Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 12297 Source: VSS

Volume Shadow Copy Service error: The I/O writes cannot be flushed during the shadow copy creation period on volume <volume>. The volume index in the shadow copy set is <volume>. Error details: Flush[0x8000ffff] Release[0x00000000] OnRun[0x00000000].
I was troubleshooting a failure with Norton Ghost 14 where this event occured right before a Ghost failure event. This was the Ghost error: Error EC8F17B7: Cannot create recovery points for job: Drive Backup of C-drive (C:\). Error E7B70001: Win32/Win64 API DeviceIoControl(IOCTL_VSNAP_SET_SNAP_VOLUMES) failed. Error EBAB03F1: The device does not recognize the command.

T734484 provides some troubleshooting information about this problem.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.