⚑ Deus Ex Machina ➽ Eventlog Lookup

Deus Ex Machina » Eventlog » Event 8 - VolSnap

VolSnap - 8


Description »
The flush and hold writes operation on volume C: timed out while waiting for a release writes command.
Data formatted as » WORDS
0000: 00000000 00580002 00000000 c0060008
0010: 00000000 00000000 000000f2 00000000
0020: 00000000 00000000 

The value of c0060008 appears to be an NTSTATUS code, but it's not one that I can find documented anywhere. The event itself has a symbolic name of VS_FLUSH_AND_HOLD_IRP_TIMEOUT - so I'd take a guess that that value is defined as that value somewhere.

Another interesting thing to note here is that value, which in this example is 000000f2. That is actually a counter for how many times this event has been logged (for any volume) sine the last reboot. The counter starts from 0, so f2 suggests that this is the 243rd time that this event has been logged since the last reboot.

You may be seeing this error if you have broken a mirror set using diskpart, as described in MS KB840165, or if your disk I/O is generally very busy. One of the recommendations from Microsoft for this error is to schedule your shadow copies for a different time. But this isn't going to help if you've disabled scheduled shadow copies. It could be something like NetBackup that's taking the snapshot. You should probably already have configured your backup program to run at a relatively quiet time of day. Check your disk I/O using performance counters (eg disk queue length, avg secs/read, avg secs/write) to see if you have a disk performance issue.

Various forum posts report that installing the hotfix at MS KB940349 resolves an issue which causes this event to be logged on Win2003. The article does not mention event ID 8, so don't expect miracles from the patch.

If you are using Windows Vista/7/2008/R2 or later, you can use VSS Diagnostics from the Windows SDK.