How to delete AALogs change logs (4033577)

The following provides options for removing change logs (AALogs) stored in the System Volume Information folder. These logs are named with the prefix AALog_ followed by an ID, for instance, AALog_{15f075c8-193a-11e7-a5c6-180373d9df42}_000001b8.log.

When backups fail repeatedly or protection is paused for extended periods, change logs can accumulate in size and number. This can lead to issues such as the System Volume Information folder becoming full or the Agent being unable to process them. Deleting these logs allows backups to resume properly.

Below are three methods to delete AALogs:

Solution 1: Use the Core Console

1. Open the Core Console and navigate to the Summary page of the machine requiring log clearance.

2. Locate the Volumes section, select the volume(s) needing clearance, and open the Protection Schedule.

3. Remove the volume(s) from protection and click Apply.

4. Refresh metadata and wait for several minutes.

5. Re-add the volume(s) to the protection schedule and click Apply. The logs should now be cleared.

   Note: If the logs are not removed, repeat the above steps with a longer wait during Step 4. Alternatively, force a base image of the affected volume within its own protection group to clear the logs.

Solution 2: Use PsExec

For volumes with 0 bytes of free space, PsExec can facilitate log deletion without requiring permission modifications. Refer to the article Unable to Change Permissions on a Volume with No Free Space (4378142) for step-by-step guidance on accessing the System Volume Information folder as the SYSTEM user via PsExec.

Solution 3: Use FltMC or AssureMC

Important: Using Solution 3 might trigger an unexpected system reboot once the filter driver is unloaded.

1. Stop the Agent Service:

   • Stop the Agent Service and set it to Disabled.

2. Assign a Drive Letter (if needed):

   • Assign a drive letter through Disk Management (diskmgmt.msc) if working with the System Reserved Partition (SRP volume).

3. Gain Access to the Folder:

   • Use one of these methods to unload the filter driver and access the folder:

     • FltMC Method: Open an elevated command prompt and run:

       fltmc unload aafsflt

     • AssureMC Method: Download the correct AssureMC version (x86 or x64), unblock the download if needed, and unzip the contents. Navigate to the directory containing AssureMC and run:

       assuremc disable <Drive_Letter>:

       Replace <Drive_Letter> with the appropriate volume.

4. Delete the Logs:

   • Navigate to the System Volume Information folder in an elevated command prompt:

     cd <Drive_Letter>:\System Volume Information

   • Delete the logs:

     del aalog*.*

5. Reload the Filter Driver:

   • Use one of these methods:

     • FltMC Method:

       fltmc load aafsflt

     • AssureMC Method:

       assuremc enable <Drive_Letter>:

6. Restore Settings:

   • Remove the assigned drive letter if working with the SRP volume.

   • Set the Agent Service to Automatic (Delayed Start) and restart it.

References

• Unable to Change Permissions on a Volume with No Free Space (4378142)