Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net. The EventId.Net for Splunk Add-on assumes that Splunk is collecting information from Windows servers and workstation via the Splunk Universal Forwarder.
The shadow copy of volume <volume> could not create a diff area file on volume <volume>.
|English: Request a translation of the event description in plain English.|
|Concepts to understand:|
What is the diff area?
What is a shadow copy?
I am reinstalling a Dell Inspiron e1505, with a newly installed hard drive with a Windows Vista Business Sp1 (Dell OEM DVD). Following their instructions (installing Media Direct 3.0 Partition first), and the rest went smoothly. I lowered the total space to be used on the restore points with the command:
vssadmin resize shadowstorage /On=C: /For=C: /Maxsize=5GB
So far it has worked well. However I tested the Media Direct Partition for the first time, found that it worked. Shut everything off, boot back into Vista (with the main power switch), then when I went
to create a restore point to install some security software (no third party antivirus/internet security product has been installed) I got this message. I restarted. No hard crashes, however Chkdsk came
in a preboot screen and ran on drive C:.
Tracing back I realized that I had hibernated Vista, then I actuated Media Direct. I believe this may have messed with the state of the hybernated Vista install on the main OS partition, because
when I shut the VISTA PC completely off, go into Media Direct, and exit, and reboot back into Vista, system restore works fine.
In one case, on Windows XP SP2, this Event ID appeared with Event ID 12289 from source VSS immediately after a NTBACKUP of the System State data was started. NTBACKUP finished normally. See EventID 12289 from source VSS.
|Private comment: Subscribers only. See example of private comment|
|Links: EventID 12289 from source VSS|
|Search: Google - Bing - Microsoft - Yahoo - EventID.Net Queue (0) - More links...|
Send comments or solutions
- Notify me when updated