Код ошибки 36 volsnap

If you receive a volsnap Event ID error on Windows 11 or Windows 10, then this post will help you resolve the problem. The list of Event ID includes 36, 8, 25, 9, 33, 1, 24, 35, 28, 23, 14, 16, etc in Windows 11/10 Event Viewer. Before you begin, ensure you have an administrator account.

What is Volsnap?

Volsnap or Volsnap.sys or Volume Snapshot is a Windows system file that is related to the Volume Shadow Copy service (VSS). Technically it’s a Windows driver file that helps the OS use the Volume Shadow Copy and has access to core files, hardware, etc. VSS is activated whenever there is a backup restore operation, data mining, disk-to-disk backups, etc.

Here is the list of event IDs followed by reason and solutions.

1. volsnap Event ID 1
2. volsnap Event ID 8
3. volsnap Event ID 9
4. volsnap Event ID 14 & Event ID 16
5. volsnap Event ID 23
6. volsnap Event ID 24 & 35
7. volsnap Event ID 25
8. volsnap Event ID 28
9. volsnap Event ID 33
10. volsnap Event ID 36

You will need an admin account to execute the suggested steps.

1] volsnap Event ID 1

VSS creates a buffer area called DIff Area which is used to temporarily write files when the data is moved. This buffer is dynamic and VSS can increase when required. However, when the shadow copy of volume could not create a different area file on volume, you get volsnap Event ID 1 in the logs.

The only solution is to move the Diff Area to a different volume. You can configure the Diff Area so that it is stored on a different volume and ensure it is in NTFS format. Ensure to choose to specify No Limit or at least 15% of the drive’s size or another drive.

Note: When the location of the Diff area is changed, all previous shadow copies are deleted

To configure the shadow copies or the Diff area, you need to go to My Computer > Manage > Right-click on any volume and select Configure Shadow Copies. You can set the diff area to a different volume by selecting a volume from the drop-down list under the Storage area, and then save the changes.  Check out the official document for complete details.

2] volsnap Event ID 8

It is related to Volume Snapshot Driver Integrity. If the process times out during the process, and the next one begins, it will result in this error. To resolve this, you need to schedule shadow copies for a different time. So if VSS reattempts, it has enough time to complete it.

3] volsnap Event ID 9

It occurs when the VSS driver doesn’t have enough resources to perform operations. It can be because of low memory or CPU or high disk I/O load.

To resolve this, find out what is taking all the resources, and remove them. You can also choose to run VSS at off-timings and ensure that Diff Area is allocated to a dedicated volume instead of on the same disk.

4] volsnap Event ID 16 & Event ID 14

The shadow copies of volume C: were aborted because of an IO failure on volume C:.

Event ID 16 occurs when the storage which stores VSS is forced dismounted. In the case of Event ID 14, the operation is aborted because of an IO failure.

There is no direct solution, but since these are disk errors, admins can further look into the disk or NTFS events to find what is causing the failure. If needed, the disk can be replaced.

5] volsnap Event ID 23

This is another case where there was insufficient disk space on the volume to create the shadow copy of the volume. The only way out is to move the Diff Area to a volume with more storage capacity or dedicate an NTFS volume to it.

6] volsnap Event ID 24 & volsnap Event ID 35

The event is triggered when there is insufficient disk space on the VSS volume. If the shadow copy is unable to grow, then this will abort the operation as it can further lead to the deletion of older copies. The solution is the same as others that you need to increase the space of VSS and Diff area. Once done, run the backup again.

7] volsnap Event ID 25

It’s triggered when the load on the IO is very high or the shadow copy storage is being copied. In simple words when there is a backup going on, and another backup gets triggered trying to backup the backup, this increases the load and results in failure.

Since the IO load is high IT admins need to formulate a strategy where the backup schedules are spanned across the time to ensure there is no clash.  According to Microsoft, you can run the following commands on the host machine to place the shadow copy on another disk:

vssadmin add shadowstorage /For=<driveletter> /On=<destinationdriveletter> /MaxSize=UNBOUNDED
vssadmin resize shadowstorage /For=<driveletter> /On=<destinationdriveletter> /MaxSize=UNBOUNDED

Make sure to increase the amount of RAM and resources.

8] volsnap Event ID 28

It occurs because of a problem with non-paged pool allocation. There is a hotfix available from Microsoft. Make sure to apply it.

9] volsnap Event ID 33

This is logged when the process removes the oldest shadow copy of volume to keep disk space usage for shadow copies of a volume. It works according to the user-defined limit.

To resolve the problem you can either increase the space allocated for VSS or allocate a separate volume so the backup doesn’t run out of space.

9] volsnap Event ID 36

When the VSS is not able to grow the shadow copy storage because of the applied limit, it triggers the error. To resolve this error you can run the following commands to expand the ShadowStorage; drive letters need to be changed accordingly:

Most of the volsnap Event IDs are related to storage space, overlapping backup, and low resources.

How do I turn off Volsnap?

You need to disable or turn off the Volume Shadow Service. However, this will affect some related services such as System Restore and Backup services. On a service, do not allocate any space for VSS and you are through.

Where did volsnap shadow copies disappear?

In case you are missing the older copies, it means, they have been removed and new copies have been placed. It usually happens when space allotted to VSS is limited, and the process needs to create space. Similar to any backup process, it will delete the oldest copy.

A volsnap error shows up when you are dealing with low disk space in any drive (C, D, E or F Drive or any external Disk Drive). When this error appears, you would not be able to take a backup.

If you are using a hard disk which you are trying to backup, you may see a message such as “Failed to Backup”.

The Volsnap source errors are events that are listed in the Windows System event log. Such events usually contain relevant troubleshooting information as to why the shadow copy got dismounted and as a result, causes the backups to fail.

The shadow copies of volume D: were aborted because the shadow copy storage could not grow due to a user-imposed limit.

Description

What is a Shadow Copy?

Shadow Copies are nothing but Snapshots. A feature available in Windows file which creates these snapshots of a disk volume. You can create or store these snapshots or shadow copies on a local disk, an external hard drive, or even a network drive.

It is a type of technology which enables backup of files and creates snapshots of files and drives based on a schedule.

You have probably more shadow copies than you may know. Every time a system restore point is created, you will have a shadow copy.

Every time a system restore point is created, you will have a valid shadow copy. 

Shadow copy is what you use to recover deleted files.

Procedure to fix Volsnap Error

Firstly, identify the volume ID in Event Viewer.

Then go to the Shadow copy configuration window by right-clicking on any storage drive > click on Configure Shadow Copies option

Now, check how much free disk space is available on the system volume in Windows Explorer.

Open Control Panel > System > Advanced System Settings.

On shadow copies configuration window select the volume id same as shown in the event.

Click on Setting > Under Maximum Size : Select Use limit > Set it on 320 MB > Click on OK

Then again go to Settings for the same storage id > Under Maximum Limit option Use Limit as “10% of total storage of that drive” > Click on OK

For example: If your drive’s total size is 100 GB then the shadow storage should be 10 GB.

Once you do this, the error should not appear again.

Some of these blogs may be of interest to you: 

How to fix Microsoft Error Code 80090016 

IT Outsourcing from India: 6 reasons why you should 

How to get the right clients for your MSP Business 

Fix Clock Drift Monitoring Error on N-able N-central 

ConnectWise Automate: Show devices that are more than X years old 

Take Control RDP Connections not working in N-Central