SUMMARY

This document contains a description of the flow of events in a backup, as captured in the Windows Events application log.

ISSUE

Below is a table that describes the flow of events in a backup, as captured in the Windows Events application log.


Starting event
Task category and message indicate the operation. The description field contains the type of operation that has started.

VSS events leading up to execution of a volume snapshot
 
Related VSS events are seen before and after the Unitrends events are logged. Any failures that occur while issuing these VSS events are logged as errors. Some details are added to the event description for that failure. In the case of errors, some diagnostics can be run from the command line to insure that the VSS subsystem is functioning. Use the ‘VssAdmin’ commands:
Vssadmin list writers
Vssadmin list providers
Vssadmin list volumes
 
If any of these commands fail or return no information, then the VSS subsystem is not functioning. A
reboot helps in most cases.
 
VSS events are described here:

When creating a snapshot, the agent adds the requested volumes to that snapshot and for each volume added the following event is logged.
 
If a failure occurs while adding a volume to the snapshot event 279 is logged. Included are some details of the error. Typically, failures occur when attempting to add non-NTFS volumes or network attached volumes to a snapshot set. In some cases, network attached volumes require a hardware specific
VSS provider to be installed before they can be added to VSS snapshots. If this error occurs, the agent attempts the backup without using the VSS snapshot. This could result in files not being backed up due to file in use errors.
 
VSS add volume events are described here:

The system state begins event indicates the exact point in the process that this starts. The system state ending event is seen later, and any errors found in between. System state duration can be determined with these two events.


A volume snapshot operation concludes with one of two events. The successful DoSnapshotSet event indicates that the volume snapshot has completed OK. A failure is logged as an Error category event with some details in the description. If the snapshot operation fails, the following error event is logged. Added to this message is some extra detail about the error. There are many possible causes for this failure. Some of the errors are related to poor disk performance causing the VSS subsystem to give up while waiting for the snapshot to complete. In these cases, the Windows OS usually logs other warnings or errors before and/or after this entry.
 
Do snapshot events are described here:

For master, differential, and incremental backups, the agent performs a system state backup. When that completes, an information or error event is logged. There are many error cases during system state backup, especially when running on Windows domain controllers. If system state failures persist then more detailed information is logged in the Unitrends agent log files.
 
System state events are described here:

At the end of the backup, the session completion event is entered. If the summary was sent okay, then the following event appears. A failure to send the summary results in an error event being entered. The success event shows how many files were backed up and how many were skipped due to an error or an in-use condition.
780
The session complete event is described here:

If a failure occurs while sending the backup summary to the Unitrends system, the following event is logged. This is usually caused by a network connection disruption between the Unitrends agent and the backup system.
  
The failed to send summary event is described here:

For application backups (Exchange or SQL), the agent concludes the session by issuing a VSS BackupComplete event with a success or fail condition. For successful backups, this event indicates to the appropriate VSS writer that any cleanup processing may be done, like transaction log truncation. A failure condition causes this event to log as an Error category and the description indicates the error.
 
There are many possible causes of an application backup failure, some of which are described in the preceding events. Any error during an application backup causes the agent to issue the BackupComplete failure event.
 
Backup complete events are described here:

Window Event logs for Installer Validations of Agent Deployments

Example record displayed in the Windows Event Viewer: