I have a Windows Server 2012 R2 running Veritas Enterprise Vault (EV). For backups of index data/metadata we put EV into backup mode and take a snapshot of the disks using the underlying SAN storage, then mount that snapshot on a backup server to protect it. We have been intermitently seeing a few corrupt files on the snapshot disks, and have been working with vendors to find a cause, to no avial. The current theory is that even though we put the application in backup mode, something is still accessing the files as we take the snapshot. So my question is - does anyone know of a way we can monitor the files in a particular filesystem on the source server and record any processes that try to access them (as we take the snapshot)? Ideally it would be something we can run continuously, but maybe even an on-demand scan started just before the snapshot would be able to tell us something.

Thanks in advance.

  • 1
    ProcMon from Sysinternals (Microsoft) can watch all process and file activity and filter for specific criteria. – music2myear Oct 23 '18 at 23:48
  • Do the offending applications have VSS writers and are they functioning properly? Unless an application subscribes to VSS events it has no way of knowing it needs to make its data ready for a snapshot. – Twisty Impersonator Oct 24 '18 at 0:21
  • Twisty Impersonator - No vss is not involved. music2myear - can you post an answer with some more details/example? I dont remember procmon having this functionality. – Zenshai Oct 24 '18 at 0:55
  • I am a little confused by your post. VSS is used for snapshotting open files. Sounds like that would be the job of Veritas. Why do you say VSS is not involved? – Appleoddity Oct 24 '18 at 1:17
  • The issue is occuring during the snapshot process. The snapshot is taken from the backend EMC storage frame without the Windows OS's knowledge. However, in order to prevent any use of the filesystems where snapshots are being taken, the application (EV) is put into backup mode which is suppsed to prevent it from using the filesystem. Veritas NBU and VSS does not get involved until we have taken the snap and mounted it on another server, by that time the corruption is already present on the snapshot (we cant browse to a few of the files with Windows expolorer). – Zenshai Oct 24 '18 at 14:42

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.