Solved

Volume Shadow Copy Service starts and stops every 15 mins - filling event log

Posted on 2006-06-27
10
8,594 Views
Last Modified: 2012-06-27
I have several Windows 2003 servers, all running SP1 that all exhibit the following behaviour. It doesn't matter if they are Enterprise, Standard or R2 editions; or whether they're DCs or stand-alone.

Every 15 minutes these six events are written to the System log in this order:

Event Type:      Information
Event Source:      Service Control Manager
Event Category:      None
Event ID:      7035
Date:            6/27/2006
Time:            12:59:06 PM
User:            NT AUTHORITY\SYSTEM
Computer:      ANDROMEDA
Description:
The Volume Shadow Copy service was successfully sent a start control.
-----------
Event Type:      Information
Event Source:      Service Control Manager
Event Category:      None
Event ID:      7036
Date:            6/27/2006
Time:            12:59:06 PM
User:            N/A
Computer:      ANDROMEDA
Description:
The Volume Shadow Copy service entered the running state.
-----------
Event Type:      Information
Event Source:      Service Control Manager
Event Category:      None
Event ID:      7035
Date:            6/27/2006
Time:            12:59:06 PM
User:            NT AUTHORITY\SYSTEM
Computer:      ANDROMEDA
Description:
The Microsoft Software Shadow Copy Provider service was successfully sent a start control.
--------------
Event Type:      Information
Event Source:      Service Control Manager
Event Category:      None
Event ID:      7036
Date:            6/27/2006
Time:            12:59:06 PM
User:            N/A
Computer:      ANDROMEDA
Description:
The Microsoft Software Shadow Copy Provider service entered the running state.
-------------
Event Type:      Information
Event Source:      Service Control Manager
Event Category:      None
Event ID:      7036
Date:            6/27/2006
Time:            1:02:07 PM
User:            N/A
Computer:      ANDROMEDA
Description:
The Volume Shadow Copy service entered the stopped state.
-----------
Event Type:      Information
Event Source:      Service Control Manager
Event Category:      None
Event ID:      7036
Date:            6/27/2006
Time:            1:05:07 PM
User:            N/A
Computer:      ANDROMEDA
Description:
The Microsoft Software Shadow Copy Provider service entered the stopped state.
-----------

This shows up weather it's a virgin stand-alone installation or an established server in a large network. I do not use the VSS for anything and have never activated it.

I don't care really why it's running as it doesn't see to harm anything - I just don't want it filling the event logs. It's really quite the pain to have to look through the logs for something when you have thousands of these event filling it up. Kind of like the proverbial needle in the hay stack.

So, how do I turn it off or turn off logging?
0
Comment
Question by:brian975
  • 5
  • 4
10 Comments
 
LVL 23

Expert Comment

by:TheCleaner
ID: 16997932
It's normal if the VSS service is set to manual.  If you don't need the service just disable it.  Do you have any backup software or disk querying software installed to manage the servers?
0
 

Author Comment

by:brian975
ID: 16998501
I use Backup Exec 10.1d for my network server backups so I have that covered. I don't really care about the stand-alone servers.

So, you're saying that, as long as I don't use the VSS, I can disable it? Do you know if Backup Exec needs it?
0
 
LVL 23

Expert Comment

by:TheCleaner
ID: 17000819
Backup Exec doesn't require it, but it's probably the culprit.  10d does use the VSS during backups, but I'm perplexed as to why you would see it every 15 minutes.  Do you have Continuous Protection running?

Backup Exec will use VSS to create a shadow copy to backup if you use the Open File Option or Continuous Protection.
0
 

Author Comment

by:brian975
ID: 17001952
Well, I do use the Open File Option on the servers.

I don't mind if VSS is running - I just want to suppress the start/stop messages in the system log.
0
Get up to 2TB FREE CLOUD per backup license!

An exclusive Black Friday offer just for Expert Exchange audience! Buy any of our top-rated backup solutions & get up to 2TB free cloud per system! Perform local & cloud backup in the same step, and restore instantly—anytime, anywhere. Grab this deal now before it disappears!

 
LVL 23

Accepted Solution

by:
TheCleaner earned 500 total points
ID: 17002661
Well, it should only start/stop when something requests it.  How often is BE10d running against that server?  You can try and disable the VSS on 1 server, wait 20 minutes and see what errors are in the application and system logs to see what is trying to access it.

It may end up being a "have to live with it", in which case you can set your log files larger and have them auto-overwrite as needed.
0
 

Author Comment

by:brian975
ID: 17002810
Backups only run once a day at 11:00pm. The rest of the day the backup processes are inactive.

I've already set the log files to 10MB and auto-overwrite. I just hate having to look through thousands of these start/stop events that have the generic label of Service Control Manager when I have to do troubleshooting or diagnostics. It seems that the notifications are pointless and just needless clutter.

I'll try disabling VSS on one of the servers like you suggested to see what happens.
0
 

Author Comment

by:brian975
ID: 17031627
Well, disabling the VSS resulted in a "catastrophic failure" message when backing up the System State.

So, the question remains: How do I suppress these messages?
0
 

Author Comment

by:brian975
ID: 17084066
Any takers?
0
 
LVL 23

Expert Comment

by:TheCleaner
ID: 17084678
I'm not sure at this point to get it done.
0

Featured Post

How to improve team productivity

Quip adds documents, spreadsheets, and tasklists to your Slack experience
- Elevate ideas to Quip docs
- Share Quip docs in Slack
- Get notified of changes to your docs
- Available on iOS/Android/Desktop/Web
- Online/Offline

Join & Write a Comment

I guess it is not common knowledge to most Wintel engineers/administrators: If you have an SNMP-based monitoring system in your environment (and it's common to have SNMP or Syslog) it's reasonably easy to enable monitoring of the Windows Event logs,…
ADCs have gained traction within the last decade, largely due to increased demand for legacy load balancing appliances to handle more advanced application delivery requirements and improve application performance.
Illustrator's Shape Builder tool will let you combine shapes visually and interactively. This video shows the Mac version, but the tool works the same way in Windows. To follow along with this video, you can draw your own shapes or download the file…
This video demonstrates how to create an example email signature rule for a department in a company using CodeTwo Exchange Rules. The signature will be inserted beneath users' latest emails in conversations and will be displayed in users' Sent Items…

708 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

13 Experts available now in Live!

Get 1:1 Help Now