By skyforbes 
When troubleshooting problems with Volume Shadow Copy Service (VSS) on Windows, event logs and error codes don’t always tell the full story. The root cause of snapshot failures, timeouts, or provider errors often remains hidden behind the scenes. This is where VSS Tracing becomes a useful diagnostic tool.
VSS Tracing allows administrators and support engineers to enable low-level logging of VSS operations across providers, writers, and the core VSS framework itself. By capturing detailed trace logs, you can correlate system behavior with specific VSS components and track down failures that standard logging mechanisms miss.
In real-world scenarios, VSS Tracing helps troubleshoot issues like 0x8004231f (insufficient storage for shadow copies), 0x8004231e (snapshots already exist), or even inexplicable failures to create or delete snapshots. It gives you the visibility needed to understand why a snapshot creation failed, why writers did not respond, or why storage associations could not be modified.
This blog will walk you through how to collect, interpret, and use VSS Tracing logs and demonstrate a few examples.
Using vsstrace to Troubleshoot VSS Problems
vsstrace is a command-line tool that records detailed VSS activity. It gives you control over which modules or processes to trace, which is especially helpful when you’re trying to narrow down what’s going wrong. You can run it in real time during snapshot operations or use it to examine saved trace files. The output helps you pinpoint exactly where the problem occurred.
The command vsstrace +f 0xffff -l 255 +indent -o log.txt runs VSS Tracing with full verbosity and captures all VSS activity into log.txt. The +indent option makes the output easier to read. We’ll demonstrate this throughout the blog. Start by running this command to begin tracing.
Next, let’s reproduce an issue. In this example, a small shadow storage limit (100MB) was set on a secondary volume (E:) for the C: drive. When attempting to create a shadow copy, the operation failed with the error ‘Insufficient storage available to create either the shadow copy storage file or other shadow copy data.’”
After reproducing the issue, press Ctrl + C to stop the trace and save the collected data.
Analyzing VSS Trace Logs with TextAnalysisTool.NET
VSS trace logs can be massive and difficult to work with in a standard text editor. TextAnalysisTool.NET makes this much easier by allowing you to load the log, apply filters, and quickly jump between relevant lines. In this example, we’ll use the tool to search for error codes, exceptions, and failure messages from our VSS tracing session to help pinpoint the root cause of the issue.
TextAnalysisTool.NET allows you to apply filters using regular expressions. Here is an example:
THROW|HRESULT.*0x[0-9a-fA-F]+|HRESULT exception caught|Error.*0x[0-9a-fA-F]+|ERROR_DISK_FULL|Original volume has snapshots on it|insufficient diff area storage|insufficient storage|failed with hr = 0x[0-9a-fA-F]+|IOCTL.*failed|CVssAdminCLI::OutputErrorMsg
The trace log captured an ERROR_DISK_FULL condition during the snapshot operation. The error occurred on the shadow storage volume \\?\Volume{07cbc32d-0000-0000-0000-500600000000}, which indicates that there was not enough free space available to complete the Volume Shadow Copy request.
It also shows a failure with HRESULT 0x8004231f, which translates to VSS_E_INSUFFICIENT_STORAGE. The error insufficient diff area storage detected while calling EndPrepareAllSnapshots confirms that there was not enough space allocated for the shadow copy diff area.
This output shows the free and used space for the volume that was assigned as shadow storage. In this case, only 100 MB total space was allocated, with 67.1 MB free and 28.9 MB used. The limited size is what triggered the ERROR_DISK_FULL condition during the VSS snapshot attempt.
References
- Using Tracing Tools with VSS: Using Tracing Tools with VSS — Win32 apps | Microsoft Learn
- Download VSS Tracing: https://storage.veeam.com/utils/Vsstrace.zip
- Download TextAnalysisTool.NET: TextAnalysisTool.NET