none
Corrupted Files after Event ID 35 Source: volsnap Aborted because the shadow copy storage failed to grow.

    Question

  • I have a 2008 R2 server that "all of a sudden" stopped opening approx. 1 in 3 files with error messages that extension could be wrong or file corrupt.  Approx. the same time as this behavior started I see event in System Log: Event ID 35 Source: volsnap, The shadow copies of volume D: were aborted because the shadow copy storage failed to grow.  The volume was out of space.  Not long after space became available again, not as a result of user action but presumably OS action.

    Any ideas how to fix this corruption?

    Thank you!

     

    Bob Herman IT Tropolis

    Thursday, October 03, 2013 2:32 AM

Answers

  • Hi,

    Hi,

    Please refer to this article about the Event 35:

    http://www.microsoft.com/technet/support/ee/transform.aspx?ProdName=Windows+Operating+System&ProdVer=5.2.3790.1830&EvtID=35&EvtSrc=VolSnap&LCID=1033%20:%20Event%20ID%2035

    As it mentioned, please try the following steps one by one to see the result:

    Using chkdsk /r, check for errors on the volume where the Diff Area is stored and on the original volume,.
    Check the system log in Event Viewer for errors associated with the volume where the Diff Area is stored or with the original volume.
    Check for hardware errors on the disks that contain the volume where the Diff Area is stored and on the original volume.
    Move the Diff Area to a different, dedicated volume.
    Move the Diff Area to a larger volume.
    Allocate more storage space for the Diff Area.
    Increase the Diff Area initial size and growth rate by changing the MinDiffArea registry key.

    Note: you could use vssadmin to move Diff area


    TechNet Subscriber Support in forum |If you have any feedback on our support, please contact tnmff@microsoft.com.

    Friday, October 04, 2013 2:12 PM
    Moderator

All replies

  • Hi,

    Hi,

    Please refer to this article about the Event 35:

    http://www.microsoft.com/technet/support/ee/transform.aspx?ProdName=Windows+Operating+System&ProdVer=5.2.3790.1830&EvtID=35&EvtSrc=VolSnap&LCID=1033%20:%20Event%20ID%2035

    As it mentioned, please try the following steps one by one to see the result:

    Using chkdsk /r, check for errors on the volume where the Diff Area is stored and on the original volume,.
    Check the system log in Event Viewer for errors associated with the volume where the Diff Area is stored or with the original volume.
    Check for hardware errors on the disks that contain the volume where the Diff Area is stored and on the original volume.
    Move the Diff Area to a different, dedicated volume.
    Move the Diff Area to a larger volume.
    Allocate more storage space for the Diff Area.
    Increase the Diff Area initial size and growth rate by changing the MinDiffArea registry key.

    Note: you could use vssadmin to move Diff area


    TechNet Subscriber Support in forum |If you have any feedback on our support, please contact tnmff@microsoft.com.

    Friday, October 04, 2013 2:12 PM
    Moderator
  • How are things going? Please let us know if there is any progress.

    TechNet Subscriber Support in forum |If you have any feedback on our support, please contact tnmff@microsoft.com.

    Tuesday, October 08, 2013 8:17 AM
    Moderator
  • Hi Sharon:

    Thanks so much for your input.  Note that only one sub-directory on the volume was affected, which happens to be a share that is accessible by, and mapped upon logon, for all domain authenticated users.  Other sub-directories on the same volume were not affected.  Thus, if diff area not having enough space was the cause would only one sub-directory on the volume be affected?  I think it's possible that a client machine was compromised that attacked shares, possibly something related to the crypto locker / encryption ransomware presently propagating.

    In any event, we were able to recover the files from the vhd file of a previous backup.  Since we're not using file snapshots I guess the only time vss runs is when the Windows Backup runs, sound right?  We've ordered larger disks and will migrate this Win. instance/VM to the new datastore wherein the volume will have plenty of free space.

    Thank you.



    Bob Herman IT Tropolis

    Monday, October 21, 2013 3:41 PM