If you are receiving a volsnap event ID error on Windows 11 or Windows 10, then this post will help you resolve the problem. The list of event id includes 36, 8, 25, 9, 33, 1, 24, 35, 28, 23, 14, 16, etc in Windows 11/10 Event Viewer. Before you begin, ensure you have an administrator account.
What is Volsnap?
Volsnap or Volsnap.sys or Volume Snapshot is a Windows system file that is related to the Volume Shadow Copy service (VSS). Technically it’s a Windows driver file that helps the OS use the Volume Shadow Copy and has access to core files, hardware, etc. VSS is activated whenever there is a backup restore operation, data mining, disk-to-disk backups, etc.
Here is the list of event IDs followed by reason and solutions.
- volsnap Event ID 1
- volsnap Event ID 8
- volsnap Event ID 9
- volsnap Event ID 14 & Event ID 16
- volsnap Event ID 23
- volsnap Event ID 24 & 35
- volsnap Event ID 25
- volsnap Event ID 28
- volsnap Event ID 33
- volsnap Event ID 36
You will need an admin account to execute the suggested steps.
1] volsnap Event ID 1
VSS creates a buffer area called DIff Area which is used to temporarily write files when the data is moved. This buffer is dynamic and VSS can increase when required. However, when the shadow copy of volume could not create a different area file on volume, you get volsnap Event ID 1 in the logs.
The only solution is to move the Diff Area to a different volume. You can configure the Diff Area so that it is stored on a different volume and ensure it is in NTFS format. Ensure to choose to specify No Limit or at least 15% of the drive’s size or another drive.
Note: When the location of the Diff area is changed, all previous shadow copies are deleted
To configure the shadow copies or the Diff area, you need to go to My Computer > Manage > Right-click on any volume and select Configure Shadow Copies. You can set the diff area to a different volume by selecting a volume from the drop-down list under the Storage area, and then save the changes. Check out the official document for complete details.
2] volsnap Event ID 8
It is related to Volume Snapshot Driver Integrity. If the process times out during the process, and the next one begins, it will result in this error. To resolve this, you need to schedule shadow copies for a different time. So if VSS reattempts, it has enough time to complete it.
3] volsnap Event ID 9
It occurs when the VSS driver doesn’t have enough resources to perform operations. It can be because of low memory or CPU or high disk I/O load.
To resolve this, find out what is taking all the resources, and remove them. You can also choose to run VSS at off-timings and ensure that Diff Area is allocated to a dedicated volume instead of on the same disk.
4] volsnap Event ID 16 & Event ID 14
Event ID 16 occurs when the storage which stores VSS is forced dismounted. In the case of Event ID 14, the operation is aborted because of an IO failure.
There is no direct solution, but since these are disk errors, admins can further look into the disk or NTFS events to find what is causing the failure. If needed, the disk can be replaced.
5] volsnap Event ID 23
This is another case where there was insufficient disk space on the volume to create the shadow copy of the volume. The only way out is to move the Diff Area to a volume with more storage capacity or dedicate an NTFS volume to it.
6] volsnap Event ID 24 & volsnap Event ID 35
The event is triggered when there is insufficient disk space on the VSS volume. If the shadow copy is unable to grow, then this will abort the operation as it can further lead to the deletion of older copies. The solution is the same as others that you need to increase the space of VSS and Diff area. Once done, run the backup again.
7] volsnap Event ID 25
It’s triggered when the load on the IO is very high or the shadow copy storage is being copied. In simple words when there is a backup going on, and another backup gets triggered trying to backup the backup, this increases the load and results in failure.
Since the IO load is high IT admins need to formulate a strategy where the backup schedules are spanned across the time to ensure there is no clash. According to Microsoft, you can run the following commands on the host machine to place the shadow copy on another disk:
vssadmin add shadowstorage /For=<driveletter> /On=<destinationdriveletter> /MaxSize=UNBOUNDED vssadmin resize shadowstorage /For=<driveletter> /On=<destinationdriveletter> /MaxSize=UNBOUNDED
Make sure to increase the amount of RAM and resources.
8] volsnap Event ID 28
It occurs because of a problem with non-paged pool allocation. There is a hotfix available from Microsoft. Make sure to apply it.
9] volsnap Event ID 33
This is logged when the process removes the oldest shadow copy of volume to keep disk space usage for shadow copies of a volume. It works according to the user-defined limit.
