Errors 1017 & 1013

[polgreen]

I am running Retrospect 6.5 on XP Pro and backing up 2 additional XP Pro

machines remotely. The log for the last time that backup worked correctly

is:

 

- 12/22/2004 12:00:30 AM: Copying DRIVE_C (C:) on rushton

12/22/2004 12:00:30 AM: Connected to rushton

12/22/2004 12:12:17 AM: Snapshot stored, 45.2 MB

12/22/2004 12:12:28 AM: Comparing DRIVE_C (C:) on rushton

12/22/2004 12:14:23 AM: Execution completed successfully

Completed: 349 files, 409.2 MB, with 26% compression

Performance: 247.9 MB/minute (288.8 copy, 219.1 compare)

Duration: 00:13:52 (00:10:32 idle/loading/preparing)

 

The next night, backup of this machine failed with the following log:

 

 

Can't use Open File Backup option for DRIVE_C (C:) on rushton, error -1017 (insufficient permissions)

 

- 12/22/2004 11:41:02 PM: Copying DRIVE_C (C:) on rushton

12/22/2004 11:41:02 PM: Connected to rushton

T-13: TPCFolderLoc::StartFind: UFindFirstFile failed, C:\WINDOWS\system32\ntdll.dll, winerr 267, error -1013

Scanning incomplete, error -1013 (malformed name)

 

The following run and all subsequent runs:

 

- 12/24/2004 12:01:35 AM: Copying DRIVE_C (C:) on rushton

12/24/2004 12:01:35 AM: Connected to rushton

T-16: TPCFolderLoc::StartFind: UFindFirstFile failed, \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\WINDOWS\system32\ntdll.dll, winerr 267, error -1013

Scanning incomplete, error -1013 (malformed name)

 

The Dantz KB suggests looking for long paths. I have searched for long paths and all are 253 or less.

 

Any further suggestions would be greatly appreciated.

[awnews]

I've also found Retrospect with OFB to be pretty unreliable (wrt the OFB). I'm running Retro 6.5.350 RDU 5.4.110 under an assortment of systems (e.g. Retro Pro under XP & W2K, Retro MultiServer under XP Pro and W2K Server). Under XP, Retro Pro will use the XP built-in Volume Shadow Copy service (no add-on required) for Open File Backup, with the VSC service start set to Auto. Under W2K (with Retro MS & OFB add-on) it will use Dantz's OFB add-on. I'm not sure what it does on an XP system *with* the OFB add-on (use XP's VSC or Dantz's OFB? I *think* VSC based on messages in the Event Log).

 

So I have systems that are reporting 0 errors for weeks (nightly backups) spontaneously reporting "error -1017":

 

===> Can't use Open File Backup option for DRIVE_C (C:), error -1017 (insufficient permissions)

 

followed by a bunch of errors similar to the below during the backup:

 

===> File "C:\Documents and Settings\user\Application Data\Vendor\Program\TEMP\38280.dat": can't read, error -1020 (sharing violation)

....

 

I can't correlate this with anything in particular (a Windows update [manual]? other software updates? the "need" to reboot a machine that's been running for several weeks). It seems to come and go (e.g. errors reported for a while, an event such as a reboot restores the "0 errors" state until it happens again). OFB/VSC can fail to start/work if there's too much disk activity at that time but I'm not seeing that message in the Retro logs or Windows Event Viewer. I generally don't get *too* concerned since the shared/temp files that are no longer being backed up are exactly that and aren't vital if the system has to be restored.

[polgreen]

Thanks for the input. In my case, I am totally hosed. The backup fails entirely and consistently every night as far as I can tell, so I need a solution.

[natew]

Hi

 

In your case will the backup complete successfully if you turn off open file backup?

 

Thanks

Nate

[awnews]

As I mentioned, I'm running Retrospect Pro 6.5.350 RDU 5.4.110 on an XP Pro machine. I've been seeing Open File Backup problems, so I "borrowed" one of my MultiServer (with OFB) licenses to see if I could get it to use Dantz's OFB option instead of XP's Volume Shadow Copy service on an XP Pro system.

