none
VSS Event ID 8193 & 32

    Question

  • A customer a domain member running running Server 2008, SP1 and SQL Server 2008.  running 64-bit, with 3 GB.  This is a virtual machine on a core installation.  Beginning about 5:40 a.m. today VSS Event ID 32 is created followed immediately by VSS Event ID 8193.  This has occurred about every 4 hours since.

    Text of Event ID 32 is:

    Volume Shadow Copy Service error: The VSS Coordinator class is not registered.  This may be caused due to a setup failure or as a result of an application's installer or uninstaller.

    Operation:
       Instantiating VSS server

    Text of Event ID 8193 is:

    Volume Shadow Copy Service error: Unexpected error calling routine CoCreateInstance.  hr = 0x80040154.

    Operation:
       Instantiating VSS server

    There does not appear to be a correlation with other events or scheduled tasks, especially not with the server backup.

    I found a thread indicating that this error may be caused by using 32-bit VSS applications on  64-bit OS.  To the best of my knowledge this is not the case, but how can I check for this.  Second question.  What else may be causing this.


    Mike S.
    Monday, September 21, 2009 5:55 PM

Answers

  • Hi Mike,

     

    As you may notice that the same error happens with a SQL server computer, from a detailed trace file, I found there are several security modules which maybe imported from SQL server. This might be something to do with the VSS error.

     

    We need to analysis and debug the VSS trace with source code. However, debugging is beyond what we can do in the forum. A suggestion would be to contact Microsoft Customer Service and Support (CSS) via telephone so that a dedicated Support Professional can assist with you on this case.

     

    You may obtain the phone numbers for specific technology request please take a look at the web site listed below:

    http://support.microsoft.com/default.aspx?scid=fh;EN-US;PHONENUMBERS

     

    If you are outside the US please see http://support.microsoft.com for regional support phone numbers.

     

    I hope the issue will be resolved soon. Thanks!


    This posting is provided "AS IS" with no warranties, and confers no rights.
    • Marked as answer by David Shen Wednesday, October 14, 2009 4:02 AM
    Tuesday, October 13, 2009 3:51 AM

All replies

  • Backing up the system state using NTBackup or Veritas Backup Exec may fail if you are having issues with the dll registrations for the Volume Shadow Copy service.
    Running the vssadmin utility and using the “list writers” parameters returns nothing. The syntax "vssadmin list writers".
    Usually this issue can be resolved by registering the dlls that are needed by the VSS service.

    1.From command prompt:

    Cd windows\system32
    Net stop vss
    Net stop swprv
    regsvr32 ole32.dll
    regsvr32 vss_ps.dll
    Vssvc /Register
    regsvr32 /i swprv.dll
    regsvr32 /i eventcls.dll
    regsvr32 es.dll
    regsvr32 stdprov.dll
    regsvr32 vssui.dll
    regsvr32 msxml.dll
    regsvr32 msxml3.dll
    regsvr32 msxml4.dll

    2.After completing the registration of the DLL’s open an command prompt and type: vssadmin list writers
    3.You should see the writers listed.
    4.Open Ntbackup and attempt to backup file or systemstate.

    Certifications: MCSA 2003 MCSE 2003
    • Proposed as answer by Guido van Brakel Monday, September 21, 2009 6:49 PM
    • Unproposed as answer by Mike S_ Monday, September 21, 2009 6:55 PM
    • Proposed as answer by Guido van Brakel Thursday, September 24, 2009 6:31 PM
    Monday, September 21, 2009 6:25 PM
  • Thanks for replying but this has nothing to do with NTBackup or Backup Exec.  The writers are listed when using the command "vssadmin list writers."

    Mike S.
    Mike S.
    Monday, September 21, 2009 6:59 PM
  • Thanks for replying but this has nothing to do with NTBackup or Backup Exec.  The writers are listed when using the command "vssadmin list writers."

    Mike S.
    Mike S.

    None the less, they do recommend those commands for restoring vss function.  See: http://support.microsoft.com/kb/940032.  It didn't work for me either.

    What did work was deleting the key [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ContentIndex\Catalogs].