To resolve the problem you can either increase the space allocated for VSS or allocate a separate volume so the backup doesn’t run out of space.
9] volsnap Event ID 36
When the VSS is not able to grow the shadow copy storage because of the applied limit, it triggers the error. To resolve this error you can run the following commands to expand the ShadowStorage; drive letters need to be changed accordingly:
Most of the volsnap Event IDs are related to storage space, overlapping backup, and low resources.
How do I turn off Volsnap?
You need to disable or turn off the Volume Shadow Service. However, this will affect some related services such as System Restore and Backup services. On a service, do not allocate any space for VSS and you are through.
Where did volsnap shadow copies disappear?
In case you are missing the older copies, it means, they have been removed and new copies have been placed. It usually happens when space allotted to VSS is limited, and the process needs to create space. Similar to any backup process, it will delete the oldest copy.
На сервере Windows Server 2012, работающего как файловый сервер, в журнале событий иногда возникает ошибка.
Источник: volsnap
ID: 25
Не удается найти описание для идентификатора события 25 из источника volsnap. Вызывающий данное событие компонент не установлен на этом локальном компьютере или поврежден. Установите или восстановите компонент на локальном
компьютере.
Если событие возникло на другом компьютере, возможно, потребуется сохранить отображаемые сведения вместе с событием.
К событию были добавлены следующие сведения:
DeviceHarddiskVolumeShadowCopy150
S:
Загрузчику ресурсов не удалось найти файл MUI
Что это за проблема?
- Ahmir
- Comments Off on How do I fix Volsnap error?
- November 5, 2022
How do I fix Volsnap error?
volsnap Event ID 25 The shadow copies shadow copies Shadow Copy (also known as Volume Snapshot Service, Volume Shadow Copy Service or VSS) is a technology included in Microsoft Windows that can create backup copies or snapshots of computer files or volumes, even when they are in use. It is implemented as a Windows service called the Volume Shadow Copy service. https://en.wikipedia.org › wiki › Shadow_Copy Shadow Copy – Wikipedia of volume D: were deleted because the shadow copy storage could not grow in time. Consider reducing the IO load on the system or choose a shadow copy storage volume that is not being shadow copied.
Error Message: volsnap Event ID 25 The shadow copies of volume D: were deleted because the shadow copy storage could not grow in time. Consider reducing the IO load on the system or choose a shadow copy storage volume that is not being shadow copied.
volsnap Event ID 25 The shadow copies shadow copies Shadow Copy (also known as Volume Snapshot Service, Volume Shadow Copy Service or VSS) is a technology included in Microsoft Windows that can create backup copies or snapshots of computer files or volumes, even when they are in use. It is implemented as a Windows service called the Volume Shadow Copy service. https://en.wikipedia.org › wiki › Shadow_Copy Shadow Copy – Wikipedia of volume D: were deleted because the shadow copy storage could not grow in time. Consider reducing the IO load on the system or choose a shadow copy storage volume that is not being shadow copied.
Error Message: volsnap Event ID 25 The shadow copies of volume D: were deleted because the shadow copy storage could not grow in time. Consider reducing the IO load on the system or choose a shadow copy storage volume that is not being shadow copied.
Error Message: volsnap Event ID 25 The shadow copies of volume D: were deleted because the shadow copy storage could not grow in time. Consider reducing the IO load on the system or choose a shadow copy storage volume that is not being shadow copied.
Updated June 2023: Stop error messages and fix your computer problem with this tool. Get it now at this link
- Download and install the software.
- It will scan your computer for problems.
- The tool will then fix the issues that were found.
What is Event ID 25?
Event ID – 25.
The event viewer error should give more information. This could be an error in the management console or network configuration, an unauthorized host server, an attack attempt, or a computer security attack. Make sure the network adapter is plugged in, turned on, working, and working properly.
What Volsnap 33?
Event ID – 33.
This message usually means that the disk space allocated for shadow copies is full. Sometimes we see failed backups when this happens. To avoid this, the public can increase the space reserved for shadow copies. 2.
So, in order to fix the volsnap.sys Windows 10 error, the client can update the drivers. Now here is the tutorial. Press the Windows key and the R key at the same time to open the Run dialog, then type devmgmt.msc in the box and click OK to continue. In the Device Manager window, expand Remote IDE ATA/ATAPI Devices and Storage Controllers.
