Troubleshooting Event ID 8486 Source WinfSys


I’ve Gather this information from event Viewer Application and System:

Upgrade Netbackup Client to version Veritas NetBackup 6.5.6 (6.5 Release Update 6)

Event Type:    Information
Event Source:    MsiInstaller
Event Category:    None
Event ID:    11707
Date:        3/1/2012
Time:        3:32:49 PM
User:        myuser
Computer:    server
Description: Product: Veritas NetBackup 6.5.6 (6.5 Release Update 6) --
Installation operation completed successfully.

Error started to appear every day at the same time (more or less):

Event Type:    Error
Event Source:    winfsys
Event Category:    None
Event ID:    8486
Date:        3/2/2012
Time:        9:14:23 AM
User:        N/A
Computer:    server
Description: The description for Event ID ( 8486 ) in Source ( winfsys ) cannot be found.
The local computer may not have the necessary registry information or message DLL files 
to display messages from a remote computer. You may be able to use the /AUXSOURCE= flag
to retrieve this description; see Help and Support for details. The following information is part 
of the event: Error: 0x00002126, in file providers\winfsys\winfsyscoordinator.cpp, line 112

Followed by this events.

Event Type:    Information
Event Source:    ESENT
Event Category:    ShadowCopy 
Event ID:    2001
Date:        3/2//2012
Time:        9:14:52 AM
User:        N/A
Computer:    Server
Description:    certsrv.exe (1504) Shadow copy 20 freeze started.

Event Type:    Information
Event Source:    ESENT
Event Category:    ShadowCopy 
Event ID:    2001
Date:        3/2//2012
Time:        9:14:52 AM
User:        N/A
Computer:    server
Description:
lsass (532) Shadow copy 20 freeze started.

Event Type:    Information
Event Source:    ESENT
Event Category:    ShadowCopy 
Event ID:    2003
Date:        3/2/2012
Time:        9:14:53 AM
User:        N/A
Computer:    server
Description:
certsrv.exe (1504) Shadow copy 20 freeze stopped.

Event Type:    Information
Event Source:    ESENT
Event Category:    ShadowCopy 
Event ID:    2003
Date:        3/2/2012
Time:        9:14:53 AM
User:        N/A
Computer:    server
Description:
lsass (532) Shadow copy 20 freeze stopped.

Also the next event appears, but in the analysis process was discarded and considered irrelevant, only appeared once.

Event Type:    Error
Event Source:    VSS
Event Category:    None
Event ID:    12301
Date:        3/2/2012
Time:        9:16:00 AM
User:        N/A12:26 
Computer:    server
Description:
Volume Shadow Copy Service error: Writer Removable Storage 
Manager did not respond to a GatherWriterStatus call.

Let’s start

From this link http://msdn.microsoft.com/en-us/library/ms681390%28VS.85%29.aspx,

Error Code: 8486 (0x2126)

"ERROR_DS_DST_NC_MISMATCH
8486 (0x2126)
Source and destination for a cross-domain move are not 
in agreement on the naming contexts in the forest. 
Either source or destination does not have the latest 
version of the Partitions container.

This is a Windows 2003 Server with the Rule Active directory services, but only have one DC so after a Dcdiag /c /v no failures were detected.

Decided to analyse the VSS component to check if any error appears.

Start and stop VSS Service did not generate any error.

net stop vss and net start vss

Used the tool Vssadmin to gather some information

For Help type vssadmin /?

C:\>vssadmin /?
vssadmin 1.1 - Volume Shadow Copy Service administrative command-line tool
(C) Copyright 2001 Microsoft Corp.
---- Commands Supported ----
Add ShadowStorage     - Add a new volume shadow copy storage association
Create Shadow         - Create a new volume shadow copy
Delete Shadows        - Delete volume shadow copies
Delete ShadowStorage  - Delete volume shadow copy storage associations
List Providers        - List registered volume shadow copy providers
List Shadows          - List existing volume shadow copies
List ShadowStorage    - List volume shadow copy storage associations
List Volumes          - List volumes eligible for shadow copies
List Writers          - List subscribed volume shadow copy writers
Resize ShadowStorage  - Resize a volume shadow copy storage association
Revert Shadow         - Revert a volume to a shadow copy
Query Reverts         - Query the progress of in-progress revert operations.

