# VSS Crashing Server



## PaulGuy (Apr 23, 2012)

Hi all!

I am having an issue with one of our servers crashing almost everytime our backup application runs.

Server Specs:
Windows Server 2003 SP2
1x vCPU
4GB RAM
1x 60GB VHD (25GB Free)
1x 200GB VHD (37GB Free)
VM running with Hyper-V
All Windows Updates are up-to-date

This issue was also occuring before the machine was converted to a VM.

We use an Iron Mountain/Autonomy online back application. This has an agent (service) that always stays in a "started" state. The application uses Windows VSS to create a snapshot and then backup over the internet.

We have 2 backup policies configured.
1) A system state policy which kicks off at 2:00am. This backups up all of the system state.
2) Main backup policy which kicks off at 2:30am. This backups up all of the C:\ and D:\ drives

From what i can see, the system crashes with a BSOD and memory dump after the first policy starts. The server then restarts, the backup will resume and complete successfully.

I have a WhoCrashed report showing an issue with *volsnap.sys*. I have tried updating this, rolling back to a previous version, running all the Microsoft hotfixes/rollups i could find and nothing seems to work.

*System Information (local)* 
computer name: AKL_NTSRV1
windows version: Windows Server 2003 Service Pack 2, 5.2, build: 3790
windows dir: C:\WINDOWS
CPU: GenuineIntel Intel(R) Xeon(R) CPU E5620 @ 2.40GHz Intel586, level: 6
1 logical processors, active mask: 1
RAM: 4294189056 total
VM: 2147352576, free: 2043846656

*Crash Dump Analysis*
Crash dump directory: C:\WINDOWS\Minidump

Crash dumps are enabled on your computer.


*On Wed 18/04/2012 2:00:39 p.m. GMT your computer crashed*
crash dump file: C:\WINDOWS\Minidump\Mini041912-01.dmp
This was probably caused by the following module: volsnap.sys (volsnap+0x1EC59) 
Bugcheck code: 0x1000007E (0xFFFFFFFFC0000005, 0xFFFFFFFF8081C790, 0xFFFFFFFFF78E2A68, 0xFFFFFFFFF78E2764)
Error: SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M
file path: C:\WINDOWS\system32\drivers\volsnap.sys
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: Volume Shadow Copy Driver
Bug check description: This indicates that a system thread generated an exception which the error handler did not catch.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem. 
The crash took place in a standard Microsoft module. Your system configuration may be incorrect. Possibly this problem is caused by another driver on your system which cannot be identified at this time. 


*On Wed 18/04/2012 2:00:39 p.m. GMT your computer crashed*
crash dump file: C:\WINDOWS\memory.dmp
This was probably caused by the following module: ntkrpamp.exe (nt!KeBugCheckEx+0x1B) 
Bugcheck code: 0x7E (0xFFFFFFFFC0000005, 0xFFFFFFFF8081C790, 0xFFFFFFFFF78E2A68, 0xFFFFFFFFF78E2764)
Error: SYSTEM_THREAD_EXCEPTION_NOT_HANDLED
file path: C:\WINDOWS\system32\ntkrpamp.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This bug check indicates that a system thread generated an exception that the error handler did not catch.
The crash took place in a standard Microsoft module. Your system configuration may be incorrect. Possibly this problem is caused by another driver on your system which cannot be identified at this time. 
Google query: ntkrpamp.exe Microsoft Corporation SYSTEM_THREAD_EXCEPTION_NOT_HANDLED

I don't think the WhoCrashed report times are correct... Not sure why these would be wrong?

Does anyone have any ideas what else could be causing this? Any troubleshooting steps i could try? 

Any help would be greatly appreciated!


----------



## PaulGuy (Apr 23, 2012)

bump.

Any ideas? It hasn't crashed in two days which is good.... I'm not holding my breath though.


----------



## Rockn (Jul 29, 2001)

You should start a resource monitor on the server and see what happens when the jobs kick off. Is volsnap an Iron Mountain component?


----------



## PaulGuy (Apr 23, 2012)

It crashed again ;<

volsnap is a windows driver.


----------



## Elvandil (Aug 1, 2003)

Have you seen this:

http://support.microsoft.com/kb/967551/
or
http://support.microsoft.com/kb/891957/


----------



## PaulGuy (Apr 23, 2012)

Yeah, i have tried both of those


----------

