Posts Tagged ‘VSS’

A Server with Sentinal One had 60GB of data in C:\System Volume Information.

Originally thought this was Veeam not cleaning up snapshots but eventually realised it was Sentinel One’s ransomware protection, which by default takes a snapshot at 4 hourly intervals.

The reason it was taking up so much space on this server was the maximum shadow copy storage space for the disk was set to “unbounded”.

To check this run vssadmin list shadowstorage in an elevated command prompt:

Confirmed the standard is to set this to 10%, but to do this we needed to temporarily disable the Sentinel One policy as it protects shadow copies and storage settings from being tampered with.

Once disabled you can run the following command to set the max size: vssadmin Resize ShadowStorage /For=C: /On=C: /MaxSize=10%

Sentinel One policy will need to be enabled again once complete.

GD Star Rating
loading...
GD Star Rating
loading...

I have recently converted a Hyper V Vm to vmware 

Trying to use Veeam to back it up , and displayed the following error

18/12/2021 4:53:15 PM :: Failed to prepare guest for hot backup. Error: VSSControl: -2147212529 Backup job failed. Discovery phase failed. Cannot add volumes to the snapshot set. Cannot add a volume to the snapshot set. Volume name: [\\?\Volume{70835baf-895e-480d-aea3-8ecd4db01046}\]. Cannot add volume to the set of volumes that should be shadowed. VSS error: VSS_E_UNEXPECTED_PROVIDER_ERROR. Code:0x8004230f

Per Veeam article this is due to VSS write issue 

I saw an old Hyper V VSS Writer : Hyper-V IC Software Shadow Copy Provider

Unforunelty this is integrated into the OS 

So had to manually remove from Registry

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS\Providers\{74600e39-7dc5-4567-a03b-f091d6c7b092}] 

GD Star Rating
loading...
GD Star Rating
loading...

Webroot has received reports of symptoms similar to those that you have reported. As a temporary measure there are two options for alleviating this issue.

First:

If you are utilizing the Task Scheduler for the backups to be performed (This can be seen in the system-Scheduled_Tasks.csv or Task Scheduler in Windows).

Example : C:\Windows\system32\vssadmin.exe Create Shadow /AutoRetry=15 /For=\\?\Volume{f3eeccd1-6c54-43d9-b19e-6695945f7934}

This command can be replaced with the following instead : wmic shadowcopy call create Volume=c:\

(Volume letter depends on the corresponding volume id they are attempting to copy)

Second:

If Task Scheduler is not being employed, we would like you to disable some settings within your Webroot policy which has been successful in alleviating the issue.

1. Log into your Webroot console.

2. Click on the Policies tab then the policy we will be modifying

3. Under Policy Section select Local Heuristics

a. Set Enable Infrared to “Off”

b. Click the Save button

4. Under Policy Section select Network Heuristics

a. Set Advanced Heuristics to “Disabled”

b. Click the Save button

 

* All endpoints assigned to this policy will update within 24hrs depending on the configured poll interval.

GD Star Rating
loading...
GD Star Rating
loading...

Backup Exec VSS Error

back-up-exec[1]According to the Error logs of Backup Exec it is a VSS error.

Indeed there is VSS error for the Exchange VSS Writer, when I ran the command “VSSADMIN LIST WRITERS”.

I restarted the VSS service and started another backup which resolved the problem.

GD Star Rating
loading...
GD Star Rating
loading...