Ask the Community
Groups
Troubleshooting Windows event IDs - Connect IT Community | Kaseya
<main> <article class="userContent"> <h2 data-id="summary"><strong>SUMMARY</strong></h2> <p>This document contains a description of the flow of events in a backup, as captured in the Windows Events application log.</p> <h2 data-id="issue"><strong>ISSUE</strong></h2> <p>Below is a table that describes the flow of events in a backup, as captured in the Windows Events application log.<br><br><img alt="User-added image" height="175" src="https://us.v-cdn.net/6032361/uploads/migrated/43JB7T69ZR2K/eid-ka01w000000g3ng-feoid-00n40000002yvfa-refid-0em40000000tony." width="500" class="embedImage-img importedEmbed-img"></img><br>Starting event<br>Task category and message indicate the operation. The description field contains the type of operation that has started.<br><img alt="User-added image" height="86" src="https://us.v-cdn.net/6032361/uploads/migrated/V7ZVTADJVM5O/eid-ka01w000000g3ng-feoid-00n40000002yvfa-refid-0em40000000too3." width="500" class="embedImage-img importedEmbed-img"></img><br>VSS events leading up to execution of a volume snapshot<br> <br>Related VSS events are seen before and after the Unitrends events are logged. Any failures that occur while issuing these VSS events are logged as errors. Some details are added to the event description for that failure. In the case of errors, some diagnostics can be run from the command line to insure that the VSS subsystem is functioning. Use the ‘VssAdmin’ commands:<br>Vssadmin list writers<br>Vssadmin list providers<br>Vssadmin list volumes<br> <br>If any of these commands fail or return no information, then the VSS subsystem is not functioning. A<br>reboot helps in most cases.<br> <br>VSS events are described here:<br><img alt="User-added image" height="229" src="https://us.v-cdn.net/6032361/uploads/migrated/WL62JC3BT4HX/eid-ka01w000000g3ng-feoid-00n40000002yvfa-refid-0em40000000too8." width="500" class="embedImage-img importedEmbed-img"></img><br>When creating a snapshot, the agent adds the requested volumes to that snapshot and for each volume added the following event is logged.<br> <br>If a failure occurs while adding a volume to the snapshot event 279 is logged. Included are some details of the error. Typically, failures occur when attempting to add non-NTFS volumes or network attached volumes to a snapshot set. In some cases, network attached volumes require a hardware specific<br>VSS provider to be installed before they can be added to VSS snapshots. If this error occurs, the agent attempts the backup without using the VSS snapshot. This could result in files not being backed up due to file in use errors.<br> <br>VSS add volume events are described here:<br><img alt="User-added image" height="136" src="https://us.v-cdn.net/6032361/uploads/migrated/H004LKFSPHNM/eid-ka01w000000g3ng-feoid-00n40000002yvfa-refid-0em40000000tood." width="500" class="embedImage-img importedEmbed-img"></img><br>The system state begins event indicates the exact point in the process that this starts. The system state ending event is seen later, and any errors found in between. System state duration can be determined with these two events.<br><br><img alt="User-added image" height="68" src="https://us.v-cdn.net/6032361/uploads/migrated/WWAT7KOXT9Q1/eid-ka01w000000g3ng-feoid-00n40000002yvfa-refid-0em40000000n6ol." width="500" class="embedImage-img importedEmbed-img"></img><br>A volume snapshot operation concludes with one of two events. The successful DoSnapshotSet event indicates that the volume snapshot has completed OK. A failure is logged as an Error category event with some details in the description. If the snapshot operation fails, the following error event is logged. Added to this message is some extra detail about the error. There are many possible causes for this failure. Some of the errors are related to poor disk performance causing the VSS subsystem to give up while waiting for the snapshot to complete. In these cases, the Windows OS usually logs other warnings or errors before and/or after this entry.<br> <br>Do snapshot events are described here:<br><img alt="User-added image" height="153" src="https://us.v-cdn.net/6032361/uploads/migrated/VBK0CDPVZ621/eid-ka01w000000g3ng-feoid-00n40000002yvfa-refid-0em40000000toos." width="500" class="embedImage-img importedEmbed-img"></img><br>For master, differential, and incremental backups, the agent performs a system state backup. When that completes, an information or error event is logged. There are many error cases during system state backup, especially when running on Windows domain controllers. If system state failures persist then more detailed information is logged in the Unitrends agent log files. <br> <br>System state events are described here:<br><img alt="User-added image" height="136" src="https://us.v-cdn.net/6032361/uploads/migrated/UPH76CA2HY0J/eid-ka01w000000g3ng-feoid-00n40000002yvfa-refid-0em40000000tooc." width="500" class="embedImage-img importedEmbed-img"></img><br>At the end of the backup, the session completion event is entered. If the summary was sent okay, then the following event appears. A failure to send the summary results in an error event being entered. The success event shows how many files were backed up and how many were skipped due to an error or an in-use condition.<br>780<br>The session complete event is described here:<br><img alt="User-added image" height="123" src="https://us.v-cdn.net/6032361/uploads/migrated/P6ETH7B7S78J/eid-ka01w000000g3ng-feoid-00n40000002yvfa-refid-0em40000000tooh." width="500" class="embedImage-img importedEmbed-img"></img><br>If a failure occurs while sending the backup summary to the Unitrends system, the following event is logged. This is usually caused by a network connection disruption between the Unitrends agent and the backup system.<br> <br>The failed to send summary event is described here:<br><img alt="User-added image" height="86" src="https://us.v-cdn.net/6032361/uploads/migrated/R99PMDWV0SB6/eid-ka01w000000g3ng-feoid-00n40000002yvfa-refid-0em40000000toow." width="500" class="embedImage-img importedEmbed-img"></img><br>For application backups (Exchange or SQL), the agent concludes the session by issuing a VSS BackupComplete event with a success or fail condition. For successful backups, this event indicates to the appropriate VSS writer that any cleanup processing may be done, like transaction log truncation. A failure condition causes this event to log as an Error category and the description indicates the error.<br> <br>There are many possible causes of an application backup failure, some of which are described in the preceding events. Any error during an application backup causes the agent to issue the BackupComplete failure event.<br> <br>Backup complete events are described here:<br><img alt="User-added image" height="167" src="https://us.v-cdn.net/6032361/uploads/migrated/DS5QTG07671W/eid-ka01w000000g3ng-feoid-00n40000002yvfa-refid-0em40000000n6oq." width="500" class="embedImage-img importedEmbed-img"></img><br><br><br><br><br><br><br><br> </p> </article> </main>