FilterManager Event ID 3 During Backups

Mark Berry December 13, 2012

I have a 2-week-old installation of Server 2012 Essentials. Windows Server Backup runs twice per day. Every time the backup runs, I get about five of these errors in the System event log:

Log Name:      System
Source:        Microsoft-Windows-FilterManager
Event ID:      3
Level:         Error
User:          SYSTEM
Description: Filter Manager failed to attach to volume ‘\Device\HarddiskVolume27’.  This volume will be unavailable for filtering until a reboot.  The final status was 0xC03A001C.

Obviously "HarddiskVolume27" is not a permanent hard drive–it must be a VSS drive created for the backup. (The volume numbers are different in each event.) The errors do not stop after a reboot.

What does this error mean and how do I stop it?

Research

Microsoft partner support pointed me to this Japanese blog article. Google Translate does an okay job on the translation.

The blog tells us that the final status of 0xC03A001C means STATUS_VHD_INVALID_STATE, i.e. the VHD is in a disabled state.

The article also suggests how to identify the process that caused the error. In Event Viewer, click on the event’s Details tab. Click the plus sign (+) next to System and scroll down to see the ProcessID:

FilterManager Event 3

Open Task Manager to see your running proccess. In the Details tab, look for the Process ID (PID) identified above. In my case, it referred to SearchIndexer.exe, which is the Windows Search service.

I stopped the Windows Search service (and dependent services) and ran a backup. This time, I did not get any FilterManager errors.

Probable Cause

It seems that Windows Search is always watching for new hard drives to be attached to the system. As part of backing up, Windows Backup attaches new, temporary hard drives like "\Device\HarddiskVolume27", then detaches them. Windows Search can’t find the drive and says you have to reboot the system.

I could set up scheduled tasks to stop and start Windows Search before and after backups. But probably I will just ignore these errors. Hopefully these confusing events will be removed in a future hotfix or service pack.



12 Comments

  1. tsw   |  January 02, 2013 at 2:15 pm

    this is also the case for windows 8… after stopping “windows search” during backup, the error messages disappear.

  2. RD   |  January 23, 2013 at 2:20 pm

    I’m seeing this error during backup but process Id = 4 which I think system process. That means a kernel system thread is having problem. Does this happens due to insufficient space on disk/volume or VSS storage.

  3. Mark Berry   |  January 23, 2013 at 2:35 pm

    If you have insufficient space, you should be seeing separate warnings from Windows Server Backup about that. But I don’t know why you would be seeing Process ID = 4. You might want to post that question on a Microsoft forum.

  4. David   |  May 10, 2013 at 4:17 pm

    im having a simuler issue but process id is diffrent but you the mostlily answer ive seen regarding this error. can you offer any insight?

    Log Name: System
    Source: Microsoft-Windows-FilterManager
    Date: 5/10/2013 2:05:44 AM
    Event ID: 3
    Task Category: None
    Level: Error
    Keywords:
    User: SYSTEM
    Computer: Blanked for security
    Description:
    Filter Manager failed to attach to volume ‘DeviceHarddiskVolume55’. This volume will be unavailable for filtering until a reboot. The final status was 0xc03a001c.
    Event Xml:

    3
    0
    2
    0
    0
    0x8000000000000000

    109116

    System
    Blanked for security

    0xc03a001c
    24
    DeviceHarddiskVolume55

  5. Mark Berry   |  May 10, 2013 at 7:38 pm

    David, looks identical to me. What process ID does yours report? What process does that correspond to in Task Manager.?

  6. TJ   |  October 28, 2013 at 1:34 pm

    Yup, I’m seeing the same thing on my Win 2012 server. PID = 4 Happens after the backup finishes.

  7. Chris   |  January 05, 2014 at 7:25 pm

    Same here. Windows Server 2012.

  8. Konstantin   |  February 21, 2014 at 4:39 am

    Thanks for your research :)

  9. Noel Carboni   |  April 22, 2014 at 5:26 am

    On Win 8.1 (with Spring Update) I’m seeing these messages, and the Process ID indicates it’s the System process (ID 4). Windows Search is and has been Disabled for a long time.

    Interestingly, after the system ran for a few days the errors stopped being logged, but came back again after a reboot.

    See also this for more detailed information about what I’m seeing:
    http://social.technet.microsoft.com/Forums/en-US/cd4b6d2a-f1af-4806-9d95-073f8ddb6f71/number-of-system-log-errors-increasing-during-nightly-backup-what-can-be-done?forum=w8itprogeneral

    It seems that VSS-integrated backups are becoming less and less well integrated with the system in general. It’s a bad trend – and sloppy work on Microsoft’s part.

  10. Tom   |  February 04, 2015 at 2:24 am

    Thanks Mark.
    It’s very helpful for me.

  11. Lynda   |  December 06, 2016 at 10:00 am

    I am getting the following message
    Filter Manager failed to attach to volume ‘\Device\Harddisk8\DR25’. This volume will be unavailable for filtering until a reboot. The final status was 0xC03A001C.
    and I only have a standalone PC on a Wireless Network. I don’t have a Server – but It seems that something has converted my computer into one.

  12. Mark Berry   |  December 06, 2016 at 10:05 am

    Lynda, I’ve seen these messages on standalone computers too. I’m still ignoring the messages.

Leave a Reply





*