61335: Checking Windows Event Log for issues with computer environment

use Google Translate

Operating Systems: 

    Last update: 25-08-2020


    Acronis software may give errors, freeze or produce other undesired effects when there are issues with parts of the computer environment it operates in:


    Disk partitions, file systems

    Operating system, software


    disk controllers

    RAID controllers

    network interface controllers

    optical discs drives

    tape devices

    disk adapters

    data and power cables


    other physical and virtual hardware used to store, transfer, manipulate data


    firmware of the above devices, BIOS/UEFI

    partition table (e.g. MBR, GPT)

    disk partitions

    disk volumes

    file systems

    Windows drivers

    Volume Shadow Copy Service (VSS)

    VSS providers

    VSS writers

    Windows Registry configuration

    Windows user accounts

    Permissions for files/folders

    Windows Management Interface (WMI)

    Examples of error messages in Acronis software, when you would want to check the environment:

    Unable to create volume snapshot

    Failed to read snapshot

    Failed to read from sector...

    Failed to read from disk...

    Failed to write the snapshot manager volume

    Various types of read and write errors

    Input/Output (I/O) errors

    Errors referencing \\?\GLOBALROOT\Device\...

    Cyclic redundancy check (CRC) error

    Failed to enumerate directory

    WMI ExecQuery failed

    MFT bitmap corrupted

    The semaphore timeout period has expired


    Acronis has developed a free tool that automates the process of checking the environment particularly for Volume Shadow Copy Service (VSS)-related issues: Acronis VSS Doctor. This tool saves time on gathering and analyzing diagnostic information from various sources, including Windows Event Log, but it does not cover all possible root causes and applies to VSS-related issues only.

    A more universal approach consists in checking Windows Event Log for issues with computer environment using Windows Event Viewer:

    1. Open Windows Start Menu.

    2. Type Event Viewer and press Enter:

    If Windows Search does not find Event Viewer by name, press the combination of the button with Windows logo on keyboard and R, and run the command evenvwr.msc

    3. Windows Event Viewer will open:

    4. Navigate to Windows Logs - System:

    5. Click Filter Current Log... on the right panel:

    6. Mark Critical, Error and Warning checkboxes in the upper part of the window, click OK to apply the filter:

    7. At this point you can click OK and review the recent warnings and errors, recorded in the System event log, and look for any information related to the issue observed in Acronis software. Pay special attention to events registered at the time the issue occurred, or just before that:

    8. As there may be many unrelated events, you can narrow the search further, by applying the following suggested filter. Click Filter Current Log.. again:

    9. Expand Event sources list:

    10. Scroll through the list and mark the following items:

    Short list (most popular sources of errors):




    Ntfs (Microsoft-Windows-Ntfs)

    Ntfs (Ntfs)

    11. Click OK and review the filtered list of events. Your further actions will depend on what parts of the environment were reported to have issues and on their current status:

    12. When troubleshooting a VSS or WMI-related issue, it is useful to also check warnings, errors and critical events under Windows Logs - Application section. In addition to troubleshooting issues with Windows environment, Application logs are also used to detect application crash and hang events.

    Further troubleshooting

    Look up the detailed error/warning text, as well as the Event ID number on the Internet. Issues with environment are common and are likely to have a solution or a workaround already documented or described.

    If you are not sure if the found errors and warnings could be the cause of the issue with Acronis software, contact Acronis Support with a system report and screenshots of the issue with Acronis, log of the operation in Acronis (if any) and the found records in Windows Event Log.