    See:  http://support.microsoft.com/kb/907574.
    Tuesday, September 22, 2009 1:22 AM
  • Hi Mike,

     

    To analyze the issue, we'll need to collect some information when the event ID 32 and 8193 occurs, please run the command in the elevated mode on the problematic server.

     

    1. vssadmin list providers > C:\provider.txt

     

    Is there any third party provider?

     

    2. vssadmin list writers > C:\writers.txt

     

    Is there any error message with any writers?

     

    Please send the provider.txt and writer.txt to us via tfwst@microsoft.com , we can help you on analyzing it.

     

    Meanwhile, please check if there is any 32-bit VSS application installed on it. As VSS support for WOW64 was removed in Windows Vista and Windows Server 2008. If you are running a 32-bit application on 64-bit Windows Server 2008 OS, this might result in the events.

     

    Please refer the following link for more details

    http://msdn.microsoft.com/en-us/library/bb968832(VS.85).aspx

     

    Hope it helps. We look forward to your reply.


    This posting is provided "AS IS" with no warranties, and confers no rights.
    Tuesday, September 22, 2009 7:48 AM
  • David,

    Thanks for your help.  I have sent the files to you.  There appear to be no third party providers and no error messages.

    The link does not indicate how to tell if there are any 32-bit VSS applications installed.  How is this done?

    Mike S.
    Mike S.
    Tuesday, September 22, 2009 5:13 PM
  • Hi Mike,

     

    Thank you for your log.

     

    Based on the research of the logs, we found there is no other third party provides in the system. So, it is hard to say if there is any 32-bit application installed.

     

    Generally speaking, Event ID 8193 and 32 indicates that there is something cause register wrong dll files with VSS writers that were registered on the system. The event errors should be fixed by register right dll files.

     

    Do you have a chance to follow shadowman123's suggestion to register the corresponding 32-bit dlls that are needed by the VSS services?


    From command prompt switch to C:\windows\system32 to register the dll files.

    CD windows\system32


    Net stop vss
    Net stop swprv
    regsvr32 ole32.dll
    regsvr32 vss_ps.dll
    Vssvc /Register
    regsvr32 /i swprv.dll
    regsvr32 /i eventcls.dll
    regsvr32 es.dll
    regsvr32 stdprov.dll
    regsvr32 vssui.dll
    regsvr32 msxml.dll
    regsvr32 msxml3.dll
    regsvr32 msxml4.dll

    Please monitor the system for some while to see if the event error can be fixed

    Hope it helps.


    This posting is provided "AS IS" with no warranties, and confers no rights.
    Thursday, September 24, 2009 7:12 AM
  • David,

    I ran the commands and received errors with eventcls.dll - the call to DllInstall failed with error code -x8000ffff; es.dll - the entry-point DllRegisterServer was not found; msxml.dll - specified module could not be found, msxml4.dll - specified module could not be found.


    Thanks,

    Mike S.
    Mike S.
    Thursday, September 24, 2009 1:55 PM
  • Are you running the commands from an elevated command prompt? If not please try it again, the commands we gave you earlier.

    If so try to scan your dll's with sfc /scannow also from an elevated command prompt.

    Certifications: MCSA 2003 MCSE 2003
    Thursday, September 24, 2009 6:28 PM
  • Hi Mike,

     

    Some of the dll files may be not successfully registered on Windows Server 2008.

     

    regsvr32 /i eventcls.dll

    regsvr32 msxml.dll

     

    The import dll file to VSS writer is swpr.dll, we need to verify swprv.dll can be successfully registered. If this can be done, please just monitor to see if the error can be fixed.

     

    regsvr32 /i swprv.dll

     

    Thanks.


    This posting is provided "AS IS" with no warranties, and confers no rights.
    Friday, September 25, 2009 6:36 AM
  • David,

    I was able to successfully register swprv.dll.  I'll monitor and let you know if that fixes the problem.

    Mike S.
    Mike S.
    Friday, September 25, 2009 3:10 PM
  • Hi Mike,

    OK. If the issue will re-occure, please feel free to let me know.

    Thanks.

    This posting is provided "AS IS" with no warranties, and confers no rights.
    Monday, September 28, 2009 2:52 AM
  • David,

    Apparently my update yesterday did not post.  The errors are still occurring.

    Mike S.
    Mike S.
    Tuesday, September 29, 2009 4:42 PM
  • Hi Mike,

     

    Please save the Application Log under Windows Logs as .evtx file and send to us for analysis.

     

    Thanks again.


    This posting is provided "AS IS" with no warranties, and confers no rights.
    Wednesday, September 30, 2009 5:37 AM
  • Hi David,

    I've sent you the log.

    Mike S.
    Mike S.
    Wednesday, September 30, 2009 1:42 PM
  • Hi Mike,

    I performed research on the event logs that you sent, I found Event ID 8224 (The VSS service is shutting down due to idle timeout.) follows the Event ID 8193 and 32 when the error occurs. I suspect there could be something cause the VSS error.

    can you try booting the problematic system with clean boot to check if the issue still exists?

    Steps to clean boot:

    1. Click Start->Run...-> type msconfig and press Enter

    2. Click Services tab and select Hide All Microsoft Services and Disable All third party Services.

    3. Click Startup tab and Disable All startup items

    4. Click OK and choose Restart

    Hope this can be helpful.


    This posting is provided "AS IS" with no warranties, and confers no rights.
    Monday, October 5, 2009 8:21 AM
  • Hi David,

    We actually did a clean boot this morning.  The error is still occurring.  Is there a way for us to increase the logging level for VSS?

    Mike S.


    Mike S.
    • Proposed as answer by etomoinick Tuesday, April 26, 2011 6:23 AM
    Wednesday, October 7, 2009 4:25 PM
  • Hi

    Please trobleshoot following KB &hotfix  stept to resolve the VSS error for windows server 2008


    For 2003 Servers                                                                            For 2008

    940349, 949391, 951568, 957778, 968502, 967551 & 969219             959476, 959962, , 967560
    __________________________________________________________________________________________________________________

    Windows 2008 Hotfix and DLL

    1.You would not be able to hard rebuild com+ 2.The latest patch for win 2k8
    are
    http://support.microsoft.com/kb/959476
    http://support.microsoft.com/kb/959962 (required in case any connections
    with hyper-v)
    http://support.microsoft.com/kb/959978

    net stop "System Event Notification Service"
    net stop "Background Intelligent Transfer Service"
    net stop "COM+ Event System"
    net stop "Microsoft Software Shadow Copy Provider "
    net stop "Volume Shadow Copy"
    cd /d %windir%\system32
    net stop Vss
    net stop swprv
    regsvr32 /s ATL.DLL
    regsvr32 /s comsvcs.DLL
    regsvr32 /s credui.DLL
    regsvr32 /s CRYPTNET.DLL
    regsvr32 /s CRYPTUI.DLL
    regsvr32 /s dhcpqec.DLL
    regsvr32 /s dssenh.DLL
    regsvr32 /s eapqec.DLL
    regsvr32 /s esscli.DLL
    regsvr32 /s FastProx.DLL
    regsvr32 /s FirewallAPI.DLL
    regsvr32 /s kmsvc.DLL
    regsvr32 /s lsmproxy.DLL
    regsvr32 /s MSCTF.DLL
    regsvr32 /s msi.DLL
    regsvr32 /s msxml3.DLL
    regsvr32 /s ncprov.DLL
    regsvr32 /s ole32.DLL
    regsvr32 /s OLEACC.DLL
    regsvr32 /s OLEAUT32.DLL
    regsvr32 /s PROPSYS.DLL
    regsvr32 /s QAgent.DLL
    regsvr32 /s qagentrt.DLL
    regsvr32 /s QUtil.DLL
    regsvr32 /s raschap.DLL
    regsvr32 /s RASQEC.DLL
    regsvr32 /s rastls.DLL
    regsvr32 /s repdrvfs.DLL
    regsvr32 /s RPCRT4.DLL
    regsvr32 /s rsaenh.DLL
    regsvr32 /s SHELL32.DLL
    regsvr32 /s shsvcs.DLL
    regsvr32 /s /i swprv.DLL
    regsvr32 /s tschannel.DLL
    regsvr32 /s USERENV.DLL
    regsvr32 /s Vss_ps.DLL
    regsvr32 /s wbemcons.DLL
    regsvr32 /s wbemcore.DLL
    regsvr32 /s wbemess.DLL
    regsvr32 /s wbemsvc.DLL
    regsvr32 /s WINHTTP.DLL
    regsvr32 /s WINTRUST.DLL
    regsvr32 /s wmiprvsd.DLL
    regsvr32 /s wmisvc.DLL
    regsvr32 /s wmiutils.DLL
    regsvr32 /s wuaueng.DLL
    Cd /d %systemroot%\syswow64
    regsvr32 /s ole32.dll
    regsvr32 /s Vss_ps.dll
    regsvr32 /s es.dll
    regsvr32 /s stdprov.dll
    regsvr32 /s msxml3.dll
    regsvr32 /s msxml.dll
    regsvr32 /s msxml4.dll
    net start "COM+ Event System"
    sfc /SCANFILE=%windir%\system32\catsrv.DLL
    sfc /SCANFILE=%windir%\system32\catsrvut.DLL
    sfc /SCANFILE=%windir%\system32\CLBCatQ.DLL
    net start "COM+ Event System"

    Hope this helpful

    Thanks...


    Deva --Self-trust is the first secret of success.
    Wednesday, October 7, 2009 6:16 PM
  • Hi David,

    We actually did a clean boot this morning.  The error is still occurring.  Is there a way for us to increase the logging level for VSS?

    Mike S.


    Mike S.


    Hi Mike,

    You may refer to the method in the KB http://support.microsoft.com/kb/887013 to enable the Volume Shadow Copy service's debug tracing features.

    Also, you can copy the commands below into notepad, and save the file as “vsstracing.bat”. Run the same to make the registry changes required to configure VSS tracing.

    net stop swprv


    reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS\Debug\Tracing /v TraceFile /t REG_SZ /d C:\trace.txt /f

    reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS\Debug\Tracing /v TraceLevel /t REG_DWORD /d 0xffffffff /f

    reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS\Debug\Tracing /v TraceEnterExit /t REG_DWORD /d 1 /f

    reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS\Debug\Tracing /v TraceToFile /t REG_DWORD /d 1 /f

    reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS\Debug\Tracing /v TraceToDebugger /t REG_DWORD /d 1 /f

    reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS\Debug\Tracing /v TraceFileLineInfo /t REG_DWORD /d 1 /f

    reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS\Debug\Tracing /v TraceForceFlush /t REG_DWORD /d 0 /f


    After running the batch file that enables tracing, we need to reproduce the issue. Once you have received the errors, stop the VSS services. You can do this by running the following commands on the command prompt.


    net stop VSS

    net stop SWPRV


    Then, disable VSS tracing by running the following command:


    reg delete HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS\Debug\Tracing /f


    The trace file is created on the root of the C drive.

    Hope it will be helpful.


    This posting is provided "AS IS" with no warranties, and confers no rights.
    • Marked as answer by David Shen Friday, October 9, 2009 8:25 AM
    • Unmarked as answer by Mike S_ Friday, October 9, 2009 1:05 PM
    Thursday, October 8, 2009 2:59 AM
  • Hi David,

    I've sent the file.  I had to let it run over night in order to capture both errors.  Event ID 32 occurs every 15 minutes, Event ID 8193 occurs every 4 hours.

    Mike S.
    Mike S.
    Friday, October 9, 2009 2:54 PM
  • David,

    The email to address EMAIL GONE was rejected.  Size is 6 MB.  Is there a better address to send this to?

    Thanks,

    Mike S.
    Mike S.
    Friday, October 9, 2009 3:02 PM
  • Hi Mike,

    Please use Windows Live SkyDrive (
    http://www.skydrive.live.com/) to upload the file and then give us the download address.
    This posting is provided "AS IS" with no warranties, and confers no rights.
    Friday, October 9, 2009 4:03 PM
  • David,

    I just noticed that we have another customer experiencing the same errors.  This also is a virtual SQL 2008 on Server 2008 running on Server 2008 core.  From the logs it appears that the errors have been occuring over a period of several months.

