Random Base Images for Protected VM Agents "Event ID 9289: AAFsFlt" (4036393)

• The AppAssure/Rapid Recovery Core is transferring random base images for protected virtual guests, and there have been no known reasons for additional base images.
• At the same time these guests are protected by AppAssure/Rapid Recovery, VM snapshots may also be enabled for the host’s guests.

NOTE:
Other reasons for unexpected base images should be investigated prior to continuing with the information that follows below.

For more specifics on why unexpected base images are snapped and transferred, please take a look at this KB article:

Unexpected Base Images Created in AppAssure 5 or Rapid Recovery 6

In your system event logs, following trail of events will be found:

• Event 1) Event ID 7036: The Volume Shadow Copy service entered the running state.
• Event 2) Event ID 7036: The VMware Snapshot Provider service entered the running state.
• Event 3) Event ID 9289: AAFsFlt cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer. If the event originated on another computer, the display information had to be saved with the event.

When the VMware Snapshot initiates with the quiescing option selected, it prevents the AppAssure filter drivers from accessing the AppAssure change log, and this condition forces changelogs to revert to base snapshot behavior.

More information on event ID 7036: Event ID 7036 — Basic Service Operations

To resolve the issue of having random base images snapping for protected virtual agents, disable the quiescing option for those guests within the vmware hypervisor itself.

This link from VMware details further how the snapshot process works: Overview of virtual machine snapshots in vSphere (1015180)