Troubleshooting Windows event IDs

Below is a table that describes the flow of events in a backup, as captured in the Windows Events application log.

Windows event IDs

Event fields used in Unitrends agent entries

Source:

Unitrends Agent

Task Category:

Backup, Restore, Bare Metal, Verify

Level:

Information or Warning or Error

Event ID:

Event IDs begin with 256 and increase

Computer:

Server name

Description:

Contains information specific to the Event ID. Each entry has the string (id # # #), where the ID number is the ID of the running process. If multiple jobs are running concurrently, events with the same ID can be viewed for a particular job.

Starting event

Task category and message indicate the operation. The description field contains the type of operation that has started.

Typical starting event flow for a backup:

Event ID

Category

Level

Keywords

Description Field   

256

Backup

Information

Classic

(id 5396) MASTER started.Version 6.0.0

VSS events leading up to execution of a volume snapshot

Related VSS events are seen before and after the Unitrends events are logged. Any failures that occur while issuing these VSS events are logged as errors. Some details are added to the event description for that failure. In the case of errors, some diagnostics can be run from the command line to insure that the VSS subsystem is functioning. Use the ‘VssAdmin’ commands:

Vssadmin list writers

Vssadmin list providers

Vssadmin list volumes

If any of these commands fail or return no information, then the VSS subsystem is not functioning. A reboot helps in most cases.

VSS events are described here:

Event ID

Category

Level

Keywords

Description Field   

275

Backup

Information

Classic

(id 5396) Agent successfully issued VSS event GatherWriterMetaData

275

Backup

Information

Classic

(id 5396) Agent successfully issued VSS event InitializeForBackup

275

Backup

Information

Classic

(id 5396) Agent successfully issued VSS event PrepareForBackup

When creating a snapshot, the agent adds the requested volumes to that snapshot and for each volume added the following event is logged.

If a failure occurs while adding a volume to the snapshot event 279 is logged. Included are some details of the error. Typically, failures occur when attempting to add non-NTFS volumes or network attached volumes to a snapshot set. In some cases, network attached volumes require a hardware-specific VSS provider to be installed before they can be added to VSS snapshots. If this error occurs, the agent attempts the backup without using the VSS snapshot. This could result in files not being backed up due to file in use errors.

VSS add volume events are described here:

Event ID

Category

Level

Keywords

Description Field   

278

Backup

Information

 

(id 1476) Added volume C:\ to the snapshot set.

279

Backup

Error

 

(id 1476) Failed to add volume C:\ to the snapshot set.

The system state begins event indicates the exact point in the process that this starts. The system state ending event is seen later, and any errors found in between. System state duration can be determined with these two events.

Event ID

Category

Level

Keywords

Description Field   

272

Backup

Information

Classic

(id 5396) Agent beginning System state backup.

A volume snapshot operation concludes with one of two events. The successful DoSnapshotSet event indicates that the volume snapshot has completed OK. A failure is logged as an Error category event with some details in the description. If the snapshot operation fails, the following error event is logged. Added to this message is some extra detail about the error. There are many possible causes for this failure. Some of the errors are related to poor disk performance causing the VSS subsystem to give up while waiting for the snapshot to complete. In these cases, the Windows OS usually logs other warnings or errors before and/or after this entry.

Do snapshot events are described here:

Event ID

Category

Level

Keywords

Description Field   

275

Backup

Information

Classic

(id 5396) Agent successfully issued VSS event DoSnapshotSet

276

Backup

Error

Classic

(id 5396) Agent failed to issue VSS event DoSnapshotSet

For master, differential, and incremental backups, the agent performs a system state backup. When that completes, an information or error event is logged. There are many error cases during system state backup, especially when running on Windows domain controllers. If system state failures persist then more detailed information is logged in the Unitrends agent log files.

System state events are described here:

Event ID

Category

Level

Keywords

Description Field   

274

Backup

Information

Classic

(id 5396) Agent system state backup was successful.

273

Backup

Error

Classic

(id 5396) Agent system state backup failed.

At the end of the backup, the session completion event is entered. If the summary was sent okay, then the following event appears. A failure to send the summary results in an error event being entered. The success event shows how many files were backed up and how many were skipped due to an error or an in-use condition.

The session complete event is described here:

Event ID

Category

Level

Keywords

Description Field   

262

Backup

Information

Classic

(id 5396) Session completes. Summary sent OK. 655 files Processor OK. 0 incomplet6e.

If a failure occurs while sending the backup summary to the Unitrends system, the following event is logged. This is usually caused by a network connection disruption between the Unitrends agent and the backup system.

The failed to send summary event is described here:

Event ID

Category

Level

Keywords

Description Field   

263

Backup

Error

Classic

(id 5396) Session completes. Failed to send summary.

For application backups (Exchange or SQL), the agent concludes the session by issuing a VSS BackupComplete event with a success or fail condition. For successful backups, this event indicates to the appropriate VSS writer that any cleanup processing may be done, like transaction log truncation. A failure condition causes this event to log as an Error category and the description indicates the error.

There are many possible causes of an application backup failure, some of which are described in the preceding events. Any error during an application backup causes the agent to issue the BackupComplete failure event.

Backup complete events are described here:

Event ID

Category

Level

Keywords

Description Field   

264

Backup

Information

Classic

(id 4720) Backup completes. Issued VSS BackupComplete event - success.

265

Backup

Error

Classic

(id 4720) Backup completes. Issued VSS BackupComplete event - failure.