Skip to main content

NTFS Errors show in Windows log during backup

Beginner
Posts: 2
Comments: 3

I figured I would give the forums a try before calling support on this one. I'm backing up a Windows 2008 R2 SP1 domain controller. The backups complete successfully but I've noticed that within the Windows Event Viewer I'm seeing some errors and warnings poping up during the backup and it has me a little concerned.

The error I'm seeing is Event ID 137, Ntfs - "The default transaction resource manager on volume \\?\Volume{9539ca54-4cf5-11e1-9c98-000c2901aad9} encountered a non-retryable error and could not start."

The warning I'm seeing is Event ID 57, Ntfs - "The system failed to flush data to the transaction log. Corruption may occur." This is repeated multiple times during the backup process.

I get very concerned when I start seeing errors showing up in my event viewer on a domain controller. Has anyone experienced this before and if so are there any know solutions to resolve them?

Thanks for your help.

Forum Star
Posts: 27
Comments: 1940

Top

http://communities.vmware.com/message/1824410
But don't uninstall vmware tools' VSS driver because backing up DC without VSS is not a good idea.

Regular Poster
Posts: 71
Comments: 162

Top

That's strange because Acronis Tech Support is asking me to uninstall VSS driver. Check with VMWare, they suggest not uninstalling the VSS driver. WHo to believe?

Keep VSS driver and *SOMETIMES* have vmprotect backups succeed.

Remove VSS driver and have vmprotect backup jobs succeed but going against VMWare's recommendations and creating a "false sense of security" with jobs succeeding but containing crash consistent backups.

I wish there was a way to get vmProtect to work with the VSS driver.

Beginner
Posts: 2
Comments: 3

Top

According to Riki78 from the VM Forum (http://communities.vmware.com/message/1824410) posted by dev-anon, it's ok to ignore these errors.

"Hello
This is the last responds from VMware Support:
Regarding the following:
(EventID 137 ntfs), EventID 57 ntfs) (EventID 12289 vss)

These can be safely ignored, That's a false alarm from the NTFS driver.

Event 12289 is in normal operation. I believe it happens when VSS is querying for supported disks and sees our floppy drive and VSS will skip it.
Engineering have reproduced the other two, they are the result of a fix engineering made to allow quiesced snapshots on VMs with an ADAM or NTDS instance. please see this: http://support.storagecraft.eu/kb_details.aspx?id=KB10059, which looks like they made the same fix we did and the resulting event logs show up as well. However, I could not find anything from Microsoft about this.
Engineering took a quiesced snapshot and ran chkdsk both after the snapshot and after reverting to the snapshot and they both came up clean.

So, the messages can be ignored.
Best Regards"

KJSTech, are your backups actually failing? So far vmProtect hasn't failed a backup task. I've just noticed the errors occuring in the event viewer during the backup process.

Regular Poster
Posts: 71
Comments: 162

Top

Yes they fail randomly. Acronis support is telling me to remove the vmware vss driver from any machine failing.

It's a real pain to do so because its a multi-step process.
1. Uninstall vmware tools, reboot
2. Reinstall vmware tools (do a custom install and do not select VSS).
3. Reboot yet again.

Because of the reboots it has to be done after hours. We have many virtual machines so it is a real time consuming project to do this.

I've only done this to 2 machines so far and I'm going to see if I can get consistent backups now. Also sometimes in vSphere client in the task list there is a stuck task at 100% for Acronis vmProtect Backup. The only way to remove them is to restart the vCenter server because if you right click on the task cancel is grayed out.

I'm having the same results whether I use vmProtect6 or vmProtect7 beta. Acronis support says all the errors I have are from VMWare. VMWare support forums lean towards that the machines are too busy or there's too much I/O going on to Quiesce the file system. They also say I can remove the VSS driver but it creates crash consistent backups. They say to ensure my backup application can verify the backups and we would periodically restore the backups in a sandbox to make sure they work. Disabling VSS may remove the errors were getting but it would create a false sense of security as it appears though the backup job is good, but they cant guarantee the application on that machine will be tolerant and we should test that all services come up on a routine basis.

