Print | Rate this content

Veritas - Backup Fails VSS Event ID 12292 Followed by Event ID 10 Are Logged

ISSUE:

VERITAS Backup fails with event ID 12292 and event Id 10

SOLUTION:

The below event ID were logged......

Event Logs:
===========
Event Type: Error
Event Source: VSS
Event Category: None
Event ID: 12292


Description:
Volume Shadow Copy Service error: Error creating the Shadow Copy Provider COM class with CLSID {65ee1dba-8ff4-4a58-
ac1c-3470ee2f376a} [0x80080005].

Event Type: Error
Event Source: VSS
Event Category: None
Event ID: 10


Description:
-------------
The description for Event ID ( 10 ) in Source ( VSS ) cannot be found. The local computer may not have the necessary
registry information or message DLL files to display messages from a remote computer. You may be able to use the
/AUXSOURCE= flag to retrieve this description; see Help and Support for details. The following information is part
of the event: {65ee1dba-8ff4-4a58-ac1c-3470ee2f376a}, SW_PROV, 0x80080005.

Questions to ask ?
------------------

  1. Did we try backing up the data using Ntbackup?

  2. Does this happen every time when they do backups using Veritas. if yes can they reproduce it?

  3. Is there any machine in their network where they have installed the Veritas software and backup works on it?

  4. What errors do we see in Vssadmin list writers and providers?

  5. Do they run the backups manually or is it a script?

What Data do we need to analyze
--------------------------------

  • Collect HPS or MPS reports
  • Run the command vssadmin list writers and vssadmin list providers see if we have any errors.

Explanation
------------

NOTE: (IN our case backing up the data using NTBACKUP was working)

Keeping in Mind that Ntbackup.exe works fine but using VERITAS the backup fails with vss errors event ID 12292 and event ID 10, these type of issues generally occur when the VSS dll's not registered correctly. Such issues get corrected after apply the latest VSS binary's. and re-registering the .dll files.

-In order to correct the issue we need to download the following hotfixes and install them on the affected server.

Step 1:
=======
Install the following hotfixes

940252
927435
924729

-Restart the server after you install the above hotfixes

Step 2.
=======
Re-register the following .dll files

From the command prompt from C:\Windows\System32 run the following:


Net stop vss
Net stop swprv

regsvr32.exe /i eventcls.dll
regsvr32.exe /i swprv.dll
regsvr32.exe vssui.dll
regsvr32.exe vss_ps.dll
regsvr32.exe msxml.dll
regsvr32.exe msxml2.dll
regsvr32.exe msxml3.dll
regsvr32.exe msxml4.dll
regsvr32.exe ole32.dll
regsvr32.exe oleaut32.dll
regsvr32.exe es.dll
vssvc /register

-Restart the server after re-registering the .dll's and test the backup.

-------------------------------------------------------------------------------------------------------------------

NOTE: In our case after doing the above workarounds the issue was resolved backups were success, but we were getting VSS event id's 20 and 8193 as shown below.

Event Logs:
===========
Event Type:Error
Event Source:VSS
Event Category:None
Event ID:20

Description:
-------------
Volume Shadow Copy Service error: A critical component required by the Volume Shadow Copy service is not registered. This might happened if an error occurred during Windows setup or during installation of a Shadow Copy provider. The error returned from CoCreateInstance on class with CLSID {faf53cc4-bd73-4e36-83f1-2b23f46e513e} and Name VSSEvent is [0x80040154].

Event Type:Error
Event Source:VSS
Event Category:None
Event ID:8193

Description:
-------------
Volume Shadow Copy Service error: Unexpected error calling routine CoCreateInstance. hr = 0x80040154.

-Why do we still get these errors / event ID 20 and 8193?
Refer to Article 940032 Non-HPE site http://support.microsoft.com/kb/940032/en-us

Cause:
---------

  1. Eventcls.dll was not registered
  2. Path to the poll the Eventcls.dll is not pointing to %Windir%\system32
  3. If the VSS system files are not registered properly

(OR)

Due to
HKLM\Software\Microsoft\EventSystem\{26c409cc-ae86-11d1-b616-00805fc79216}\Subscriptions key.

Recommendation / Action Plan:
-------------------------------------------
==>Check the below registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EventSystem\{26c409cc-ae86-11d1-b616-00805fc79216}\EventClasses\{FAF53CC4-BD73-4E36-83F1-2B23F46E513E}-{00000000-0000-0000-0000-000000000000}-{00000000-0000-0000-0000-000000000000}


Note :- It should point to "TypeLib"="C:\WINDOWS\system32\EVENTCLS.DLL"

It should be as follows:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EventSystem\{26c409cc-ae86-11d1-b616-00805fc79216}\EventClasses\{FAF53CC4-

BD73-4E36-83F1-2B23F46E513E}-{00000000-0000-0000-0000-000000000000}-{00000000-0000-0000-0000-000000000000}]
"Active"=dword:00000001
"EventClassID"="{FAF53CC4-BD73-4E36-83F1-2B23F46E513E}"
"EventClassName"="VssEvent"
"OwnerSID"="S-1-5-18"
"TypeLib"="C:\WINDOWS\system32\EVENTCLS.DLL"
"AllowInprocActivation"=dword:ffffffff
"FireInParallel"=dword:00000000
"EventClassPartitionID"="{00000000-0000-0000-0000-000000000000}"
"EventClassApplicationID"="{00000000-0000-0000-0000-000000000000}"

-Now go to C:\windows\system32 and re-register the eventcls.dll

Syntax:
--------
C:\Windows\System32>Regsvr32 EVENTCLS.DLL

=============================================================================================================================================================
Action Plan 2 (Do this action if you still get errors)

  1. net stop vss

    1. CD %systemroot%\system32

  2. regsvr32 ole32.dll

  3. regsvr32 vss_ps.dll

  4. Vssvc /Register

  5. regsvr32 /I swprv.dll

  6. regsvr32 /I eventcls.dll

  7. regsvr32 es.dll

  8. regsvr32 stdprov.dll

  9. regsvr32 vssui.dll

  10. regsvr32 msxml.dll

  11. regsvr32 msxml3.dll

  12. regsvr32 msxml4.dll

  13. Stop the Following services:

    Volume Shadow Copy Service.
    MS Software Shadow Copy Provider
    "COM+ event system"
    "COM+ System Application"

  14. Take the backup of the "Subscriptions" key

    HKLM\Software\Microsoft\EventSystem\{26c409cc-ae86-11d1-b616-00805fc79216}\Subscriptions

  15. Delete the "Subscriptions" key

  16. Restart/Start the following services:

    "COM+ event system"
    "COM+ System Application"
    "Microsoft Software Shadow Copy Provider"
    "Volume Shadow Copy"

  17. Reboot the machine.

==Run the command "VSSadmin List Writers" from the command prompt.
==Check to see if you get a list of writers and no errors in the event logs
==Test the backup.

Received confirmation from customer that issue is resolved after the above action plans were done.

Legal Disclaimer: Products sold prior to the November 1, 2015 separation of Hewlett-Packard Company into Hewlett Packard Enterprise Company and HP Inc. may have older product names and model numbers that differ from current models.

Provide feedback

Please rate the information on this page to help us improve our content. Thank you!
Document title: Veritas - Backup Fails VSS Event ID 12292 Followed by Event ID 10 Are Logged
Document ID: emr_na-c01316043-1
How helpful was this document?
How can we improve this document?
Note: Only English language comments can be accepted at this time.
Please wait while we process your request.