Time-out errors occur in Volume Shadow Copy service writers, and shadow copies are lost during backup and during times when there are high levels of input/output (826936)

SYMPTOMS

This hotfix addresses two specific symptoms:

Time-out errors occur in Volume Shadow Copy service writers.
Shadow copies are lost during backup and during times when there are high levels of input/output.

Time-out errors occur in Volume Shadow Copy service writers

Sometimes, during the backup process, some Volume Shadow Copy service writers might fail because of time-out errors that cause the backup to fail. A Volume Shadow Copy service writer is a program or a service that uses Volume Shadow Copy service to save information to a shadow copy storage area. For example, when you use the NTBackup program, the backup may not be successful, and you may receive the following error message:

Error returned while creating the volume shadow copy: 800423f4 (or the values 800423f2 or 800423f3)

To diagnose the Volume Shadow Copy service writer problem, run the vssadmin command immediately after the backup failure:

Click Start, and then click Run.
Type vssadmin list writers.

This command lists the Volume Shadow Copy service writers and the current state of each writer. For example, the output might indicate that the Microsoft SQL Server Desktop Engine (MSDE) or the Microsoft Active Directory directory service writer failed. You may experience time-out errors on several writers, including the MSDE writer, the SQL writer, the New Technology Directory Service (NTDS) writer, the Windows Internet naming system (WINS) writer, the Dynamic Host Configuration Protocol (DHCP) writer, the Remote Storage writer, the certification authority writer, and the Microsoft Exchange writer. The following is sample output:

C:\>VSSADMIN LIST WRITERS
[...]
Writer name: 'NTDS'
Writer Id: {b2014c9e-8711-4c5c-a5a9-3cf384484757}
Writer Instance Id: {26ed439f-4a52-481d-963d-5db5b695d9e7}
State: [10] Failed
Last error: Retryable error

Additionally, certain time-out errors can be identified by looking in the application event log. Some examples:

Event ID: 12290
Description:
Volume Shadow Copy Service warning: ESENT ERROR {b2014c9e-8711-4c5c-a5a9-3cf384484757} NTDS: -2402. hr = 0x00000000.

Event ID: 2004
Description:
Shadow copy 6 time-out (20000 ms).

Shadow copies are lost during backup and during times when there are high levels of input/output

Another related symptom is that shadow copies of shared network folders may have been deleted. When this problem occurs, the following event error is logged:

Event Type: Error
Event Source: VolSnap
Event Category: None
Event ID: 25
Description:

The shadow copies of volume VolumeName were aborted because the diff area file could not grow in time. Consider reducing the IO load on this system to avoid this problem in the future.

In the message, VolumeName is the name of the volume that is scheduled for backup.

CAUSE

The symptoms that are described earlier in this article may occur for one of the following reasons:

Volume Shadow Copy service writer time-out
Shadow copy deletion
Large audit log

Volume Shadow Copy service writer time-out

You may experience a problem that causes certain Volume Shadow Copy service writers to time out during a lengthy shadow copy creation. This problem occurs especially on computers that have slow hard disks, low memory, or low CPU speed; or on computers that have the disk write cache disabled (for example, on a domain controller computer).

Shadow copy creation includes a complex sequence of inter-process calls. The inter-process calls make sure that all the important Volume Shadow Copy service writers (programs such as SQL, Exchange Server, operating system services, and others) flush their data buffers during shadow copy creation. Also, some Volume Shadow Copy service writers, like the Exchange writer, wait to write for a predefined time interval so the shadow copy can be created during the time interval. The writers wait to write so the contents of the shadow copy will be consistent with their data buffers. However, if there is low CPU speed, high memory usage, or high input/output levels, you may experience the following behaviors:

The writers do not flush their data buffers.
The writers do not wait the time interval before they write.

When this problem occurs, shadow copy creation fails.

Important Volume Shadow Copy service writers may fail with similar errors because of other conditions. These conditions include a lack of disk space or improper configuration of the computer. This hotfix addresses only the specific timeout errors that might randomly occur in Volume Shadow Copy service writers during backup. You are strongly advised to review the event log for any other potential Volume Shadow Copy service errors that might generate a writer failure.

Shadow copy deletion

You may also experience a problem in the Volsnap.sys driver that causes shadow copy deletion when there is a high level of input/output, especially when the disk write cache is disabled (for example, on a domain controller computer).

By default, the shadow copy provider that is included in Microsoft Windows Server 2003 is used to create shadow copies for backup purposes. The shadow copies are implemented by using a copy-on-write implementation. The differences are also copied in the shadow copy storage area. In Volume Shadow Copy service, you can use the shadow copy management tool, or you can use the vssadmin command.

In the original released version of Windows Server 2003, the initial shadow copy storage area that is allocated for shadow copy creation is 100 megabytes (MB). However, the actual space that is used is much smaller. As time passes, the allocated space may increase as more data is modified on the original volume. However, when you have high input/output traffic on the original volume, the shadow copy storage area cannot grow fast enough to hold all the copy-on-write changes. This causes deletion of all the shadow copies on the original volume. This problem is more noticeable in domain controller configurations. By default, the disk write cache is disabled in domain controller configurations.

