Article: Volume Shadow Looms Large


I just found out this new article about VSS in the Microsoft Certified Professional Magazine, containing several interesting comments about VSS usage. Ron Rynbrandt, (who works for the Dr Pepper 7UP Bottling Group) had the following observation:



We use VSS for shared folders, and we love it. I store all of my Citrix user folders and profiles on a server where I use VSS as a restoration tool. It replaces about 95 percent of all restores we perform, and reduces restoration times from 2-3 hours (from tape) to about five minutes. We do restrict usage of VSS restores to just IT people as part of our change control process.


One small caveat: When I first set up VSS, I let it use unlimited space on the drive. This worked okay for a while, until the drive got close to full. Then, when the VSS service ran again, it ran out of disk space and corrupted all VSS images on the drive. This happened a couple times before I set a limit on VSS space to 5 MB less than the capacity of the drive. Now, VSS images are handled in a FIFO order correctly.


And also a similar comment later in the article from Falco Dam, (who works for IT-to-IT, a training and consultancy company in The Netherlands):



You always run the (albeit minimal) risk of overwhelming the Volume Shadow Copy Service, which causes all of your shadow copies to be deleted. This risk can be mitigated by placing the VSC data on a separate spindle of disks, making sure you have enough resources, and installing SP1 which includes KB 833167 as you’ve pointed out. Still, you need to be aware of this risk.


Correct. I would add: You are not likely to hit this issue except on a very high write I/O on large scale deployments. This is a known problem that was addressed for Windows Server 2003 RTM in KB 887827 (which includes both KB 826936 and KB 833167 hotfixes). Also, this fix is already addressed in Windows Server 2003 SP1.


Anyway, please note that, unless you already deployed SP1, the latest VSS hotfix for RTM is now KB 887827 and this includes all changes in all previous VSS hotfixes for Windows Server 2003 RTM (non-SP1), like 833167.


Another set of comments from Falco Dam:


How many shadow copies you can go back, therefore, depends on the activity on the volume. I’ve found it quite difficult to predict up front the number of saved shadow copies you will have available at any one time; you only know when you’ve implemented it.

True – it is difficult to estimate the space needed for VSS, that it depends on the particular I/O pattern that you have on your volume. The most accurate way to estimate this is to let it run for a while, and then see how much space you have for all shadow copies.


Also, as a very general heuristic, you might consider the following rule: the used size of the a certain shadow copy is roughly equal with the amount of changed data since the previous shadow copy. However, I would stress out that this rule might return sometimes a slightly different number than in practice. Just to present a particular exception, “eating” existing free space on the volume is not generally considered “changing data” unless this free space comes from a deleted file that was present at the time of previous shadow copy, etc.



Any backups you make (using NTBackup or any other tool) will only back up the current data. There is no way that the shadow copies themselves can be backed up (none that I know of, anyway). You may want to consider redundancy in the spindle that you use to hold the VSC data.


Unfortunately, this is by design, and you have to rely on a real backup solution to guarantee that your previous “versions” are correctly archived. The upcoming Data Protection Manager will address a very similar scenario.



As for the Previous Versions client, I am always wary to just install it on any workstation. I’d hate to see some clueless user playing with it and restoring a massive folder from a shadow copy with a single click. There’s just no way to undo this damage. My advice is to install the Previous Versions client on administrators’ computers only and perhaps some power users.


Good point. We had lots of customer requests for this feature, and this issue is now addressed by the new KB 888603 hotfix, that allows you to selectively disable either the “Restore” button, or disable the whole “Previous Versions” tab. This setting is controlled through a registry key. Note that you might define a custom Group Policy which changes this registry key therefore allowing certain classes of machines to access and/or perform restore through the Previous Versions tab.


And, in the Comments section, an observation from Simon Lucas:



Is it true that VSS copies files whose only changed attribute is their position on the disk? This is relevant to Defrag or Diskeeper where only the position is changed and can result in large volumes of data being stored by VSS during the initial stages of defragmenting when fragmentation was severe.


This is somewhat true – but it will also preserve changed files (as mentioned above).  In order to avoid the Defrag problem, you need to format your volumes with 16KB cluster size or more. More details about this are presented in KB 312067.


 


P.S. Also, you might want to check out the previous article from Bill Boswell on VSS here.


[update – various minor fixes done]

Comments (2)

  1. Will Lotto says:

    Is there a VSS support forum anywhere, or some information about trying to diagnose problems with VSS before I raise an error to Microsoft Product Support Services.

    I’ve got two DC’s running Windows 2003 SP1.

    The DC which is assigned the PDC role will not backup using VSS. — If I assign the PDC role to the other DC, VSS starts working on the DC that is no longer responsible, and fails on the one which is.

    Symptoms:

    – With this server responsible for PDC:

    C:Documents and Settingsadministrator.CTA>vssadmin list writers

    vssadmin 1.1 – Volume Shadow Copy Service administrative command-line tool

    (C) Copyright 2001 Microsoft Corp.

