Thread Info
  • State Suggested Answer
  • +5 person also asked this people also asked this
  • Locked Locked
  • Replies 25 replies
  • Answers 2 answers
  • Subscribers 16 subscribers
  • Views 74426 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

freeze/thaw VSS failures when Sophos AV is utilized

JamesGolden

Unitrends has an article (5520, https://support.unitrends.com/UnitrendsBackup/s/article/ka040000000PmjMAAS/000005520?_ga=2.69789140.576488646.1505169382-1745831295.1501935182) on getting freeze/thaw VSS failures on devices running Sophos A/V when doing backups. 

I've got one server experiencing this with Unitrends. I've got another server with Windows Server Backups that keep failing , but I haven't tried uninstalling Sophos on the 2nd one yet to verify that this this the same issue.

 

is there any official word from Sophos on this? Has anyone else experienced this? 

 



This thread was automatically locked due to age.
  • 0 in reply to jak

    Do you know in which KB article Microsoft will fix this issue?

  • 0 in reply to Jurjen de Jong

    The Sophos article links to the Microsoft one. You’d have to contact Microsoft for more info as to when they are fixing it exactly and on which platforms.

    Regards,

    Jak

  • 0

    I installed Sophos Enpoint yesterday and backups have been failing since I installed it. They were working fine before. Just switched over from McAfee. Apparently, that was a BAD move. Should have stuck with what works! I have tried all the registry changes. Even tried killing the Health service and backups still fail. This sucks!

  • 0 in reply to Lisa Busby

    Lisa, follow the instructions in article 132691 (https://community.sophos.com/kb/en-us/132691).  for most of my servers though, I think the sweet spot was a setting of 300 seconds though.

    Other than that, once the polling interval is changed, your backups should be good to go, unless its a different issue going on.

    Have you added exclusions for your backup processes and directories?

  • 0 in reply to Lisa Busby

    Hello,

    Out of interest, are you getting the below error message in the event log?

    A VSS writer has rejected an event with error 0x800423f2, The writer's timeout expired between the Freeze and Thaw events.
    Changes that the writer made to the writer components while handling the event will not be available to the requester. Check the event log for related events from the application hosting the VSS writer.
    Operation:
    Thaw Event

    Is the problem you are experiencing actually the same as this thread or could it be a different issue?

    What other errors are you seeing?  Do you have any example log messages?

    The issue as detailed in this thread and https://community.sophos.com/kb/en-us/132691 can't be the same as the one you have if stopping the Sophos Health service doesn't resolve the issue.  The Health service is the only Sophos component that uses transaction registry writing which causes the Microsoft bug as detailed in https://support.microsoft.com/en-gb/help/4460135/making-vss-shadow-copy-fails-with-vss-ws-failed-at-freeze-error.  I guess there is a very remote chance that at the same time as installing Sophos another piece of software has been installed that also writes to the registry using transactions to expose the same issue but that seems very unlikely.

    Regards,

    Jak

Unfiltered HTML