Backup and VSS
4sources
9reasons
3conditions
4decode tables
A backup job or the shadow-copy service behind it failed or degraded.
How the agent recognises this on a host
- VSS writer state is readable on the host, which is what a backup product snapshots through.
- Shadow-copy storage is allocated on at least one volume.
The sources below carry those markers.
| Source | What it is | Status |
|---|---|---|
| Windows Application event log | The Application channel: application crashes and hangs, database and VSS provider faults, certificate and identity-sync failures. | Live |
| Windows System event log | The System channel: service, driver, disk, network, cluster and hardware faults from the operating system itself. | Live |
| VSS writers | VSS writer state, the canonical evidence behind a failed backup. | Live |
| VSS shadow storage | Shadow-copy storage allocation and how close it is to its cap. | Live |
| Disk volumes | Every fixed volume: free space, fill trend, protection state and whether the filesystem is readable. | Live |
What is scored here
| Source | Signals | What they are |
|---|---|---|
| VSS shadow storage | 2 | shadow storage near cap, shadow copies failing for space |
| VSS writers | 1 | VSS writer failed |
| Windows Application event log | 7 | vss data integrity writer failed, vss legacy driver scan, vss optimization time budget reached, vss provider class not registered, vss snapshot call failed, vss snapshots failing for space, vss writer callback query |
| Windows System event log | 2 | vss shadow aborted, vss shadow lost |