The symptoms that are described earlier in this article may occur for one of the following reasons:
- Volume Shadow Copy service writer time-out
- Shadow copy deletion
- Large audit log
Volume Shadow Copy service writer time-out
You may experience a problem that causes certain Volume Shadow Copy service writers to time out during a lengthy shadow copy creation. This problem occurs especially on computers that have slow hard disks, low memory, or low CPU speed; or on computers that have the disk write cache disabled (for example, on a domain controller computer).
Shadow copy creation includes a complex sequence of inter-process calls. The inter-process calls make sure that all the important Volume Shadow Copy service writers (programs such as SQL, Exchange Server, operating system services, and others) flush their data buffers during shadow copy creation. Also, some Volume Shadow Copy service writers, like the Exchange writer, wait to write for a predefined time interval so the shadow copy can be created during the time interval. The writers wait to write so the contents of the shadow copy will be consistent with their data buffers. However, if there is low CPU speed, high memory usage, or high input/output levels, you may experience the following behaviors:
- The writers do not flush their data buffers.
- The writers do not wait the time interval before they write.
When this problem occurs, shadow copy creation fails.
Important Volume Shadow Copy service writers may fail with similar errors because of other conditions. These conditions include a lack of disk space or improper configuration of the computer. This hotfix addresses only the specific timeout errors that might randomly occur in Volume Shadow Copy service writers during backup. You are strongly advised to review the event log for any other potential Volume Shadow Copy service errors that might generate a writer failure.
Shadow copy deletion
You may also experience a problem in the Volsnap.sys driver that causes shadow copy deletion when there is a high level of input/output, especially when the disk write cache is disabled (for example, on a domain controller computer).
By default, the shadow copy provider that is included in Microsoft Windows Server 2003 is used to create shadow copies for backup purposes. The shadow copies are implemented by using a copy-on-write implementation. The differences are also copied in the shadow copy storage area. In Volume Shadow Copy service, you can use the shadow copy management tool, or you can use the
vssadmin command.
In the original released version of Windows Server 2003, the initial shadow copy storage area that is allocated for shadow copy creation is 100 megabytes (MB). However, the actual space that is used is much smaller. As time passes, the allocated space may increase as more data is modified on the original volume. However, when you have high input/output traffic on the original volume, the shadow copy storage area cannot grow fast enough to hold all the copy-on-write changes. This causes deletion of all the shadow copies on the original volume. This problem is more noticeable in domain controller configurations. By default, the disk write cache is disabled in domain controller configurations.
Important A similar problem is caused by defragmenting a volume with small cluster size, where all shadow copies are deleted, and where the event log error that is listed earlier in this article is logged.
For additional information about losing shadow copies during a disk defragmentation, click the following article number to view the article in the Microsoft Knowledge Base: 312067 Shadow copies may be lost when you defragment a volume
Also, event error ID 2004 may be logged when there are corrupted NTFS file system volumes. To determine if this is the problem, run the Chkdsk.exe program with the
/f switch.
Large audit log
Writer time-out errors might also appear during a system-state backup if the audit log is extremely large. It is best to back up or to clean the audit log periodically.