 

 

 

With the defaults set up, I *think* the answer is no--it appears that even with Dantz's OFB option installed, Retro is still using VSC on this XP Pro system.

 

 

 

==== Here's a line from the Retro log:

 

Can't use Open File Backup option for DRIVE_C (C:), error -1017 (insufficient permissions)

 

 

 

==== And here's the time-correlated error in the Event Viewer log:

 

Event Type: Error

 

Event Source: VSS

 

Event Category: None

 

Event ID: 12289

 

Date: 1/14/2005

 

Time: 1:32:05 AM

 

User: N/A

 

Computer: THISPC

 

Description:

 

Volume Shadow Copy Service error: Unexpected error DeviceIoControl(000001EC,0x0053c008,0003A238,0,00039230,4096,[0]). hr = 0x80070057.

 

 

 

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

 

Data:

 

0000: 49 4e 43 49 43 48 4c 48 INCICHLH

 

0008: 33 36 32 00 00 00 00 00 362.....

 

0010: 53 50 52 51 53 4e 50 43 SPRQSNPC

 

0018: 31 36 30 00 00 00 00 00 160.....

 

 

 

(there are bunch more of these Retro error logs and MS Event Viewer logs, but they appear to be time correlated & therefore related). The MS web link returns "We're sorry. There is no additional information about this issue in the Error and Event Log Messages or Knowledge Base databases at this time" so that's useless.

 

 

 

 

 

So it appears that there's some mysterious problem with Microsoft's VSC that is failing, causing Retro to be unable to do OFB. This wasn't true a couple of weeks ago, when the machine had the same version of Retrospect (6.5.350 & RDU) but the Retro log showed zero errors and no VSC errors were in the Event log. There have been minor things done to the machine since them, mostly some recent Windows updates, making me wonder if there are problems with MS's stuff. I checked by WU logs and I *did* do a bunch of WU on 1/3, the day before the VSC errors started on 1/4 (last WU before that was 11/12). And there are many people in this forum reporting OFB problems--check your Event Log and see if there are any VSC errors.

 

 

 

WU done on 1/3/05:

 

Security Update for Windows XP (KB885836) Successful Monday, January 03, 2005 Windows Update website

 

Cumulative Update for Outlook Express for Windows XP (KB887797) Successful Monday, January 03, 2005 Windows Update website

 

Critical Update for Windows XP (KB886185) Successful Monday, January 03, 2005 Windows Update website

 

Security Update for Windows XP (KB885835) Successful Monday, January 03, 2005 Windows Update website

 

Security Update for Windows XP (KB873339) Successful Monday, January 03, 2005 Windows Update website

 

Update for Windows Media Connect Successful Monday, January 03, 2005 Windows Update website

 

 

 

One question--is there a way to *force* Retrospect with Dantz's OFB option to use that OFB rather than the VSC under XP? If there was I could give that a try to see if OFB would work that way by bypassing VSC.

 

 

[natew]

Hi

 

The force option wont work with Retrospect professional.

You can however make Server versions use the Retrospect open file filter (roff).

 

Actually, now I'm not so sure... If you run the setup program you can choose to install the Open File Option in a custom install. Reboot the machine, launch Retrospect and type CTRL + ALT + P + P. There is an option there to force Retrospect to use legacy open file backup rather than the shadow copy service.

 

I suspect Professional looks for the shadow copy service and uses it if its available. I'm not sure it will use roff as an alternative.

 

Hope that helps

Nate

[awnews]

The license I "borrowed" for this test was a (legal, used at another location) MultiServer license. I temporarily entered it in place of the (legal) Pro license on this XP Pro problem machine and it *reports* all license options including OFB. I didn't reinstall anything since I was under the impression that there was really only one version of Retrospect and it was up to the license code to enable/disable specific features. And I changed it back to the Pro license after the (failed) test. I don't recall seeing any custom install OFB options (???). As I mentioned, I'm still seeing the shared file errors (-1017) and VSC errors in the Event Log, so I'm convinced that Retro (MS + OFB option) is using VSC rather than Dantz's custom OFB.

