If you receive a volsnap Event ID error on Windows 11 or Windows 10, then this post will help you resolve the problem. The list of Event ID includes 36, 8, 25, 9, 33, 1, 24, 35, 28, 23, 14, 16, etc in Windows 11/10 Event Viewer. Before you begin, ensure you have an administrator account.
What is Volsnap?
Volsnap or Volsnap.sys or Volume Snapshot is a Windows system file that is related to the Volume Shadow Copy service (VSS). Technically it’s a Windows driver file that helps the OS use the Volume Shadow Copy and has access to core files, hardware, etc. VSS is activated whenever there is a backup restore operation, data mining, disk-to-disk backups, etc.
Fix VOLSNAP Event ID error on Windows computers
Here is the list of event IDs followed by reason and solutions.
- volsnap Event ID 1
- volsnap Event ID 8
- volsnap Event ID 9
- volsnap Event ID 14 & Event ID 16
- volsnap Event ID 23
- volsnap Event ID 24 & 35
- volsnap Event ID 25
- volsnap Event ID 28
- volsnap Event ID 33
- volsnap Event ID 36
You will need an admin account to execute the suggested steps.
1] volsnap Event ID 1
VSS creates a buffer area called DIff Area which is used to temporarily write files when the data is moved. This buffer is dynamic and VSS can increase when required. However, when the shadow copy of volume could not create a different area file on volume, you get volsnap Event ID 1 in the logs.
The only solution is to move the Diff Area to a different volume. You can configure the Diff Area so that it is stored on a different volume and ensure it is in NTFS format. Ensure to choose to specify No Limit or at least 15% of the drive’s size or another drive.
Note: When the location of the Diff area is changed, all previous shadow copies are deleted
To configure the shadow copies or the Diff area, you need to go to My Computer > Manage > Right-click on any volume and select Configure Shadow Copies. You can set the diff area to a different volume by selecting a volume from the drop-down list under the Storage area, and then save the changes. Check out the official document for complete details.
2] volsnap Event ID 8
It is related to Volume Snapshot Driver Integrity. If the process times out during the process, and the next one begins, it will result in this error. To resolve this, you need to schedule shadow copies for a different time. So if VSS reattempts, it has enough time to complete it.
3] volsnap Event ID 9
It occurs when the VSS driver doesn’t have enough resources to perform operations. It can be because of low memory or CPU or high disk I/O load.
To resolve this, find out what is taking all the resources, and remove them. You can also choose to run VSS at off-timings and ensure that Diff Area is allocated to a dedicated volume instead of on the same disk.
4] volsnap Event ID 16 & Event ID 14
The shadow copies of volume C: were aborted because of an IO failure on volume C:.
Event ID 16 occurs when the storage which stores VSS is forced dismounted. In the case of Event ID 14, the operation is aborted because of an IO failure.
There is no direct solution, but since these are disk errors, admins can further look into the disk or NTFS events to find what is causing the failure. If needed, the disk can be replaced.
5] volsnap Event ID 23
This is another case where there was insufficient disk space on the volume to create the shadow copy of the volume. The only way out is to move the Diff Area to a volume with more storage capacity or dedicate an NTFS volume to it.
6] volsnap Event ID 24 & volsnap Event ID 35
The event is triggered when there is insufficient disk space on the VSS volume. If the shadow copy is unable to grow, then this will abort the operation as it can further lead to the deletion of older copies. The solution is the same as others that you need to increase the space of VSS and Diff area. Once done, run the backup again.
7] volsnap Event ID 25
It’s triggered when the load on the IO is very high or the shadow copy storage is being copied. In simple words when there is a backup going on, and another backup gets triggered trying to backup the backup, this increases the load and results in failure.
Since the IO load is high IT admins need to formulate a strategy where the backup schedules are spanned across the time to ensure there is no clash. According to Microsoft, you can run the following commands on the host machine to place the shadow copy on another disk:
vssadmin add shadowstorage /For=<driveletter> /On=<destinationdriveletter> /MaxSize=UNBOUNDED vssadmin resize shadowstorage /For=<driveletter> /On=<destinationdriveletter> /MaxSize=UNBOUNDED
Make sure to increase the amount of RAM and resources.
8] volsnap Event ID 28
It occurs because of a problem with non-paged pool allocation. There is a hotfix available from Microsoft. Make sure to apply it.
Read: Fix 0x80042304, The volume shadow copy provider is not registered in the system
9] volsnap Event ID 33
This is logged when the process removes the oldest shadow copy of volume to keep disk space usage for shadow copies of a volume. It works according to the user-defined limit.
To resolve the problem you can either increase the space allocated for VSS or allocate a separate volume so the backup doesn’t run out of space.
9] volsnap Event ID 36
When the VSS is not able to grow the shadow copy storage because of the applied limit, it triggers the error. To resolve this error you can run the following commands to expand the ShadowStorage; drive letters need to be changed accordingly:
Most of the volsnap Event IDs are related to storage space, overlapping backup, and low resources.
How do I turn off Volsnap?
You need to disable or turn off the Volume Shadow Service. However, this will affect some related services such as System Restore and Backup services. On a service, do not allocate any space for VSS and you are through.
Where did volsnap shadow copies disappear?
In case you are missing the older copies, it means, they have been removed and new copies have been placed. It usually happens when space allotted to VSS is limited, and the process needs to create space. Similar to any backup process, it will delete the oldest copy.