List Providers

C:\>vssadmin List Providers
vssadmin 1.1 - Volume Shadow Copy Service administrative command-line tool
(C) Copyright 2001 Microsoft Corp.
Provider name: 'Microsoft Software Shadow Copy provider 1.0'
   Provider type: System
   Provider Id: {b5946137-7b9f-4925-af80-51abd60b20d5}
   Version: 1.0.0.7

As expected the provider is the windows vss service.

List Writers

C:\>vssadmin List Writers
vssadmin 1.1 - Volume Shadow Copy Service administrative command-line tool
(C) Copyright 2001 Microsoft Corp.
Writer name: 'System Writer'
   Writer Id: {e8132975-6f93-4464-a53e-1050253ae220}
   Writer Instance Id: {942fee37-2423-4939-9d1f-23e1b1fdcd63}
   State: [1] Stable
   Last error: No error
Writer name: 'MSDEWriter'
   Writer Id: {f8544ac1-0611-4fa5-b04b-f7ee00b03277}
   Writer Instance Id: {2a769bb4-73b5-41d4-bddd-117ee5c89fcb}
   State: [1] Stable
   Last error: No error
Writer name: 'Registry Writer'
   Writer Id: {afbab4a2-367d-4d15-a586-71dbb18f8485}
   Writer Instance Id: {01209590-2760-4bc0-966c-afea31d9240a}
   State: [1] Stable
   Last error: No error
Writer name: 'Event Log Writer'
   Writer Id: {eee8c692-67ed-4250-8d86-390603070d00}
   Writer Instance Id: {d7b42bbf-09a3-4551-adf6-377b58beec0c}
   State: [1] Stable
   Last error: No error

Writer name: 'COM+ REGDB Writer'
   Writer Id: {542da469-d3e1-473c-9f4f-7847f01fc64f}
   Writer Instance Id: {75b8c326-944f-4ddd-a59f-fed878661b2d}
   State: [1] Stable
   Last error: No error
Writer name: 'NTDS'
   Writer Id: {b2014c9e-8711-4c5c-a5a9-3cf384484757}
   Writer Instance Id: {50a0f7d6-ac6f-4551-948b-e53223be382e}
   State: [1] Stable
   Last error: No error
Writer name: 'IIS Metabase Writer'
   Writer Id: {59b1f0cf-90ef-465f-9609-6ca8b2938366}
   Writer Instance Id: {1e7ff912-51fd-404e-8c1c-37660771ff02}
   State: [1] Stable
   Last error: No error
Writer name: 'FRS Writer'
   Writer Id: {d76f5a28-3092-4589-ba48-2958fb88ce29}
   Writer Instance Id: {4253a656-a06e-43cb-aa01-8016d5f4731e}
   State: [1] Stable
   Last error: No error
Writer name: 'Certificate Authority'
   Writer Id: {6f5b15b5-da24-4d88-b737-63063e3a1f86}
   Writer Instance Id: {68c12b98-6b49-4ec4-9192-daeb081fe801}
   State: [1] Stable
   Last error: No error
Writer name: 'WMI Writer'
   Writer Id: {a6ad56c2-b509-4e6c-bb19-49d8f43532f0}
   Writer Instance Id: {b86510d6-d7ee-43ef-beaf-31365bca47f4}
   State: [1] Stable
   Last error: No error

No errors were detected.

List volumes

C:\>vssadmin list volumes
vssadmin 1.1 - Volume Shadow Copy Service administrative command-line tool
(C) Copyright 2001 Microsoft Corp.
Volume path: C:\
    Volume name: \\?\Volume{ee361175-c2f4-11dd-bcbc-806e6f6e6963}\
Volume path: D:\
    Volume name: \\?\Volume{ee361178-c2f4-11dd-bcbc-001a64f5677c}\

No errors were detected in the VSS service.

Is time to check from backup server side.

