To stay updated on your favorite discussions, please create an account or log in. Then, click the Bookmark icon to subscribe and receive notifications.

Backupassist/Windows Server Backup issue: "EFI system partition (ESP)"-error when "F-Secure Server S

Agrar
Agrar Posts: 24 Security Scout
in Business Suite

Our environment:

  -> An "Windows 2012 R2" HyperV-host, which we will call further on W2012R2HYPERV, with "Backupassist version: 10.4.1" running on it ( this is a kind of "wrapper"-software around "Windows Server Backup")

 

  -> Another "Windows 2012 R2"-host, which we will call further on W2012R2ISCSITARGET, on which a vhdx-file is provided as the backup target-disk, thru the iscsi protocol
        -> F-Secure versions:
                F-Secure Server Security Premium 12.12 build 104
                F-Secure Anti-Virus 9.52 build 240
                F-Secure Automatic Update Agent 9.03 build 111
                F-Secure User Interface 14.00 build 104
                F-Secure Management Agent 10.10 build 133
                F-Secure ORSP Client 1.2.17 build 257
                F-Secure Web UI 1.70 build 113
                F-Secure DeepGuard 5.0 build 740
                F-Secure Online Help 1.4 build 402
                F-Secure Server Security Premium Customization 12.10 build 104
                F-Secure Web Traffic Scanner 3.01 build 276
                F-Secure Browsing Protection 2.01 build 483
                F-Secure Software Updater 2.21 build 1633
                
          Upgrade to this version was done at least 1 month ago, and the backup was working OK during all this time.
          
  We have 4 such combinations of HyperV-server/target-server-with-iscsi, and all of these started to show the problem described hereunder as from 2018-08-15.

The problem:

  -> As of 2018-08-15, this backup on W2012R2HYPERV ended with the following error:
 
            "[Critical error WINIMAGE_UNABLE_BACKUP_VOLUME] Unable to back up volume - Additional information: Windows Backup failed to get an exclusive lock on the EFI system partition (ESP)."
            
            In the event viewer, we see under "Applications and Services Logs" -> "Microsoft" -> "Windows" -> "Backup" -> "Operational" an entry like this:
            
                Log Name:      Microsoft-Windows-Backup
                Source:        Microsoft-Windows-Backup
                Date:          16-08-18 20:16:38
                Event ID:      5
                Task Category: None
                Level:         Error
                Keywords:      
                User:          SYSTEM
                Computer:      <<UNDISCLOSED>>
                Description:
                The backup operation that started at '‎2018‎-‎08‎-‎16T18:09:11.246433200Z' has failed with following error code '0x8078011E' (Windows Backup failed to get an exclusive lock on the EFI system partition (ESP). This may happen if another application is using files on the ESP. Please retry the operation.). Please review the event details for a solution, and then rerun the backup operation once the issue is resolved.
                ....

Workaround found so far/Investigation status:

  -> If I:
 
     -> on W2012R2ISCSITARGET: stop, using services.msc, the services "F-Secure Management Agent" and "F-Secure WebUI Daemon"
     -> on W2012R2HYPERV: restart, using services.msc, the service "Virtual Disk" (unlcear whether this is really needed; I just thought to notice it was stuck at some time in my trialing-and-erroring)

    Now, on W2012R2HYPERV, I could restart the backup and it ran OK.

 

Further investigation ongoing.

Comments

  • Agrar
    Agrar Posts: 24 Security Scout

    On 2018-08-17, the backup worked again without specific action from me, except a reboot of both machines which may or may not have played

    I suspect a 'common root cause' with https://community.f-secure.com/t5/Business/Scanner-Manager-Update-15-August/m-p/109967#M8388 (title: "Scanner Manager Update 15 August Causing "Disk Errors" with Windows 2008 Servers?"), because:
      -> It started around the same time, probably after the 'virus definitions update' of 2018_08_15_x
      -> It ended after another 'virus definitions update'. We saw it work again with virus definitions version 2018_08_17_3
      -> Here we speak of an iscsi-disk and in that issue of a LUN-disk...that is similar, no?
     

This discussion has been closed.

Categories