Tag Archive: vss

VSS Event ID 12289

I noticed I was getting 10 errors with the source VSS and ID of 12289 once a day. The error message is:

Volume Shadow Copy Service error: Unexpected error VSS_E_WRITER_STATUS_NOT_AVAILABLE. An older active writer session state is being overwritten by a newer session. The most common cause is that the number of parallel backups has exceeded the maximum supported limit. hr = 0x80042409.


PostSnapshot Event


Maximum supported sessions: 64

Completed sessions: 8

Active sessions: 64

Aborted sessions: 0

Writer failed sessions: 0

New snaphot set: {9e27fa3a-58c4-49e8-ac98-e61ce47e227b}

Old snapshot set: {78b24809-c91f-46d2-ae15-1e3ac517f17c}

Old operation: 1014

Old state: 1

Old failure: 0

Execution Context: Writer

Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220}

Writer Name: System Writer

Writer Instance ID: {0ded508e-db13-4a3d-ae21-c82dde65cef3}

VSS Event 12289

VSS Event 12289

Each of the 10 events was a different “Writer Name
This is a simple problem, which means that my VSS writers, which handle Shadow Copies as well as Windows Backup, were busy when requested for use.
This is simply a conflict with backup schedules. I h to task manager and sure enough, the VSS was scheduled to make copies at 7 AM of drives C and D.
I have my Windows Server Backup scheduled at 7 AM as well. Moving the Windows Server Backup scheduled time to 6 AM solves this problem.
Alternately, you could move your VSS Shadow Copy Schedule to another time using Task Manager.

I also added Backup Operators Group read permissions on Volume Shadow Copy using GPMC. Create and link a new GPO, navigate to Computer>Windows>Security>System Services>Volume Shadow Copy. Enable the GPO, and set to automatic. Then click the Edit Security button, and add Backup Operators with read permissions.

I would like to point out that Microsoft and others have stated that this issue may be benign and cause no problems. My Backups are ALL completing successfully despite the error.


I was surfing through my server manager, and I noticed a whole lot of yellow exclamation points on my server roles. After browsing them, I realized most were caused by the server reboot this morning, and can safely be deleted as 1 time events. I did notice an informational item under File Services.

Log Name:      System
Source:        volsnap
Date:          10/13/2010 12:00:34 PM
Event ID:      33
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      SOLACESERVER.solace.local
The oldest shadow copy of volume C: was deleted to keep disk space usage for shadow copies of volume C: below the user defined limit.

Server Manager and VSS Error Event ID 33

Server Manager and VSS Error Event ID 33

Configure Shadow Copies

Configure Shadow Copies

User defined limit? Did I set that? Oh well, let’s explore and see what it is set at, and how to gauge what the best settings are for a system. Navigate to Start>My Computer. Right click on the C: Drive and select Configure Shadow Copies.

I see four entries.





The first two are disabled. A:\ is my backup drive, and I do not it want Shadowed. The first is the volumename for my backup drive, which is also not Shadowed- why would you make copies of the drive that you store copies on, after all. If it WAS enabled, you could change it’s scheduling under scheduled tasks, Volume Shadow Copy. Were going to ignore those two for now- let’s focus on our two logical drives, C:\ and D:\. We do want these Shadowed- to provide previous version support for files, as well as for use in Windows Server Backup, which uses VSS.

These drives were both backed up today, they both have 10 shares, though the used size is different: 2088 for C:\, and 8921 on D:\. You will notice that both drives keep their own Shadow Copies. I at one time thought that this would be a good thing to change, so I put them both on a backup drive. Well, after that Windows Server Backup worked 50% of the time, and I could not change them back- exception error. So I suggest leaving them there.

Shadow Copies

Shadow Copies


But what about the size? Why are they different? Why does C:\ only have two copies while D:\ has 5? These settings are all set by Windows depending upon the drive size. My C: is 60Gb while D: is 90Gb. Also, D: has more content, and about the same free disk space. Proportionally the settings are correct- a large space for Shadow Copies on a larger drive. But C:\ is only keep two Shadow Copies, which gives you 2 previous version. You need more? Then increase the size by clicking settings and changing it.

You will notice in the settings menu that the limit is actually larger than the used- this is of course true. You can change it to no limit if you wish and have the space, or increase the limit to include many more copies. You can also change the schedule here- the default is twice a day. I like to leave mine here, though I change the times to make sure they do not run at the same time as other major things such as an Exchange backup.

In windows Server 2003 you had to keep the sizes as multiples of 300Mb, but this is no longer the case. As for the correct size- default is good. If you need it larger increase it untill you can keep the number of copies you wish. If you need it small, I suggest making it small incrementally, and make sure you can keep at lease 2 Shadow Copies. Making it too small might restrict Shadow Copies too much and interfere with Windows Server Backup.

You can also manage space and copies with the command line tool VSSADMIN, which is documented here at TechNet.

So I come into work, and load up the console only to see yellow and red warnings. Crap. Well, time to start fixing things.

SBS Console Screenshot

SBS Console

First thing I notice, is that one of my backups failed. this is troublesome, as my past problem with backups and VSS were quite an issue. So I go to the Backups tab, and click backup history. I then see the error “A Volume Shadow Copy Service operation failed. Unknown error (0x800423f3)”. This happened at 7AM, but not at 8PM- this leads me to believe the VSS service was busy so it could not backup my server. On to the event log.
I open the event log, and the first 1,000 entries are Outlook connecting and disconnecting. Ill investigate that later- now I will turn off outlook and scroll down to 7 AM. There it is, 3 events. Event ID’s 7001, 12298 and 12310. Before I investigate this, I want to make sure no other tasks are scheduled to run at 7AM. I go to Task Scheduler, and go through each task- theres nothing running at 7AM. I did however find two tasks named FSSScanXXX. That rung a bell as Forefront Security, which is uninstalled- deleted those tasks.
VSS Event ID 33
I plugged the three events into Google, and found this page. That post mentioned Hotfixes, but I don’t think I am ready for that yet. I did install Exchange 2007 SP2 recently, maybe that is the issue. Ill keep looking.
I stmble upon this post at TechArena, which rang a bell. I just installed Exchange 2007 Rollup 4- though at the failure time it was not installed. Well see how it reacts after the update.
The manually run Backup ran fine, no Eventlog errors or failures. Ill comment more on this once the scheduled task runs at 7 AM.
Update: The backup completed successfully overnight. It seems this error was in fact caused by a transient error and was corrected by applying Microsoft Exchange SP2 Update Rollup 4.
%d bloggers like this: