Getting an Event ID 27 from volsnap when running backup on machine with Hyper-V


  • Last night our Win2008 R2 server registered the following in Event Viewer about 4 minutes after starting a backup:
    Log Name:      System
    Source: volsnap
    Date: 9/18/2009 2:04:15 AM
    Event ID: 27
    Task Category: None
    Level: Error
    Keywords: Classic
    User: N/A
    Computer: Rome.douglas-associates.local
    The shadow copies of volume \\?\Volume{03b1197a-98ea-11de-90fa-0023aeff5859} were aborted during detection because a critical control file could not be opened.
    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
    <Provider Name="volsnap" />
    <EventID Qualifiers="49158">27</EventID>
    <TimeCreated SystemTime="2009-09-18T06:04:15.895194600Z" />
    <Security />
    This error showed up twice (2:03:36 AM and 2:04:15 AM) and the only thing going on at the time was a backup job.  The backups claim to have completed successfully, but this error leaves me with some doubt.

    Can anyone fill me in on what's happening and what (if anything) needs to be done.

    Many thanks!

    Some basics on the server:
    Dell T710 w/12Gb RAM, Intel E5520 (1 cpu, 4 cores w/HT, OS shows 8 processors), RAID 1 Drive 1Tb
    Win Server 2008 R2 (RTM-64bit) with these Roles: ADDS, DHCP, DNS, File Services, Hyper-V (3 VMs all running W2k3 32bit)
    Friday, September 18, 2009 5:48 PM


  • This problem has not occurred again, so I'm going to close the thread down.
    • Marked as answer by Doug Clutter Monday, October 19, 2009 11:58 AM
    Monday, October 19, 2009 11:58 AM