/output
File Information
The English version of this hotfix has the file attributes (or later) that are listed in the following table. The dates and times for these files are listed in coordinated universal time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time tool in Control Panel.
Date Time Version Size File name -------------------------------------------------------------- 18-Dec-2003 20:04 5.2.3790.114 59,392 Clusdisk.sys 26-Dec-2003 23:02 5.2.3790.113 225,280 Dmadmin.exe 26-Dec-2003 23:02 5.2.3790.109 1,055,232 Esent.dll 18-Dec-2003 07:21 5.2.3790.113 129,536 Ftdisk.sys 26-Dec-2003 23:02 5.2.3790.113 273,920 Swprv.dll 18-Dec-2003 07:16 5.2.3790.113 116,736 Volsnap.sys 18-Dec-2003 07:16 5.2.3790.113 131,584 Vssadmin.exe 26-Dec-2003 23:02 5.2.3790.113 542,720 Vssapi.dll 26-Dec-2003 23:02 5.2.3790.113 130,560 Vssui.dll 18-Dec-2003 07:16 5.2.3790.113 663,040 Vssvc.exe 26-Dec-2003 23:02 5.2.3790.113 18,432 Vss_ps.dll 16-Dec-2003 17:55 5.2.3790.113 37,888 Ws03res.dll
STATUS
Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section. This problem was first corrected in Windows Server 2003 Service Pack 1.
MORE INFORMATION
For more information about the Volume Shadow Copy service (VSS), click the following article number to view the article in the Microsoft Knowledge Base:
327948 Windows Server 2003 compatibility with former backup software
For more information about software update terminology, click the following article number to view the article in the Microsoft Knowledge Base:
824684Description of the standard terminology that is used to describe Microsoft software updates
Additional query words: VSS Snapshot Rollup provider
Keywords: kbbug kbfix kbqfe kbwinserv2003sp1fix kbwinserv2003presp1fix atdownload kbhotfixserver KB833167
