Volume Shadow Copy Service starts and stops every 15 mins - filling event log
I have several Windows 2003 servers, all running SP1 that all exhibit the following behaviour. It doesn't matter if they are Enterprise, Standard or R2 editions; or whether they're DCs or stand-alone.
Every 15 minutes these six events are written to the System log in this order:
Event Type: Information
Event Source: Service Control Manager
Event Category: None
Event ID: 7035
Date: 6/27/2006
Time: 12:59:06 PM
User: NT AUTHORITY\SYSTEM
Computer: ANDROMEDA
Description:
The Volume Shadow Copy service was successfully sent a start control.
-----------
Event Type: Information
Event Source: Service Control Manager
Event Category: None
Event ID: 7036
Date: 6/27/2006
Time: 12:59:06 PM
User: N/A
Computer: ANDROMEDA
Description:
The Volume Shadow Copy service entered the running state.
-----------
Event Type: Information
Event Source: Service Control Manager
Event Category: None
Event ID: 7035
Date: 6/27/2006
Time: 12:59:06 PM
User: NT AUTHORITY\SYSTEM
Computer: ANDROMEDA
Description:
The Microsoft Software Shadow Copy Provider service was successfully sent a start control.
--------------
Event Type: Information
Event Source: Service Control Manager
Event Category: None
Event ID: 7036
Date: 6/27/2006
Time: 12:59:06 PM
User: N/A
Computer: ANDROMEDA
Description:
The Microsoft Software Shadow Copy Provider service entered the running state.
-------------
Event Type: Information
Event Source: Service Control Manager
Event Category: None
Event ID: 7036
Date: 6/27/2006
Time: 1:02:07 PM
User: N/A
Computer: ANDROMEDA
Description:
The Volume Shadow Copy service entered the stopped state.
-----------
Event Type: Information
Event Source: Service Control Manager
Event Category: None
Event ID: 7036
Date: 6/27/2006
Time: 1:05:07 PM
User: N/A
Computer: ANDROMEDA
Description:
The Microsoft Software Shadow Copy Provider service entered the stopped state.
-----------
This shows up weather it's a virgin stand-alone installation or an established server in a large network. I do not use the VSS for anything and have never activated it.
I don't care really why it's running as it doesn't see to harm anything - I just don't want it filling the event logs. It's really quite the pain to have to look through the logs for something when you have thousands of these event filling it up. Kind of like the proverbial needle in the hay stack.
So, how do I turn it off or turn off logging?
Every 15 minutes these six events are written to the System log in this order:
Event Type: Information
Event Source: Service Control Manager
Event Category: None
Event ID: 7035
Date: 6/27/2006
Time: 12:59:06 PM
User: NT AUTHORITY\SYSTEM
Computer: ANDROMEDA
Description:
The Volume Shadow Copy service was successfully sent a start control.
-----------
Event Type: Information
Event Source: Service Control Manager
Event Category: None
Event ID: 7036
Date: 6/27/2006
Time: 12:59:06 PM
User: N/A
Computer: ANDROMEDA
Description:
The Volume Shadow Copy service entered the running state.
-----------
Event Type: Information
Event Source: Service Control Manager
Event Category: None
Event ID: 7035
Date: 6/27/2006
Time: 12:59:06 PM
User: NT AUTHORITY\SYSTEM
Computer: ANDROMEDA
Description:
The Microsoft Software Shadow Copy Provider service was successfully sent a start control.
--------------
Event Type: Information
Event Source: Service Control Manager
Event Category: None
Event ID: 7036
Date: 6/27/2006
Time: 12:59:06 PM
User: N/A
Computer: ANDROMEDA
Description:
The Microsoft Software Shadow Copy Provider service entered the running state.
-------------
Event Type: Information
Event Source: Service Control Manager
Event Category: None
Event ID: 7036
Date: 6/27/2006
Time: 1:02:07 PM
User: N/A
Computer: ANDROMEDA
Description:
The Volume Shadow Copy service entered the stopped state.
-----------
Event Type: Information
Event Source: Service Control Manager
Event Category: None
Event ID: 7036
Date: 6/27/2006
Time: 1:05:07 PM
User: N/A
Computer: ANDROMEDA
Description:
The Microsoft Software Shadow Copy Provider service entered the stopped state.
-----------
This shows up weather it's a virgin stand-alone installation or an established server in a large network. I do not use the VSS for anything and have never activated it.
I don't care really why it's running as it doesn't see to harm anything - I just don't want it filling the event logs. It's really quite the pain to have to look through the logs for something when you have thousands of these event filling it up. Kind of like the proverbial needle in the hay stack.
So, how do I turn it off or turn off logging?
TheCleaner
It's normal if the VSS service is set to manual. If you don't need the service just disable it. Do you have any backup software or disk querying software installed to manage the servers?
ASKER
I use Backup Exec 10.1d for my network server backups so I have that covered. I don't really care about the stand-alone servers.
So, you're saying that, as long as I don't use the VSS, I can disable it? Do you know if Backup Exec needs it?
So, you're saying that, as long as I don't use the VSS, I can disable it? Do you know if Backup Exec needs it?
Backup Exec doesn't require it, but it's probably the culprit. 10d does use the VSS during backups, but I'm perplexed as to why you would see it every 15 minutes. Do you have Continuous Protection running?
Backup Exec will use VSS to create a shadow copy to backup if you use the Open File Option or Continuous Protection.
Backup Exec will use VSS to create a shadow copy to backup if you use the Open File Option or Continuous Protection.
ASKER
Well, I do use the Open File Option on the servers.
I don't mind if VSS is running - I just want to suppress the start/stop messages in the system log.
I don't mind if VSS is running - I just want to suppress the start/stop messages in the system log.
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
Backups only run once a day at 11:00pm. The rest of the day the backup processes are inactive.
I've already set the log files to 10MB and auto-overwrite. I just hate having to look through thousands of these start/stop events that have the generic label of Service Control Manager when I have to do troubleshooting or diagnostics. It seems that the notifications are pointless and just needless clutter.
I'll try disabling VSS on one of the servers like you suggested to see what happens.
I've already set the log files to 10MB and auto-overwrite. I just hate having to look through thousands of these start/stop events that have the generic label of Service Control Manager when I have to do troubleshooting or diagnostics. It seems that the notifications are pointless and just needless clutter.
I'll try disabling VSS on one of the servers like you suggested to see what happens.
ASKER
Well, disabling the VSS resulted in a "catastrophic failure" message when backing up the System State.
So, the question remains: How do I suppress these messages?
So, the question remains: How do I suppress these messages?
ASKER
Any takers?
I'm not sure at this point to get it done.