    C:Documents and Settingsadministrator.CTA>

    This causes 3 errors in the application log:

    Event Type: Error

    Event Source: VSS

    Event Category: None

    Event ID: 12302

    Date: 27/05/2005

    Time: 4:17:47 PM

    User: N/A

    Computer: CTA-SVR4

    Description:

    Volume Shadow Copy Service error: An internal inconsistency was detected in trying to contact shadow copy service writers. Please check to see that the Event Service and Volume Shadow Copy Service are operating properly.

    For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp“>http://go.microsoft.com/fwlink/events.asp“>http://go.microsoft.com/fwlink/events.asp“>http://go.microsoft.com/fwlink/events.asp.

    Data:

    0000: 2d 20 43 6f 64 65 3a 20 – Code:

    0008: 42 55 45 43 58 4d 4c 43 BUECXMLC

    0010: 30 30 30 30 37 32 37 34 00007274

    0018: 2d 20 43 61 6c 6c 3a 20 – Call:

    0020: 42 55 45 43 58 4d 4c 43 BUECXMLC

    0028: 30 30 30 30 37 32 31 39 00007219

    0030: 2d 20 50 49 44 3a 20 20 – PID:

    0038: 30 30 30 30 34 34 38 34 00004484

    0040: 2d 20 54 49 44 3a 20 20 – TID:

    0048: 30 30 30 30 35 34 38 30 00005480

    0050: 2d 20 43 4d 44 3a 20 20 – CMD:

    0058: 76 73 73 61 64 6d 69 6e vssadmin

    0060: 20 6c 69 73 74 20 77 72 list wr

    0068: 69 74 65 72 73 20 20 20 iters

    0070: 2d 20 55 73 65 72 3a 20 – User:

    0078: 43 54 41 5c 61 64 6d 69 CTAadmi

    0080: 6e 69 73 74 72 61 74 6f nistrato

    0088: 72 20 20 20 20 20 20 20 r

    0090: 2d 20 53 69 64 3a 20 20 – Sid:

    0098: 53 2d 31 2d 35 2d 32 31 S-1-5-21

    00a0: 2d 32 36 30 30 37 39 37 -2600797

    00a8: 31 37 30 2d 34 30 36 38 170-4068

    00b0: 37 37 38 31 35 33 2d 37 778153-7

    00b8: 32 38 36 32 34 34 31 32 28624412

    00c0: 2d 35 30 30 20 20 20 20 -500

    Event Type: Error

    Event Source: VSS

    Event Category: None

    Event ID: 12302

    Date: 27/05/2005

    Time: 4:17:47 PM

    User: N/A

    Computer: CTA-SVR4

    Description:

    Volume Shadow Copy Service error: An internal inconsistency was detected in trying to contact shadow copy service writers. Please check to see that the Event Service and Volume Shadow Copy Service are operating properly.

    For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp“>http://go.microsoft.com/fwlink/events.asp“>http://go.microsoft.com/fwlink/events.asp“>http://go.microsoft.com/fwlink/events.asp.

    Data:

    0000: 2d 20 43 6f 64 65 3a 20 – Code:

    0008: 42 55 45 43 58 4d 4c 43 BUECXMLC

    0010: 30 30 30 30 37 32 38 33 00007283

    0018: 2d 20 43 61 6c 6c 3a 20 – Call:

    0020: 42 55 45 43 58 4d 4c 43 BUECXMLC

    0028: 30 30 30 30 37 32 31 39 00007219

    0030: 2d 20 50 49 44 3a 20 20 – PID:

    0038: 30 30 30 30 34 34 38 34 00004484

    0040: 2d 20 54 49 44 3a 20 20 – TID:

    0048: 30 30 30 30 35 34 38 30 00005480

    0050: 2d 20 43 4d 44 3a 20 20 – CMD:

    0058: 76 73 73 61 64 6d 69 6e vssadmin

    0060: 20 6c 69 73 74 20 77 72 list wr

    0068: 69 74 65 72 73 20 20 20 iters

    0070: 2d 20 55 73 65 72 3a 20 – User:

    0078: 43 54 41 5c 61 64 6d 69 CTAadmi

    0080: 6e 69 73 74 72 61 74 6f nistrato

    0088: 72 20 20 20 20 20 20 20 r

    0090: 2d 20 53 69 64 3a 20 20 – Sid:

    0098: 53 2d 31 2d 35 2d 32 31 S-1-5-21

    00a0: 2d 32 36 30 30 37 39 37 -2600797

    00a8: 31 37 30 2d 34 30 36 38 170-4068

    00b0: 37 37 38 31 35 33 2d 37 778153-7

    00b8: 32 38 36 32 34 34 31 32 28624412

    00c0: 2d 35 30 30 20 20 20 20 -500

    Event Type: Error

    Event Source: VSS

    Event Category: None

    Event ID: 12302

    Date: 27/05/2005

    Time: 4:17:47 PM

    User: N/A

    Computer: CTA-SVR4

    Description:

    Volume Shadow Copy Service error: An internal inconsistency was detected in trying to contact shadow copy service writers. Please check to see that the Event Service and Volume Shadow Copy Service are operating properly.

    For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp“>http://go.microsoft.com/fwlink/events.asp“>http://go.microsoft.com/fwlink/events.asp“>http://go.microsoft.com/fwlink/events.asp.