Forum Star
Posts: 27
Comments: 1940

Top

KJSTech, as your backups fail, you have a different problem than just event log errors. I'd recommend to limit uninstalling VSS to these two machines, and when you make sure that backups don't (or do) fail on these machines anymore, get backup to the support with your findings (vss = sporadic fails, no vss = ? ) and proceed until backups work with normal setup.

Forum Member
Posts: 14
Comments: 34

Top

Was there ever a fix for this?

Acronis Program Manager
Posts: 22
Comments: 3026

Top

Hi chi-ltd,

As far as I know the situation with intermittent quiesced snapshot failures which KJSTech had been caused by improper connection of NFS datastore where the affected VM resides. There were 2 NICs in teaming and one was running 1GBit, while the 2nd one was at 100MBit. Making them both 1Gbit connection resolved the issue with the snapshots. This has been discovered with help from VMware support team.

I might be referring to another case, so KJSTech if the above information is not correct, please let us know.

Thank you.
--
Best regards,
Vasily
Acronis vmProtect Program Manager

Regular Poster
Posts: 71
Comments: 162

Top

Vasily is correct. I had consistant troubles with a few backups and it was due to the speeds on the one NIC in the team. This team was on the storage VLAN, which is where the NAS infrastructure is attached for our NFS datastores.
We have seperate VLAN's for DMZ and the regular server network on each vmware hosts, but it made sense since Acronis and VMWare are writing these snapshots to the NFS datastore, that the NIC on that VLAN was the culprit.

As far as NTFS / VSS errors in the Windows Server 2008 Event Viewer... that still happens, and as Robert posted that is safe to ignore. It deoesn't seem to affect anything. Again as Robert posted, more details are in this link on that particular issue: http://communities.vmware.com/message/1824410

Just a few gotcha's left in our environment...
Ocasionally a backup fails still, but if you reinstall VMWare tools, it runs fine for awhile until you have to do it again.

Acronis "cannot access archive" if trying to write an archive to an SMB share using DOMAIN level credentials. We had to create a LOCAL account on or EMC Celerra CIFS share and use those credentials. I don't think Acronis supports LAN Manager level 5 (Send NTLMv2 response only\refuse LM & NTLM) which is a security mandate via our Domain default policy, so it applies to any domain level credentials. Luckilly our EMC system allows local account creation as well. Funny thing is Acronis can SEE archives, just not write to them (unless using a local account on our SAN).

Acronis Program Manager
Posts: 22
Comments: 3026

Top

Hi KJSTech,

Thank you for the confirmation! What concerns the share access issue - it appears to be related to Linux 'samba' module which has issues with support of "NTLMv2 response only\refuse LM & NTLM" scheme. In other words it is applicable to Virtual Appliance only (which runs on Linux) and we have to rely on new 'samba' updates where this support is in to-do list. With Windows Agent you should not have such issues.

Thank you.
--
Best regards,
Vasily
Acronis vmProtect Program Manager

Regular Poster
Posts: 71
Comments: 162

Top

Ah that makes perfect sense. Any Linux based appliance or machine we have has trouble with that. Also this group policy = Microsoft network server: Digitally sign communications (always)

So what we do is just create LOCAL accounts with long random generated passwords (minimum 15 characters). Our auditors want high security everything which makes sense for what we do, so thats where that came from.

Forum Member
Posts: 0
Comments: 92

Top

Same as what I did. Setting up accounts with long passwords is actually a pain. :)

Beginner
Posts: 0
Comments: 1

Top

I have the same issue on Exchange and DB Servers.
In my scenario this happens during the quiescing process (VADP backup or just taking a Quiesced Snapshot).
Is there a KB/Patch from MS for this, or a solution that would not require to format the Disks from MBR to GPT?