Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 517 Source: Backup

Backup started at "5/6/2009 2:21:41 PM" failed with following error code "2155348237" (Enumeration of the files failed.). Please rerun backup once issue is resolved.
This blog article helped me: EV100425 (Reasons why the error Enumeration of the files failed may occur).
Log-Message in the file c:\windows\Logs\WindowsServerBackup\ was
Error in backup of c:\windows\\systemroot\ during enumarte: Error [0x8007007b] The filename...


Changing the ImagePath from:




solved the issue on two VMs.
I was getting event id: 517, and error 2155347997. Make sure you check the backup logs for errors:

In my case, I found this error:
Error in backup of C:\windows\\systemroot\ during enumerate: Error [0x8007007b] The filename, directory name, or volume label syntax is incorrect.

The problem was caused by VMWare tools. I changed this in regedit and ran the backup again:

ImagePath: \system32\drivers\lsi_sas.sys


ImagePath: system32\drivers\lsi_sas.sys
Error code 2155348010, error message: One of the backup files could not be created. - This thread - EV100274 (Backup displays message 0x8078002a) discusses this at length, however, KB982018 hotfix cited therein was found to be "not applicable to my system" (WS2008 R2 SP1) and thus did not fix it. Neither did reformatting at a variety of cluster sizes.
This message can be recorded in a variety of conditions, with different error codes/error message combinations. The troubleshooters should use those particular error codes when searching for solution applicable to their case.

T364835 provides some very generic suggestions on how to troubleshoot this type of event (and this is understandable as each variation of this event requires a different approach).
Error code 2155348226, error message System writer is not found in the backup - This problem is due to the fact that the system writer fails because permissions to files in the %windir%\winsxs\filemaps\ or %windir%\winsxs\temp\PendingRenames directories are incorrect. See ME2009272 how on resolve this issue.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.