Below is a table that describes the flow of events in a backup, as captured in the Windows Events application log.
Windows event IDs |
Event fields used in Unitrends agent entries |
---|---|
Source: |
Unitrends Agent |
Task Category: |
Backup, Restore, Bare Metal, Verify |
Level: |
Information or Warning or Error |
Event ID: |
Event IDs begin with 256 and increase |
Computer: |
Server name |
Description: |
Contains information specific to the Event ID. Each entry has the string (id # # #), where the ID number is the ID of the running process. If multiple jobs are running concurrently, events with the same ID can be viewed for a particular job. |
Task category and message indicate the operation. The description field contains the type of operation that has started.
Typical starting event flow for a backup:
Event ID |
Category |
Level |
Keywords |
Description Field |
256 |
Backup |
Information |
Classic |
(id 5396) MASTER started.Version 6.0.0 |
Related VSS events are seen before and after the Unitrends events are logged. Any failures that occur while issuing these VSS events are logged as errors. Some details are added to the event description for that failure. In the case of errors, some diagnostics can be run from the command line to insure that the VSS subsystem is functioning. Use the ‘VssAdmin’ commands:
Vssadmin list writers
Vssadmin list providers
Vssadmin list volumes
If any of these commands fail or return no information, then the VSS subsystem is not functioning. A reboot helps in most cases.
VSS events are described here:
Event ID |
Category |
Level |
Keywords |
Description Field |
275 |
Backup |
Information |
Classic |
(id 5396) Agent successfully issued VSS event GatherWriterMetaData |
275 |
Backup |
Information |
Classic |
(id 5396) Agent successfully issued VSS event InitializeForBackup |
275 |
Backup |
Information |
Classic |
(id 5396) Agent successfully issued VSS event PrepareForBackup |
When creating a snapshot, the agent adds the requested volumes to that snapshot and for each volume added the following event is logged.
If a failure occurs while adding a volume to the snapshot event 279 is logged. Included are some details of the error. Typically, failures occur when attempting to add non-NTFS volumes or network attached volumes to a snapshot set. In some cases, network attached volumes require a hardware-specific VSS provider to be installed before they can be added to VSS snapshots. If this error occurs, the agent attempts the backup without using the VSS snapshot. This could result in files not being backed up due to file in use errors.
VSS add volume events are described here:
Event ID |
Category |
Level |
Keywords |
Description Field |
278 |
Backup |
Information |
|
(id 1476) Added volume C:\ to the snapshot set. |
279 |
Backup |
Error |
|
(id 1476) Failed to add volume C:\ to the snapshot set. |
The system state begins event indicates the exact point in the process that this starts. The system state ending event is seen later, and any errors found in between. System state duration can be determined with these two events.
Event ID |
Category |
Level |
Keywords |
Description Field |
272 |
Backup |
Information |
Classic |
(id 5396) Agent beginning System state backup. |
A volume snapshot operation concludes with one of two events. The successful DoSnapshotSet event indicates that the volume snapshot has completed OK. A failure is logged as an Error category event with some details in the description. If the snapshot operation fails, the following error event is logged. Added to this message is some extra detail about the error. There are many possible causes for this failure. Some of the errors are related to poor disk performance causing the VSS subsystem to give up while waiting for the snapshot to complete. In these cases, the Windows OS usually logs other warnings or errors before and/or after this entry.
Do snapshot events are described here:
Event ID |
Category |
Level |
Keywords |
Description Field |
275 |
Backup |
Information |
Classic |
(id 5396) Agent successfully issued VSS event DoSnapshotSet |
276 |
Backup |
Error |
Classic |
(id 5396) Agent failed to issue VSS event DoSnapshotSet |
For master, differential, and incremental backups, the agent performs a system state backup. When that completes, an information or error event is logged. There are many error cases during system state backup, especially when running on Windows domain controllers. If system state failures persist then more detailed information is logged in the Unitrends agent log files.
System state events are described here:
Event ID |
Category |
Level |
Keywords |
Description Field |
274 |
Backup |
Information |
Classic |
(id 5396) Agent system state backup was successful. |
273 |
Backup |
Error |
Classic |
(id 5396) Agent system state backup failed. |
At the end of the backup, the session completion event is entered. If the summary was sent okay, then the following event appears. A failure to send the summary results in an error event being entered. The success event shows how many files were backed up and how many were skipped due to an error or an in-use condition.
The session complete event is described here:
Event ID |
Category |
Level |
Keywords |
Description Field |
262 |
Backup |
Information |
Classic |
(id 5396) Session completes. Summary sent OK. 655 files Processor OK. 0 incomplet6e. |
If a failure occurs while sending the backup summary to the Unitrends system, the following event is logged. This is usually caused by a network connection disruption between the Unitrends agent and the backup system.
The failed to send summary event is described here:
Event ID |
Category |
Level |
Keywords |
Description Field |
263 |
Backup |
Error |
Classic |
(id 5396) Session completes. Failed to send summary. |
For application backups (Exchange or SQL), the agent concludes the session by issuing a VSS BackupComplete event with a success or fail condition. For successful backups, this event indicates to the appropriate VSS writer that any cleanup processing may be done, like transaction log truncation. A failure condition causes this event to log as an Error category and the description indicates the error.
There are many possible causes of an application backup failure, some of which are described in the preceding events. Any error during an application backup causes the agent to issue the BackupComplete failure event.
Backup complete events are described here:
Event ID |
Category |
Level |
Keywords |
Description Field |
264 |
Backup |
Information |
Classic |
(id 4720) Backup completes. Issued VSS BackupComplete event - success. |
265 |
Backup |
Error |
Classic |
(id 4720) Backup completes. Issued VSS BackupComplete event - failure. |