C:\>bpclient -client server.local -L
bpclient: no entity was found (227)

After checking Symantec knowledge base, found this article http://www.symantec.com/docs/TECH164047, where this information is relevante:

Solution
This is a known issue with VSP snapshots in NetBackup 6.5.6.
If the client is a Windows 2003 machine, it is recommended 
to use VSS as the snapshot provider instead of VSP.

It was adjusted the backup policy to force the client to use the VSS component..

C:\>bpclient -client server.local -L
Client Name: server.local
Current Host:
        Hostname: server.local
        IP Address: 0.0.0.0
Dynamic Address:       no
Free Browse:   Allow
List Restore:  Not Specified
Max Jobs This Client:  Not Specified
WOFB Enabled:  yes
WOFB FIM:      VSS
WOFB Usage:    Global Drive Snapshot
WOFB Error Control:    Abort on Error

Launch backup from server side

list Active Shadows in client

C:\>vssadmin list shadows
vssadmin 1.1 - Volume Shadow Copy Service administrative command-line tool
(C) Copyright 2001 Microsoft Corp.

Contents of shadow copy set ID: {3fb9de9c-9e15-4ded-97ea-bd5e85c9cff2}
   Contained 2 shadow copies at creation time: 5/8/2012 12:21:25 PM
      Shadow Copy ID: {f552e1e3-cf6a-4852-bf47-7596f59f05ad}
         Original Volume: (C:)\\?\Volume{ee361175-c2f4-11dd-bcbc-806e6f6e6963}\
         Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy41
         Originating Machine: server.local
         Service Machine: server.local
         Provider: 'Microsoft Software Shadow Copy provider 1.0'
         Type: ApplicationRollback
         Attributes: Persistent, No auto release, Differential

      Shadow Copy ID: {70101cd7-98e2-462a-9c1d-ea3331d66f75}
         Original Volume: (D:)\\?\Volume{ee361178-c2f4-11dd-bcbc-001a64f5677c}\
         Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy42
         Originating Machine: server.local
         Service Machine: server.local
         Provider: 'Microsoft Software Shadow Copy provider 1.0'
         Type: ApplicationRollback
         Attributes: Persistent, No auto release, Differential

Contents of shadow copy set ID: {a875af43-d007-4090-8478-0db439b72846}
   Contained 1 shadow copies at creation time: 5/8/2012 12:22:41 PM
      Shadow Copy ID: {d3fd06f5-96b6-4646-aead-ec7e5d11e838}
         Original Volume: (C:)\\?\Volume{ee361175-c2f4-11dd-bcbc-806e6f6e6963}\
         Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy43
         Originating Machine: server.local
         Service Machine: server.local
         Provider: 'Microsoft Software Shadow Copy provider 1.0'
         Type: Backup
         Attributes: Differential

Contents of shadow copy set ID: {9c70ecf1-f150-4926-b65c-3f4e024732d5}
   Contained 1 shadow copies at creation time: 5/8/2012 12:23:10 PM
      Shadow Copy ID: {38162c22-9d11-4b57-ad13-f50dea1b77e4}
         Original Volume: (C:)\\?\Volume{ee361175-c2f4-11dd-bcbc-806e6f6e6963}\
         Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy44
         Originating Machine: server.local
         Service Machine: server.local
         Provider: 'Microsoft Software Shadow Copy provider 1.0'
         Type: Backup
         Attributes: Differential

Checked Event Viewer and errors disappear.

Hope that this information can be useful.

Advertisements

About rodvars
Been working in IT Services/Consulting for the past 15 years. My main areas of work are planning, development, managing and administration System infrastructures focusing on optimizing user processes, enforcing business security, performance enhancements, high availabilty and infrastucture scalability.

One Response to Troubleshooting Event ID 8486 Source WinfSys

  1. Mauro Fonseca says:

    Im working in the Backup Plataform Symantec Veritas Netbackup relases 6.x, 6.5.x and 7.x
    This is a fine trobeshooting report… this event id is not friendly, and this issue its a redblink for any care evt administrator.
    I´m pleasure to find with Rodolfo this solution, and More details folow the link.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: