Tuesday, February 10, 2015

Server 2012 r2: Disk # has been surprised removed, event ID 157 when backing up VHD's.

I have a Server 2012 r2 Hyper-V virtual machine that has 3 disks (vhd's) mounted.  One for the C drive, one for Logs, another for DB storage.  A VSS backup is taken every night, and during this time there is some curious event logs being recorded:

The highlighted partmgr event 58 is described as: "The disk signature of disk 3 is equal to the disk signature of disk 0."  As well as the other 2 partmgr events pairing the virtual disks 1 and 2.  The disk event 157 is described as "Disk 3 has been surprise removed"  As well as the other two disk events saying the same for disk 4 and 5.

My theory is when a VSS backup is taken 3 new disks are created (3,4,5) that match the original virtual machine disks (0,1,2).  Data is then backed up to the new disks and a signature check is done (partmgr event 58) to make sure they match.  Disks 3,4,5 are then ejected from the system, and event ID 157 is recorded.

In that case when backups are taken these events should probably be defined as Informational and not Warning, in order to keep logs clean.