Error returned while creating the volume shadow copy:ffffffff

[zarg]

We are getting the following error in our backup logs for off-site servers:

Backup Status
Operation: Backup
Active backup destination: 4mm DDS
Media name: ""Pembroke BK 24/11/2005 AT 22:12""

Volume shadow copy creation: Attempt 1.
Timeout before function completed

Error returned while creating the volume shadow copy:0xffffffff.

Error returned while creating the volume shadow copy:ffffffff
Aborting Backup.

----------------------

The operation did not successfully complete.

----------------------

The error has only started to happen recently. Some servers run OK, others always fail the first backup but run the second time and one just will not run backup at all. They all fail with the above message.

We are in the middle of a project to migrate users from NT4 domains and Exchange 5.5 to AD and Exchange 2003.

The only thing I have found which relates to this problem invloves re-registring some dlls, and when we called Microsoft Support their first suggestion was the same thing:

net stop vss
regsvr32 /s ole32.dll
regsvr32 /s vss_ps.dll
Vssvc /Register
regsvr32 /s /i swprv.dll
regsvr32 /s /i eventcls.dll
regsvr32 /s es.dll
regsvr32 /s stdprov.dll
regsvr32 /s vssui.dll
regsvr32 /s msxml.dll
regsvr32 /s msxml3.dll
regsvr32 /s msxml4.dll

At the moment we are perplexed and not sure what to try next, any help will be greatly appreciated.

Our details are as follows:

Servers are typically:
Compaq ML370 G4 with dual 3.2ghz
2GB RAM
2 x 36GB SCSI HD
Disk 0 is configured: C 10GB (system&boot) M 20gb (exch store) P 4GB (profiles) and 800MB unallocated
Disk 1 is configured: L 4GB (exch logs) F 20GB (files) and 10GB unallocated
HP StorageWorks DAT72 internal SCSI
Server built using HP SmartStart

Standard software installed:
Windows 2003 Enterprise Server with SP1
Exchange 2003 with SP1
ADC
IIS
.net 1.1
HP Compaq insight agent
Powerchute Plus 5.2
PC Anywhere 11.5
McAfee Virus 8.0i Enterprise
McAfee Rogue System Sensor
McAfee GroupShield 6.0.2
Java JRE 1.4.2

AD Tree is Windows 2000 native

NTBackup is scheduled to back up all volumes, system state and exchange storage group

EDIT: Server is ML370 (not 340)

[yuval14]

Please remove/uninstall:

Powerchute Plus 5.2 (You should upgrade to 7.04 version)
PC Anywhere 11.5

Exclude: C:\System Volume Information from the Mcafee engine online
scan

Contact MS:

http://support.microsoft.com/default.aspx?kbid=833167

Also, its recommanded to replace the backup tape with HP LTO2 External device
and use Backupexec 10d and upgrade the servers drivers to 7.40 + BIOS/Firmware.

Regards,

Yuval

[guyt]

Originally Posted by yuval14

Also, its recommanded to replace the backup tape with HP LTO2 External device
and use Backupexec 10d and upgrade the servers drivers to 7.40 + BIOS/Firmware.

Why ? throwing more money on hardware when he akready has the hardware that is supposed to serve his needs ? and when the problem is OS or software related ?

I would try to:
- Install latest Proliant Support Pack (the error might be related to buggy sorage/tape drivers)
- Try to backup to a file instead of tape and see if the error persists

[zarg]

Thank you both for the suggestions:

KB833167 is superseeded by KB887827 and both are included in SP1.
I will upgrade PowerChute Plus
It is running the latest version of PCAnywhere but removing it is not an option at this stage (the server is conviently located 400 miles away)
McAfee already excludes the c:\System Volume Information directory

I have already installed the latest StorageWorks drivers and firmware.

I am going to install the latest PSP and then try a full backup to file (space permitting). Then upgrade/remove the PowerChute software.

[zarg]

Here is the latest whats happening:

The server is quite new and was built using smart start 7.40 and the latest psp is 7.40a so it didn't update any drivers - so there goes the easy option =)

I haven't upgraded the PowerChute Plus software but the latest is 5.2.3 for the licensed version we have.

I have got McAfee to exlcude the System Volume Information directory on all partions and excluded the vssvc and ntbackup service.

Now the server is backing up on the second attempt, the first is the same error as below.

I have tried backing up to file just doing the c drive, system state and exchange store and this fails on the first attempt but runs on the second as well.

Anymore ideas?

[scottr]

I am seeing the exact same issue. We have a different setup per the following:
Dell PowerEdge 2800 Single 3.4ghz
2G RAM
3 x 146GB SCSI Raid 5
2 logical NTFS drives c: 12G with 1.75G Free, d: 261G with 192G Free
DELL Provided Seagate DAT72-052 SCSI Tape Drive

Software:
Windows 2003 Small Business Sever SP1
APC PowerChute Personal Edition 1.5
Norton Antivirus Enterprised Edition

I am using ntbackup and get the ffffffff error in it.