Volsnap error 25 occurs right at the time. Then after a few 1/2 minutes no action is taken to fix the volsnap 27s error. There is also no activity in other Windows event logs. Disk activity may be constant during some of those 1/2 minutes if only 2 volsnaps are stored on the disk.
volsnap.sys should be a system file located in your system volume C:WindowsSystem32drivers of the amazing windows device. This file is the podium provider for a feature called Volume Shadow Copy Service (VSS). VSS is responsible for backup management, data mining and subsequent recovery.
How to fix Volsnap. system error
- Disconnect external devices.
- Repair the Windows operating system containing Reimage.
- Run System File Checker.
- Update the driver here.
- Install the latest updates.
What is a Volsnap error?
Error events from the Volsnap source are listed in this dedicated Windows system event log. Essentially, these events contain information needed for troubleshooting, such as why the shadow copy started to unmount and therefore caused some backups to fail.
What is Volsnap error?
The Volsnap source consists of the error events listed in the Windows system event log. These events usually contain information related to troubleshooting, why the shadow copy was unmounted, and what is causing the backup to fail.
What Volsnap Windows 10?
sys is considered to be the contents of the Windows operating system associated with the Volume Shadow Copy Service (VSS). This image is known to cause a blue screen error. However, major utility conflicts include RAM or hard drive issues, incompatible firmware, corrupted truckers or malware infection, etc.
How do I turn off Volsnap?
Method 4: Stop the volume shadow service
- Of course, boot into Safe Mode.
- In Safe Mode, press the Windows key and expand Services. Press Enter.
- Scroll down the number of services to find Volume Shadow Copy, right-click it and select Stop.
What failed volsnap sys?
sys is a working Windows application file associated with the new Volume Shadow Copy Service (VSS). This file is known to have a blue screen error. But the main reasons are conflicts such as RAM or hard drive problems, incompatible firmware, corrupted drivers or malware infection, etc.
Updated: June 2023
Are you grappling with persistent PC problems? We have a solution for you. Introducing our all-in-one Windows utility software designed to diagnose and address various computer issues. This software not only helps you rectify existing problems but also safeguards your system from potential threats such as malware and hardware failures, while significantly enhancing the overall performance of your device.
- Step 1 : Install PC Repair & Optimizer Tool (Windows 10, 8, 7, XP, Vista).
- Step 2 : Click Start Scan to find out what issues are causing PC problems.
- Step 3 : Click on Repair All to correct all issues.
What does Volsnap sys do?
Volsnap. sys is a pop-up window that allows your computer to interact with the operator or operators connected to the equipment. In other words, a person has direct access to internal elements related to the operating system, hardware, etc.
How do I fix Volsnap error?
How to fix Volsnap. system error
- Disconnect external devices.
- Repair Windows using Reimage.
- Run System File Checker.
- Update existing drivers.
- li >
- Install the latest updates.
What is a Volsnap error?
Volsnap’s source is error events, which are no doubt listed in the Windows system performance log. Such events usually contain the latest bug fixes as information about why most of the shadow copies were unmounted and caused the backup to fail.
What is Volsnap error?
Volsnap location errors are events identified in the Windows Check System log. Such events usually contain important troubleshooting information about why the dark copy was not deployed and cause the backup to fail, which is a significant result.
What Volsnap Windows 10?
sys is the best Windows operating system file that comes with the Snapshot Volume Copy Service (VSS). This file is a known end result of a blue screen error. However, the root causes include conflicts like RAM or hard drive issues, firmware incompatibility, corrupted drivers, malware or crashes, etc.
How do I turn off Volsnap?
Method 4: Stop the volume shadow service
- Boot your valuable system in safe mode.
- In safe mode, press the Windows key and press Enter.
- Scroll down to view services. Find and right click. Volume Shadow Copy, then Stop.
What failed volsnap sys?
sys is the Windows operating system associated with the Volume Shadow Copy Service (VSS) file. This file is known to cause a blue screen error. However, these root causes include conflicts such as RAM or hard drive problems, incompatible firmware, corrupted drivers, malware or infection, etc.
What does Volsnap sys do?
Volsnap. sys is definitely a Windows driver that allows the entire computer to communicate with the appropriate component or drivers. This means that the driver has direct access to the internals of the running product, hardware, etc.
RECOMMENATION: Click here for help with Windows errors.