    Data:

    0000: 2d 20 43 6f 64 65 3a 20 – Code:

    0008: 42 55 45 43 58 4d 4c 43 BUECXMLC

    0010: 30 30 30 30 37 32 39 32 00007292

    0018: 2d 20 43 61 6c 6c 3a 20 – Call:

    0020: 42 55 45 43 58 4d 4c 43 BUECXMLC

    0028: 30 30 30 30 37 32 31 39 00007219

    0030: 2d 20 50 49 44 3a 20 20 – PID:

    0038: 30 30 30 30 34 34 38 34 00004484

    0040: 2d 20 54 49 44 3a 20 20 – TID:

    0048: 30 30 30 30 35 34 38 30 00005480

    0050: 2d 20 43 4d 44 3a 20 20 – CMD:

    0058: 76 73 73 61 64 6d 69 6e vssadmin

    0060: 20 6c 69 73 74 20 77 72 list wr

    0068: 69 74 65 72 73 20 20 20 iters

    0070: 2d 20 55 73 65 72 3a 20 – User:

    0078: 43 54 41 5c 61 64 6d 69 CTAadmi

    0080: 6e 69 73 74 72 61 74 6f nistrato

    0088: 72 20 20 20 20 20 20 20 r

    0090: 2d 20 53 69 64 3a 20 20 – Sid:

    0098: 53 2d 31 2d 35 2d 32 31 S-1-5-21

    00a0: 2d 32 36 30 30 37 39 37 -2600797

    00a8: 31 37 30 2d 34 30 36 38 170-4068

    00b0: 37 37 38 31 35 33 2d 37 778153-7

    00b8: 32 38 36 32 34 34 31 32 28624412

    00c0: 2d 35 30 30 20 20 20 20 -500

    If I take ownership of the PDC role with the other DC:

    C:Documents and Settingsadministrator.CTA>vssadmin list writers

    vssadmin 1.1 – Volume Shadow Copy Service administrative command-line tool

    (C) Copyright 2001 Microsoft Corp.

    Writer name: ‘System Writer’

    Writer Id: {e8132975-6f93-4464-a53e-1050253ae220}

    Writer Instance Id: {8bde1e99-8dde-4721-b19a-cc40a8323bf6}

    State: [1] Stable

    Last error: No error

    Writer name: ‘MSDEWriter’

    Writer Id: {f8544ac1-0611-4fa5-b04b-f7ee00b03277}

    Writer Instance Id: {0dfdb1ea-d4a5-4312-9d04-764b482bcfa7}

    State: [1] Stable

    Last error: No error

    Writer name: ‘Microsoft Exchange Writer’

    Writer Id: {76fe1ac4-15f7-4bcd-987e-8e1acb462fb7}

    Writer Instance Id: {48099ce4-4d6d-4a9d-9280-60f3abfa035e}

    State: [1] Stable

    Last error: No error

    Writer name: ‘Registry Writer’

    Writer Id: {afbab4a2-367d-4d15-a586-71dbb18f8485}

    Writer Instance Id: {61565c50-ebf9-4735-8ff9-9a3e98ec5a75}

    State: [1] Stable

    Last error: No error

    Writer name: ‘Event Log Writer’

    Writer Id: {eee8c692-67ed-4250-8d86-390603070d00}

    Writer Instance Id: {25cd8a13-1faf-41cf-9307-077416221c2c}

    State: [1] Stable

    Last error: No error

    Writer name: ‘WMI Writer’

    Writer Id: {a6ad56c2-b509-4e6c-bb19-49d8f43532f0}

    Writer Instance Id: {e8bf893e-0f8d-428f-981e-53c50314eb90}

    State: [1] Stable

    Last error: No error

    Writer name: ‘COM+ REGDB Writer’

    Writer Id: {542da469-d3e1-473c-9f4f-7847f01fc64f}

    Writer Instance Id: {c8e570f2-6f08-45fe-97e6-538cfc4f8169}

    State: [1] Stable

    Last error: No error

    Writer name: ‘IIS Metabase Writer’

    Writer Id: {59b1f0cf-90ef-465f-9609-6ca8b2938366}

    Writer Instance Id: {5daa429d-382d-403b-89a6-65a1d5edad31}

    State: [1] Stable

    Last error: No error

    Writer name: ‘FRS Writer’

    Writer Id: {d76f5a28-3092-4589-ba48-2958fb88ce29}

    Writer Instance Id: {862f4205-3b69-44cc-a36a-cc5e4e76a15d}

    State: [1] Stable

    Last error: No error

    Writer name: ‘NTDS’

    Writer Id: {b2014c9e-8711-4c5c-a5a9-3cf384484757}

    Writer Instance Id: {5745ee4e-04bd-4fe6-a6c7-c40b63c501e4}

    State: [1] Stable

    Last error: No error

    I think this is probably going to have to go to PSS, but I’d rather try to resolve it myself first… Does anybody have any suggestions?

  2. AdiOltean says:

    Unfortunately I am not aware about this issue.

    I think the best way to investigate it (without guesswork or anything that might put you on the wrong path) would be to contact Microsoft PSS.