 

Using the CTRL-ALT-SHIFT-P-P method, I found the "Open File Backup" (Preferences) pane. However, it only lists an option for "Use Legacy Restore Methods in Windows XP" and has a "Excluded Writer List" with only one item "MSDEWriter" [must be a default]. This doesn't sound like something I'd want to check since I'm not doing any "Restore" operation and it doesn't say something like "Force Legacy OFB rather than VSC" to do what you what you suggest.

[natew]

Hi

 

Sorry about that. All I had was a Japanese version of Retrospect handy. My translation was wrong.

 

On a Windows XP or 2003 system the legacy open file option is only installed if you select it from a custom install. The file is Windows\system\drivers\roff.sys

 

VSC may have to be disabled for Retrospect to use roff.sys instead.

 

Nate

[polgreen]

I was finally able to run Retrospect with OFB turned off (the offending machine was offsite)

and I still get the same error:

 

T-13: TPCFolderLocStartFind: UFindFirstFile failed, C:\WINDOWS\system32\ntdll.dll, winerr 267, error -1013

Scanning incomplete, error -1013 (malformed name)

 

In addition to all the other errors relating to not being able to back up open files.

 

Any other suggestions?

[natew]

Hi

 

The malformed name error usually can be taken at face value. There is a corrupt or invalid filename on the disk causing problems in the file scan.

 

Have you run a thorough scandisk with all of the disk scan options enabled? Are you able to backup subvolumes from this machine?

 

Thanks

Nate

[polgreen]

Nate,

 

I have run XP's Error Checking tool with both options selected. I didn't have patience to

watch it til it finished and when I returned there was no log info available to tell me whether anything was fixed or not.

 

I have run a remote full backup of the offending drive. At the end of the initial scan, I was total that there was a fatal error and I should check the log. There was no indication of an error in the log and the job continued running to completion.

 

Tonight, I will let the standard scheduled backup occur. If it fails again I'll be back.

 

Thanks for your help.

[polgreen]

Nate,

 

I just finished a scheduled backup of all 3 machines. The 1013 error occurred yet again

inspite of the Error Checking run.

 

In your last message you asked if I could run on subvolumes. I'm not clear on what you

mean or what you are trying to find out? Should I do some sort of binary search to determine exactly where the failure is occurring?

 

Tom

[natew]

Hi

 

A subvolume is just a subfolder on the disk. I'm curious if you can back up pieces of the disk rather than the disk as a whole. Using subvolumes we can often narrow down corruption to one directory or portion of the hard disk.

 

Thanks

Nate

[polgreen]

Nate,

 

I'm back at this one after a break. Here's what I have discovered:

 

The file ntdll.dll (C:\Windows\system32) has been corrupted in the following

weird way. While the file exists in the directory, a copy of the file with the same name

has the folder attribute set. I have renamed the offending file but cannot delete it.

Even using XP's Recovery Console, I still cannot delete the file/folder. Under regular

XP I get the error that the folder name is invalid. I can move the file to another location

on the disk.

 

Note that using either XP's native Disk Checking or XP Recovery Console's CHKDSK

finds nothing wrong.

 

I finally decided to move the offending file to a directory which I've excluded from back ups

using the custom settings in Retrospect. I put the invalid file/folder in the Temporary Internet

Files folder. Retrospect still refused to complete the backup - complaining as always that there is a 1013 error, now in the shadow copy of the Temporary Internet Files directory which

I've set to not be backed up.

 

Any suggestions????

[natew]

Hi

 

Do you have another partition on this machine? You could install Windows on the new partition boot from it and then delete the problem folder/file. BartPE is a utility that will let you boot into Windows from a CD image. You may be able to get rid of the file that way too.

 

Thanks

Nate