Return
-
Title
Determining the cause of a base image -
Description
AppAssure may take a new base image for a variety of reasons. For a detailed list of reasons please see this KB article - https://support.quest.com/kb/118467
This article details how to find the specific reason for a base image on an agent machine.
-
Resolution
The core logs (C:\AppRecovery.log) will contain the reason why a base image was needed.
To parse the logs and find the reason, we must have the following information:
Agent name that is taking new base images
Time that the base(s) were created
AppAssure keeps approximately 100 MBs of logs on the C volume. These logs will contain the message related to the new base image creation. It is recommended that the logs be parsed immediately following a base image since high usage AppAssure environments may overwrite the logs quickly. In lower usage environments the logs may contain as much as 30+ days worth of logs.
Here is an example of log messages related to base image creation:
INFO 2013-11-22T19:56:44 [61] – Events.Protection.Transfer.TransferStartedEvent () Transferring backup of ‘C:\’ on ‘SJSERVER’
WARN 2013-11-22T19:56:44 [933] – Replay.Core.Implementation.Transfer.TransferJob (Transfer ID ’7619d800-0fb4-4477-b6db-23e02ce74aea’ of volumes [\\?\Volume{50b87cdd-f3c9-11de-b5c1-806e6f6e6963}\] from ‘SJSERVER’) AppAssure 5 has detected the presence of Symantec Protection Software on SJSERVER. Some customers have experienced configuration difficulties between this software and AppAssure 5, preventing backups or causing incorrect behavior. Please review the KB article at https://support.quest.com/appassure/kb/117506 for more details.
DEBUG 2013-11-22T19:58:44 [255] – Replay.Agent.Client.TransferManagementAgentClient (DetermineDataToSendTask AgentDisplayName=SJSERVER VolumeName=C:\) GET https://sjserver:8006/apprecovery/api/agent/transfer/snapshots/a16fcc73-d3c2-4a4c-8b79-3b0dc9077408/volumes/~|~~|~%253f~|~Volume%257b50b87cdd-f3c9-11de-b5c1-806e6f6e6963%257d~|~/blocks/changed failed with HTTP status code InternalServerError
INFO 2013-11-22T19:58:44 [255] – Events.Protection.Transfer.VolumeTransferStartedEvent (DetermineDataToSendTask AgentDisplayName=SJSERVER VolumeName=C:\) Transferring 20.46 GB base image of ‘C:\’ on ‘SJSERVER’
INFO 2013-11-22T20:09:52 [237] – Replay.Core.Implementation.Transfer.VolumeTransferJob (DetermineDataToSendTask AgentDisplayName=SJSERVER VolumeName=D:\) Volume is dirty or not enabled, so a base image will be performed
INFO 2013-11-22T20:09:52 [237] – Events.Protection.Transfer.VolumeTransferStartedEvent (DetermineDataToSendTask AgentDisplayName=SJSERVER VolumeName=D:\) Transferring 168.64 GB base image of ‘D:\’ on ‘SJSERVER’
Notice at 19:56:44, the server started the backup of this agent and at 19:58:44 the core logged that it is unable to get the changed blocks (“Unexpected exception getting changed blocks for volume; a base image will be forced”). The reason why changed blocks (the AppAssure change log file) were unable to be accessed is unknown. However, the logs do point out that Symantec is present which may be a potential cause.
At 20:09:52, the core logged that the volume is dirty or not enabled for D: (meaning that either the volume has never been protected or is marked as being in a dirty shutdown state). In the case of a dirty shutdown, a base image will be taken, as AppAssure cannot guarantee that all block changes were tracked properly on the volume.
__________
Is your AppAssure or Rapid Recovery solution working as efficiently as possible? Learn more about our AppAssure and Rapid Recovery Health Check.