    Mike
    Mike S.
    Monday, October 12, 2009 8:11 PM
  • Hi Mike,

     

    As you may notice that the same error happens with a SQL server computer, from a detailed trace file, I found there are several security modules which maybe imported from SQL server. This might be something to do with the VSS error.

     

    We need to analysis and debug the VSS trace with source code. However, debugging is beyond what we can do in the forum. A suggestion would be to contact Microsoft Customer Service and Support (CSS) via telephone so that a dedicated Support Professional can assist with you on this case.

     

    You may obtain the phone numbers for specific technology request please take a look at the web site listed below:

    http://support.microsoft.com/default.aspx?scid=fh;EN-US;PHONENUMBERS

     

    If you are outside the US please see http://support.microsoft.com for regional support phone numbers.

     

    I hope the issue will be resolved soon. Thanks!


    This posting is provided "AS IS" with no warranties, and confers no rights.
    • Marked as answer by David Shen Wednesday, October 14, 2009 4:02 AM
    Tuesday, October 13, 2009 3:51 AM
  • ...I've been working on this same issue.  Did you ever find any resolution?
    Tuesday, December 29, 2009 7:55 PM
  • Groovescribe,

    I got busy and had to move on to something else for a while.  I'll take a look to see if the issue is still occurring.  I expect to do that next week.  Please post a reminder if I don't.

    Thanks,

    Mike S.
    Mike S.
    Thursday, December 31, 2009 8:17 PM
  • Groovescribe,

    I got busy and had to move on to something else for a while.  I'll take a look to see if the issue is still occurring.  I expect to do that next week.  Please post a reminder if I don't.

    Thanks,

    Mike S.
    Mike S.

    I have this same issue, did you check to see if yours is resolved?
    Tuesday, January 26, 2010 6:47 PM
  • ...if you have a chance, did you find any resolution to this issue.  Can't seem to get an answer out of Symantec which is the direction my research took me.

    If you have time, I'd be interested to hear what you found.  If not, no worries.

    Thanks Mike!  Appreciate the insight!

    Groove
    Wednesday, January 27, 2010 4:25 PM
  • Unfortunatley I haven't been able to devote much time to this since it doesn't seem to be causing problems on the system.  The frequency of both events has decreased.  Event ID 32 is now occuring about every 8 hours and Event ID 8193 hasn't occured for over a week.  I can't correlate any scheduled operations with the error.  For example I'm backing the SQL database on the hour every hour, but when Event 32 occurs it is at 43 minutes after the hour.  I am not using Volume Shadow Copies on this server.

    mike S.
    Mike S.
    Thursday, January 28, 2010 3:08 PM
  • I received a response from Microsoft last night about a diferent VSS issue.  They are telling me that SP2 for Server 2008 includes a number of hotfixes for VSS.

    Mike S.


    Mike S.
    Friday, January 29, 2010 1:43 PM
  • Dear David,

    I have same problem on windows server 2003 x64,SP2.  When we initiate a systemstate backup it is happening fine.  But when we initiate backup from netbackup tool it is failing.

    VSS service is not starting after initiating backup from tool.  msxml.dll is in sysWoW64.  KB940349,KB969219 already installed on server and registration of dlls went successfully.

     

    Below events are logged on server.

    Event ID 11:

     

    Event Type: Error
    Event Source: VSS
    Event Category: None
    Event ID: 11
    Date:  11/22/2010
    Time:  11:12:48 PM
    User:  N/A
    Computer: ......

    Description:
    Volume Shadow Copy Service information: The COM Server with CLSID {e579ab5f-1cc4-44b4-bed9-de0991ff0623} and name Coordinator cannot be started. [0x80070422]

     

     

    Event ID 8193:

     

    Event Type: Error
    Event Source: VSS
    Event Category: None
    Event ID: 8193
    Date:  11/22/2010
    Time:  11:12:48 PM
    User:  N/A
    Computer: ...............

    Description:
    Volume Shadow Copy Service error: Unexpected error calling routine CoCreateInstance.  hr = 0x80070422.

    Any help appreciated.

    Wednesday, November 24, 2010 5:43 AM