Further I get the following event:

Event Type:	Error
Event Source:	VSS
Event Category:	None
Event ID:	12302
Date:		12/19/2005
Time:		11:30:30 AM
User:		N/A
Computer:	SERVER1
Description:
Volume Shadow Copy Service error: An internal inconsistency was
 detected in trying to contact shadow copy service writers.  Please 
check to see that the Event Service and Volume Shadow Copy
 Service are operating properly.

For more information, see Help and Support Center at 
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 2d 20 43 6f 64 65 3a 20   - Code: 
0008: 42 55 45 43 58 4d 4c 43   BUECXMLC
0010: 30 30 30 30 37 32 37 34   00007274
0018: 2d 20 43 61 6c 6c 3a 20   - Call: 
0020: 42 55 45 43 58 4d 4c 43   BUECXMLC
0028: 30 30 30 30 37 32 31 39   00007219
0030: 2d 20 50 49 44 3a 20 20   - PID:  
0038: 30 30 30 30 34 35 32 34   00004524
0040: 2d 20 54 49 44 3a 20 20   - TID:  
0048: 30 30 30 30 35 31 30 38   00005108
0050: 2d 20 43 4d 44 3a 20 20   - CMD:  
0058: 22 43 3a 5c 57 49 4e 44   "C:\WIND
0060: 4f 57 53 5c 73 79 73 74   OWS\syst
0068: 65 6d 33 32 5c 6e 74 62   em32\ntb
0070: 61 63 6b 75 70 2e 65 78   ackup.ex
0078: 65 22 20 20 20 20 20 20   e"      
0080: 2d 20 55 73 65 72 3a 20   - User: 
0088: 65 61 67 6c 65 6f 66 66   eagleoff
0090: 69 63 65 5c 41 64 6d 69   ice\Admi
0098: 6e 69 73 74 72 61 74 6f   nistrato
00a0: 72 20 20 20 20 20 20 20   r       
00a8: 2d 20 53 69 64 3a 20 20   - Sid:  
00b0: 53 2d 31 2d 35 2d 32 31   S-1-5-21
00b8: 2d 34 32 37 37 35 38 30   -4277580
00c0: 37 39 34 2d 31 36 32 34   794-1624
00c8: 35 37 30 31 35 31 2d 31   570151-1
00d0: 32 36 36 32 35 31 38 35   26625185
00d8: 31 2d 35 30 30 20 20 20   1-500

I have searched extensively at Microsoft with not a lot of luck. I did find article 907574 with the exact same event id as above but it pertainined only to XP and I verified the registry per the article and everything looked good. Several other articles show similar problems but not the same problem so I am leary of trying the hotfixes.

Of note would be that, ntbackup was working fine until about 4 weeks ago when this failure mode started (I do not know the exact timeframe as everything was running fine so I was only changing the tape out once a week and now the ntbackup log only goes back 2 weeks).

I do not see that any updates to the machine occured during this timeframe. Dell diagnostics indicates that the tape drive and tape are working fine.

This may not pertain but the help system is now not working on this machine as well.

NTBackup was scheduled to back up all system state and certain folders on the D dirve.

Any help would be greatly appreciated.

EDIT: I just remebered that as part of the troubleshooting, I turned off volume shadow copy on c drive. It was already off on d drive. This did not help

[scottr]

I just got ntbackup working on the 2800.

I poked around on this web site a bit and found a link to www.eventid.net. Specficially
http://www.eventid.net/display.asp?e...ce=VSS&phase=1.

Per comments by Charles L., this fixed it.
"
Charles L. (Last update 5/27/2005):
System started experiencing this error repeatedly and all VSS backups would fail. NTBACKUP also could not backup a simple text file.
Running the command “vssadmin list writers” normally returns a long list of writers. The affected system returned nothing for this command. The fix the problem I reregistered ole32.dll. The syntax is as follows: “c:\regsvr32 ole32.dll”.
The server will need to be restarted after this command is executed. Afterwards "vssadmin list writers" returned the proper list and the backup worked again
"

Hope this helps

[PercyI20]

I had the same problem a while back.

The problem was solved by one of the following 3 things I did

1) I cleared the logs in event viewer

2) I set the volume shadow copies in services to automatic

3) I uninstalled mcfee anti-virus

For some reason mcfee took a lot of memory and cpu useage that could cause time-out errors because the server is slower.

Im still waiting for the security team to reinstall mcfee. If the backup fails after the reinstallation of mcfee I will know what the problem was.

They installed mcfee and there is no problem with the server or the backups