Important A similar problem is caused by defragmenting a volume with small cluster size, where all shadow copies are deleted, and where the event log error that is listed earlier in this article is logged. For additional information about losing shadow copies during a disk defragmentation, click the following article number to view the article in the Microsoft Knowledge Base:

312067 Shadow copies may be lost when you defragment a volume

Also, event error ID 2004 may be logged when there are corrupted NTFS file system volumes. To determine if this is the problem, run the Chkdsk.exe program with the /f switch.

Large audit log

Writer time-out errors might also appear during a system-state backup if the audit log is extremely large. It is best to back up or to clean the audit log periodically.

RESOLUTION

Important The hotfix that is described in the "Hotfix information" section is included in the update that is described in the following Microsoft Knowledge Base article:

833167 A Volume Shadow Copy Service (VSS) update package is available for Windows Server 2003

It is highly recommended that you install this update to resolve the problem described in this article and other VSS-related issues.

Hotfix information

A supported hotfix is now available from Microsoft, but it is only intended to correct the problem that is described in this article. Only apply it to systems that are experiencing this specific problem. This hotfix may receive additional testing. Therefore, if you are not severely affected by this problem, we recommend that you wait for the next Windows Server 2003 service pack that contains this hotfix.

To resolve this problem immediately, contact Microsoft Product Support Services to obtain the hotfix. For a complete list of Microsoft Product Support Services telephone numbers and information about support costs, visit the following Microsoft Web site:

http://support.microsoft.com/contactus/?ws=support

Note In special cases, charges that are ordinarily incurred for support calls may be canceled if a Microsoft Support Professional determines that a specific update will resolve your problem. The usual support costs will apply to additional support questions and issues that do not qualify for the specific update in question.

Prerequisites

No prerequisites are required.

Restart requirement

You must restart your computer after you apply this hotfix.

Hotfix replacement information

This hotfix does not replace any other hotfixes.

File information

The English version of this hotfix has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in coordinated universal time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time tool in Control Panel. Windows Server 2003, Microsoft Windows Small Business Server 2003

Date         Time   Version      Size       File name
-------------------------------------------------------------
28-Aug-2003  19:37  5.2.3790.81  1,054,720  Esent.dll        
28-Aug-2003  18:51  5.2.3790.81    271,360  Swprv.dll        
28-Aug-2003  18:51  5.2.3790.81    116,736  Volsnap.sys
28-Aug-2003  18:51  5.2.3790.81    642,560  Vssvc.exe        
12-Aug-2003  18:54                     271  Branches.inf
28-Aug-2003  19:50                  10,886  Kb826936.cat
28-Aug-2003  19:39                     354  Updatebr.inf
28-Aug-2003  19:39                   5,697  Update_rtmqfe.inf

Windows Server 2003, 64-bit editions

Date         Time   Version       Size       File name         Platform
-----------------------------------------------------------------------
28-Aug-2003  19:33  5.2.3790.80   2,604,544  Esent.dll         IA-64
28-Aug-2003  19:33  5.2.3790.80     698,368  Swprv.dll         IA-64
28-Aug-2003  18:51  5.2.3790.80     347,136  Volsnap.sys
28-Aug-2003  18:51  5.2.3790.80   1,751,040  Vssvc.exe         IA-64
12-Aug-2003  18:54                      271  Branches.inf
28-Aug-2003  19:49                   10,886  Kb826936.cat
28-Aug-2003  19:40                      354  Updatebr.inf
28-Aug-2003  19:40                    5,717  Update_rtmqfe.inf

MORE INFORMATION

Warning If you use Registry Editor incorrectly, you may cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that you can solve problems that result from using Registry Editor incorrectly. Use Registry Editor at your own risk.

This hotfix makes some classes of writer (SQL, Active Directory, and others) less likely to experience time-out errors. In part, this hotfix is designed to improve the performance of the default shadow copy driver (Volsnap.sys) when there are high input/output levels. The hotfix also includes a larger initial size for the shadow copy storage area: 300 MB instead of 100 MB. Additionally, if a 300 MB initial size is not sufficient, and if shadow copies are still lost because of high input/output levels, this hotfix includes a way for you to configure the initial size of the shadow copy storage area when the shadow copy storage area is created. You can configure the initial size of the shadow copy storage area by using the configurable registry key setting that this hotfix provides.

Follow these steps, and then quit Registry Editor:

Click Start, click Run, type regedit, and then click OK.
Locate and then click the following key in the registry:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VolSnap
On the Edit menu, point to New, and then click DWORD value.
Type MinDiffAreaFileSize, and then press ENTER.
On the Edit menu, click Modify.
Type the size that you want for the shadow copy storage area, and then click OK.

The MinDiffAreaFileSize registry key specifies the minimum size of the shadow copy storage area; the default setting is 300 MB, and the maximum setting is 3 gigabytes (GB). For an accurate setting, specify a value that is a multiple of 300 MB; otherwise, the next multiple of 300 MB will be chosen. A value of 300 is equal to 300 MB, and a value of 3,000 is equal to 3 GB.

Shadow copies may not function correctly if the value of the MinDiffAreaFileSize registry key is larger than the maximum size of the shadow copy storage area. Before you apply the hotfix, run the vssadmin list shadowstorage command. Make sure that the Min Diff Area file is larger than 300 MB or that the Min Diff Area file is larger than the value that is specified in the registry. Also, make sure that you have at least 300 MB of free space on the shadow copy storage volume.