1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
|
device: 0.967
virtual: 0.966
register: 0.965
assembly: 0.960
hypervisor: 0.960
arm: 0.960
semantic: 0.957
architecture: 0.955
network: 0.954
permissions: 0.952
user-level: 0.951
graphic: 0.950
PID: 0.949
vnc: 0.946
performance: 0.946
socket: 0.941
debug: 0.939
files: 0.937
KVM: 0.936
peripherals: 0.928
VMM: 0.926
ppc: 0.925
kernel: 0.921
risc-v: 0.913
boot: 0.912
TCG: 0.910
x86: 0.909
mistranslation: 0.898
i386: 0.670
Windows QEMU Guest Agent VSS Provider service stops during qemu backup
I’m currently implementing the QEMU Guest Agent on all my KVM Windows guests.
I’m using the stable VirtIO drivers and Guest agent from Fedora: https://fedoraproject.org/wiki/Windows_Virtio_Drivers
Both the stable and latest release do provide Qemu Windows Guest agent 7.0.0.10.
After the Guest agent installation I initially received VSS events with ID 8194:
Volume Shadow Copy Service error: Unexpected error querying for the IVssWriterCallback interface. hr = 0x80070005, Access is denied.
This is often caused by incorrect security settings in either the writer or requestor process.
Operation:
Gathering Writer Data
Context:
Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220}
Writer Name: System Writer
Writer Instance ID: {6c777a34-53dd-4fb3-a4c9-b85d7e183e27}
I was able to fix this issue by adding local access permissions for the “Network Service” account at the Dcom security permissions:
On the client computer from the Start Menu, select Run
The Run dialog opens.
In the Open field type dcomcnfg and click OK.
The Component Services dialog opens.
Expand Component Services, Computers, and My Computer.
Right-click My Computer and click Properties on the pop-up menu.
The My Computer Properties dialog opens.
Click the COM Security tab.
Under Access Permission click Edit Default.
The Access Permissions dialog opens.
From the Access Permissions dialog, add the "Network Service" account with Local Access allowed.
Close all open dialogs.
Now an initial backup runs without any errors but this is causing the QEMU Guest Agent VSS Provider service to stop running without any error in the event log.
As a result a second backup will cause an error: MSDTC Client 2 with event ID: 4879:
MSDTC encountered an error (HR=0x80000171) while attempting to establish a secure connection with system SERVERNAME.
This is probably caused because the QEMU Guest Agent VSS Provider service isn’t running anymore.
I can manually start the QEMU Guest Agent VSS Provider service but every backup is causing the service to stop.
I’m seeing this behavior at all my Windows based guests running both Windows Server 2012 R2 and Windows Server 2008 R2.
Since I can’t find any logging or troubleshooting possibilities for this particular service I'm open for suggestions how to troubleshoot this issue to receive detailed information about the reason why this services stops running during a backup.
qemu-server 3.4-3 amd64
Guest agent 7.0.0.10
After upgrading to QEMU guest agent 7.2.1 this issue disappeared.
The only minor "issue" that remains is that the QEMU Guest Agent VSS Provider service is being installed with start-up type: Automatic.
After a backup the service is automatically being stopped causing monitoring systems like the Windows server manager to complain about stopped services with start-up type automatic.
Because the Qemu guest agent starts the VSS provider service automatically when a backup is being triggered this can easily be solved by changing the start-up type to: manual.
I have now changed the start-up type to manual using GPO for all my Qemu Windows guests.
I have filed a bug report at Redhat with the request to change the service start-up type to manual for the provided MSI install packages.
https://bugzilla.redhat.com/show_bug.cgi?id=1286672
Hi Joop,
From where did you find QEMU guest agent 7.2.1 ? I am looking for one for RHEL 7. Any idea where can I find it ?
Thanks,
Ravi
Hello Ravi,
You can find it at the Fedora Windows VirtIO Drivers wiki page that I provided in my first post.
Here's a direct link to the latest 7.2.1 guest agent:
https://fedorapeople.org/groups/virt/virtio-win/direct-downloads/archive-qemu-ga/qemu-ga-win-7.2.1-1/
Hello Ravi,
Just noticed that you are looking for a RHEL 7 guest agent instead of the Windows version.
Not sure what the latest Linux release is but the standard repos currently provide release 2.3.0.
If you need a newer version you need to search for a 3th party rpm or compile it yourself from source.
Thanks Joop, I am looking for Windows 2012 guest agent only. Let me try the 7.2.1 guest agent.
Well, I am still getting this error.
Volume Shadow Copy Service error: Unexpected error querying for the IVssWriterCallback interface. hr = 0x80070005, Access is denied.
. This is often caused by incorrect security settings in either the writer or requestor process.
Operation:
Gathering Writer Data
Context:
Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220}
Writer Name: System Writer
Writer Instance ID: {07dc130c-35da-4bd1-9948-2b4501249c3b}
Finally it worked.
I had to carry out DCOM config that you suggested earlier in addition to installation of 7.2.1
Thanks,
Ravi
Have you tried my manual steps to fix this issue?
On the client computer from the Start Menu, select Run
The Run dialog opens.
In the Open field type dcomcnfg and click OK.
The Component Services dialog opens.
Expand Component Services, Computers, and My Computer.
Right-click My Computer and click Properties on the pop-up menu.
The My Computer Properties dialog opens.
Click the COM Security tab.
Under Access Permission click Edit Default.
The Access Permissions dialog opens.
From the Access Permissions dialog, add the "Network Service" account with Local Access allowed.
Close all open dialogs.
If the issue has not been fixed for you I suggest to reopen the bug (I'm the original bug reporter not the bug fixer)
|