I’m Ahmir, a freelance writer and editor who specializes in technology and business. My work has been featured on many of the most popular tech blogs and websites for more than 10 years. Efficient-soft.com is where I regularly contribute to my writings about the latest tech trends. Apart from my writing, I am also a certified project manager professional (PMP).
Shadow copies are great for reverting to older files without the user having to resort to backups. We also configured various systems with active shadow copies and with one system we had to find the following error again and again.
Error
Source: Volsnap
Event ID: 25
Error description : The shadow copies of volume “D:” were deleted because the shadow copy memory was not increased in time. You should reduce the I / O load on the system or choose a shadow copy storage volume that will not be shadow copied.
Below we have shown you the original error message directly from the Windows event log “eventvwr.msc” .
We identified the problems beforehand, because for some unknown reason only the last automatically created shadow copy was kept. All shadow copies from before the last creation were automatically deleted again and again, although according to the shadow copy setup the storage space would be sufficient.
We also cannot understand the argument of the error message that the I / O load is too high and cannot be the cause of the problem.
Ultimately, we got the error under control by doing the following. We have illustrated all steps here.
First of all, we had the shadow copy storage area setting displayed. It just works with the command
vssadmin list shadowstorage
The used, the currently assigned and the maximum shadow copy storage area is then displayed. It was currently relatively small at just under 37GB, and 2.2TB were still free on the whole.
We then changed the maximum size of the shadow copy area again to the maximum value. You can do this with the following command.
vssadmin resize shadowstorage / for: LAUFWERK / on: LAUFWERK / MaxSize = UNBOUNDED
About the parameters MaxSize your different values can specify. The value ” unbounded ” indicates that the entire free space of the partition can also be used for shadow copies. You can also provide information in MB, GB or TB or enter a percentage . This is explained relatively well in the help and you can read this relatively well in the picture above.
After setting this setting, we had no problems creating and saving multiple shadow copies, and event ID 25 no longer occurred.
Below you will find further articles in which we also went into the Windows event log and also event ID error codes .
– Edit the Windows event log using the command line tool “wevtutil”
– Activate event logging when shutting down Windows 10 (registry)
– Windows Event ID 100 in the event log
– The time service is no longer announced as a time source … Event ID 142
– Hyper-V MAC conflict Event ID 16945 (MsLbfoSysEvtProvider)
– WHEA Logger – Event ID 47
– Crypt32 – Event ID 8 – Explanation and error
correction – 0xC004F057 Event ID: 1058 – Error when installing the proof of purchase
– Citrix Event ID 9017 in the event log of a XenApp server
– Task
planning Event ID identifier Error 101 – Event log (Eventlog) Quickly delete entries using Powershell
– Error “The server was not able to remove swapped pool memory …” ID 2020
null
Расскажу об одной интересной печальной истории, кому-то, возможно, поучительной, повлекших потерю данных dataloss при использовании двусторонней репликации DFSR и использованием теневых копий (Shadow Copy) файловой системы вместо полноценного резервного копирования.
Предистория:
Было у заказчика две площадки с настроенной двусторонней репликацией DFSR файлового сервиса (объем данных, к слову, около 10 ТБ). Вторая площадка была как бы резервной и мало кто из пользователей подключался к DFS шаре на неё. В качестве резервного копирования заказчик использовал теневые снимки файловой системы (Volume shadow Copie).
Как и положено в лучших традициях печальных историй, события операционной системы никто не смотрел и деятельность по проактивной диагностики не проводилась.
Описание проблемы
В один пятничный день у заказчика появилась проблема «массового случайного пропадания файлов на файловом сервисе«.
Загрузка дискового ввода-вывода систем была 100%, процесс — DFSR.
В EventLogs — в глаза попалась volsnap 25
volsnap 25 Ошибка Теневые копии тома D: удалены из-за невозможности увеличения хранилища теневых копий. Уменьшите загрузку ввода-вывода для системы или выберите другой том для хранилища теневых копий, который не подлежит теневому копированию.
Так же множественные события
DFSR 4304 Предупреждение "Службе репликации DFS несколько раз подряд не удалось реплицировать файл из-за постоянных нарушений общего доступа к файлу. Службе не удалось подготовить файл к репликации из-за нарушения общего доступа. "
Репликация не завершалась успешно последнии два с половиной месяца, так что данные на обоих системах оказались неконсистентными.
Если Вы читаете эту статью найдя её по ошибке volsnap 25 в надежде получения решения по восстановлению утерянных Вами теневых копий, — смиритесь и забудьте: ввиду принципов работы NTFS теневые копии утеряны безвозвратно!
