Ask the Community
Groups
Backups failing - freeze/thaw VSS failures or broken Agent when Antivirus is used - Connect IT Community | Kaseya
<main> <article class="userContent"> <h2 data-id="summary"><strong>SUMMARY</strong></h2> <p>Security software known for either damaging</p> <h2 data-id="issue"><strong>ISSUE</strong></h2> <p>Backups fail citing VSS freeze/thaw events and customer is utilizing an Antivirus.<br><br>GetWriterStatus: USNAPError! GatherWriterStatus call has returned a failure.<br>(VSS_E_WRITERERROR_TIMEOUT) The writer's timeout expired between the Freeze and Thaw events.<br>Please check Windows Events Log that Volume Shadow Copy Service and VSS Writers are operating properly.<br><br>To confirm, leverage the command:<br># fltmc instances<br> </p> <h2 data-id="resolution"><strong>RESOLUTION</strong></h2> <p>Sophos Antivirus has provided their own KB in regards to how to prevent this issue in their software. Please see the following KB written specifically to address this ongoing issue:<br><br><a rel="nofollow" href="/home/leaving?allowTrusted=1&target=https%3A%2F%2Fcommunity.sophos.com%2Fkb%2Fen-us%2F132691">https://community.sophos.com/kb/en-us/132691</a><br><br>In addition to the above Sophos fix also confirm that the exceptions listed in this <a rel="nofollow" href="/home/leaving?allowTrusted=1&target=https%3A%2F%2Funitrends-support.zendesk.com%2Fhc%2Fen-us%2Farticles%2F360013249438">KB 5800</a> are applied for your antivirus programs. For any other Antivirus program, if you need assistance with making sure the appropriate exclusions are made to prevent scanning Windows Shadow Copy volumes/location, please contact your Antivirus Software support team.<br> </p> <h2 data-id="cause"><strong>CAUSE</strong></h2> <p>Antiviruses with Real Time Protection and/or Intrusion prevention Services may have unexpected impacts to the success of guest-level backups.</p> <h2 data-id="notes"><strong>NOTES</strong></h2> <p>For details on the 'fltmc instances' command see <a rel="nofollow" href="/home/leaving?allowTrusted=1&target=https%3A%2F%2Fnotesfromthedatacenter.wordpress.com%2Ftag%2Ffltmc%2F">https://notesfromthedatacenter.wordpress.com/tag/fltmc/</a></p> </article> </main>