Olaf Berli
asked on
Skipped files in Backup Exec
Customer is running Win2003 server as PDC and Backup Exec 12. Today the log shows 5 skipped files. Have tried to figure out what they are, and there seems to be some indications that they are related to some malware. Then anti-virus software reports the files as locked. Would like any comments. All files seeme to have a size of 0 bytes (in Win Explorer). The log shows:
Backup- C: The item C:\WINDOWS\system32\h323lo g.txt in use - skipped.
The item C:\WINDOWS\system32\spool\ PRINTERS\F P00057.SHD in use - skipped.
The item C:\WINDOWS\system32\spool\ PRINTERS\F P00057.SPL in use - skipped.
The item C:\WINDOWS\system32\spool\ PRINTERS\F P00058.SHD in use - skipped.
The item C:\WINDOWS\system32\spool\ PRINTERS\F P00058.SPL in use - skipped.
The h323log.txt is locked by scvhost.exe, while the others are locked by spoolsv
Any recommendations?
-Olaf-
Backup- C: The item C:\WINDOWS\system32\h323lo
The item C:\WINDOWS\system32\spool\
The item C:\WINDOWS\system32\spool\
The item C:\WINDOWS\system32\spool\
The item C:\WINDOWS\system32\spool\
The h323log.txt is locked by scvhost.exe, while the others are locked by spoolsv
Any recommendations?
-Olaf-
Hi.
To delete the files in C:\WINDOWS\system32\spool\ PRINTERS stop the spooler service, delte them and then start the service again.
You can use Process Monitor http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx to see what process is locking the txt file.
Hope this helps.
To delete the files in C:\WINDOWS\system32\spool\
You can use Process Monitor http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx to see what process is locking the txt file.
Hope this helps.
ASKER
hutnor: No, no need to include them in the backup. We are in the process of excluding unneeded files from the backup. These files have not been reported as 'in use' before, and I wanted to check what they are. Question: What is VSS?
WindowsITAdmin: Files in spool directory are deleted. Thanks. Guess they were left-over print jobs.
Remaining question: what is the C:\WINDOWS\system32\h323lo g.txt - locked by svchost.exe?
WindowsITAdmin: Files in spool directory are deleted. Thanks. Guess they were left-over print jobs.
Remaining question: what is the C:\WINDOWS\system32\h323lo
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
use/enable VSS when doing backups if it not already