To monitor backups on Windows, it is crucial to monitor information related to the different backup jobs.
Here are the main backup-related things you should look out for:
Event IDs for backup failures may differ slightly between different versions of Windows, including Windows 10
and Windows Server. However, many Event IDs remain consistent between these systems, especially when the
same backup tools are used.
Here is a non-exhaustive table of elements allowing the detection of a backup error or degradation, you can use part or all
of these elements in order to obtain alarms indicating abnormal behavior. This will allow you to be alert and move forward in your
investigations.
# |
Windows services |
Service name |
When |
Condition |
1 |
File History Service |
fhsvc |
Stopped |
True |
2 |
Block Level Backup Engine Service |
wbengine |
Stopped |
True |
3 |
Microsoft Software Shadow Copy Provider |
swprv |
Stopped |
True |
4 |
Volume Shadow Copy |
VSS |
Stopped |
True |
5 |
Windows Backup |
sdclt |
Stopped |
True |
# |
Acronis Backup Windows services |
Service name |
When |
Condition |
1 |
Acronis Managed Machine Service |
acronis_mms |
Stopped |
True |
2 |
Acronis Scheduler2 Servic |
AcrSch2Svc |
Stopped |
True |
|
|
|
|
|
# |
Veeam Backup Windows services |
Service name |
When |
Condition |
1 |
Veeam Backup Service |
VeeamBackupSvc |
Stopped |
True |
2 |
Veeam Guest Catalog Service |
VeeamMountSvc |
Stopped |
True |
1 |
|
|
|
|
# |
Symantec Backup Windows services |
Service name |
When |
Condition |
1 |
Backup Exec Device & Media Service |
bedbengine |
Stopped |
True |
2 |
Backup Exec Job Engine |
BackupExecJobEngine |
Stopped |
True |
|
|
|
|
|
# |
Veritas Backup Windows services |
Service name |
When |
Condition |
1 |
NetBackup Client Service |
bpcd |
Stopped |
True |
2 |
NetBackup Database Manager |
nbdbms |
Stopped |
True |
3 |
NetBackup Request Manager |
nbrb |
Stopped |
True |
# |
Commvault |
Service name |
When |
Condition |
1 |
Commvault Communications Service |
GxCVD |
Stopped |
True |
2 |
Commvault Services |
GxVss |
Stopped |
True |
3 |
Commvault Client Event Manager |
GxEvMgrC |
Stopped |
True |
# |
Description |
Source |
Log Name |
Event |
Level |
1 |
Backup error |
Microsoft-Windows-FileHistory-Engine |
Microsoft-Windows-FileHistory-Engine/WHC |
201 |
Warning |
2 |
Configuration problem |
Microsoft-Windows-FileHistory-Engine |
Microsoft-Windows-FileHistory-Engine/WHC |
202 |
Error |
3 |
Save slot not available |
Microsoft-Windows-FileHistory-Engine |
Microsoft-Windows-FileHistory-Engine/WHC |
203 |
Information |
4 |
The backup could not be completed |
Microsoft-Windows-Backup |
Microsoft-Windows-Backup/Operational |
517 |
Error |
5 |
Scheduled backup failed to start |
Microsoft-Windows-Backup |
Microsoft-Windows-Backup/Operational |
521 |
Error |
6 |
Inaccessible save location |
Microsoft-Windows-Backup |
Microsoft-Windows-Backup/Operational |
523 |
Error |
7 |
Hardware failure preventing backup |
Microsoft-Windows-Backup |
Microsoft-Windows-Backup/Operational |
525 |
Warning |
8 |
Saved successfully |
Microsoft-Windows-Backup |
Microsoft-Windows-Backup/Operational |
5 |
Information |
9 |
Backup canceled |
Microsoft-Windows-Backup |
Microsoft-Windows-Backup/Operational |
14 |
Information |
10 |
Backup failed to start |
Microsoft-Windows-Backup |
Microsoft-Windows-Backup/Operational |
49 |
Error |
|
|
|
|
|
|
# |
Acronis Backup |
Source |
Log Name |
Event |
Level |
1 |
Critical Error |
AcronisAgent |
Application |
1001 |
Error |
2 |
Not fully successfull |
AcronisAgent |
Application |
1002 |
Warning |
3 |
Completed successfully |
AcronisAgent |
Application |
1003 |
Information |
# |
Veeam Backup |
Source |
Log Name |
Event |
Level |
1 |
Failed to backup |
Veeam Backup |
Application |
190 |
Information |
2 |
potential problem or partial failure |
Veeam Backup |
Application |
191 |
Error |
3 |
Completed successfully |
Veeam Backup |
Application |
192 |
Warning |
# |
Symantec Backup Exec |
Source |
Log Name |
Event |
Level |
1 |
Backup failure |
Backup Exec |
Application |
34113 |
Error |
2 |
Potential problem or partial failure |
Backup Exec |
Application |
57755 |
Warning |
3 |
Completed successfully |
Backup Exec |
Application |
57476 |
Information |
# |
Commvault |
Source |
Log Name |
Event |
Level |
1 |
Backup failure |
Commvault |
Application |
4096 |
Error |
2 |
Potential problem or partial failure |
Commvault |
Application |
4097 |
Warning |
3 |
Completed successfully |
Commvault |
Application |
4098 |
Information |
# |
Veritas net backup |
Source |
Log Name |
Event |
Level |
1 |
Backup failure |
NetBackup |
Application |
257 |
Error |
2 |
Potential problem or partial failure< |
NetBackup |
Application |
258 |
Warning |
3 |
Completed successfully |
NetBackup |
Application |
259 |
Information |