Действия:
- Первым делом мы остановили репликацию: сначала убив процесс, после остановив репликацию.
- Установили права только на чтение на уровне сетевой шары в менее поврежденный и содержащий более старые копии данных (репликация не завершалась успешно последние два с половиной месяца) узел файловой шары на второй площадке. Туда направили пользователей и продолжили разбираться с проблемой вместе с заказчиком.
- Произвели Checkdisk, на предмет устранения ошибок файловой системы.
- Нагрузка спала и мы заглянули в файл конфликтов и свойства DFS, размер для конфликтов был равен по умолчанию всего четырём гигабайтам (на 10 ТБ данных), в итоге средствами Restore-DfsrPreservedFiles восстановили 3209 крайних файла, перемещенных DFSR как конфликтные в соответствующий каталог.
Описание
Из текста выше уважаемый читатель уже понял, что у нашего уважаемого заказчика случился dataloss.
На продуктивной системе файлового сервера возникали незначительные ошибки файловой системы, которые не отражались на производительности или стабильности работы файлового сервиса
С течением времени количество ошибок увеличивалось,и к моменту X достигло большого количества. Клиенты автоматически переключились на вторую площадку, где абсолютно прозрачно продолжили работу, а репликация со стороны площадки 1 продолжилась. Поврежденная файловая система препятствовала репликации рабочих файлов обратно в копию на основной площадке.Конечный объект папки на второй площадке была помечен как недоступный, автоматически получил меньший приоритет по сравнению с копией в офисе. Клиенты переключились на копию на первую площадку, обнаружили проблему
Одновременно сервер на второй площадке начал синхронизировать повреждения с копией на первой площадке, при этом файлы, отсутствующие в копии первой площадки, оказались мгновенно удалены и на второй площадке.
В этот момент система репликации данных DFSR активно реплицировала поврежденные объекты файловой системы на вторую площадку и обратно, тем самым предельно увеличив нагрузку на систему ввода вывода и породила циклическую перезапись файлов между площадками. Увеличенная нагрузка и проблемы на уровне файловой системы привели к неработоспособности существующих резервных копий данных файлового сервиса осуществляющихся средствами механизма теневых копий.
Таким образом ошибки на файловой системе увеличивались в следствии работы механизма репликации испорченных данных. Причина инцидента и проблемы — технический сбой на файловой системе и разрушительные последствия работы механизма репликации DFSR с испорченными объектами файловой системы.
Говоря короче:
Случился corrupt file system и DFSR в конфигурации двусторонней репликации начала циклически перезаписывать файлы на файловой системе на обоих узлах с учетом отсутствия консистентной копии данных на каждом из узлов.
Контрмеры или что нужно чтобы так не случилось у Вас
- Во первых любая технология требует перед внедрением качественного проработанного подхода к её реализации. DFS и DFSR нужно использовать с умом. В частности обратить внимание на необходимую топологию репликации (избегая по возможности двусторонней репликации), а так же на параметры «Квота на папку конфликтов и удалений» и «Промежуточное хранение». В случае с холодным резервом (односторонняя репликация), если возникнут продолжительные неполадки на узле с основной копией данных (доступной на чтение и запись) нужно предусмотреть сценарий(план действий) для ИТ-оператора включающий:
- разрешение на запись на резервном узле
- запрет на запись на основном узле
- переключить репликацию в обратную сторону
- не разрешать запись на основном узле пока репликация не завершится
- По поводу volsnap 25, microsoft приводит полезную рекомендацию, актуальную еще со времен 2003 виндовс:
-
If the file system's cluster size is 16 KB or larger, the provider can recognize disk defragmentation I/O and handle it correctly. Microsoft recommends that you use a 16-KB or larger cluster allocation unit size when you format the volume if you plan to defragment volumes that are used for shadow copies of shared folders.
- Нужно помнить основные принципы в построении резервного копирования, в частности, держать резервные копии на тех же самых носителях информации, а тем более файловых системах, не есть хорошая идея. Выполнять дополнительно резервное копирование данных на регулярной основе иным чем средством резервного копирования восстановления на иную систему хранения данных.
- Превентивно производить плановые операции проверки состояния файловой системы (Checkdisk) на файловом сервисе
- Превентивно производить проактивный мониторинг событий и проверку наличия теневых резервных копий.