3

After about 15 minutes, a Norton Ghost 14 backup fails with Error EBAB03F1: The specified network name is no longer available.

The source computer is a P4 laptop running Windows XP SP3. The target computer is a Core2 Quad desktop running Windows Vista Ultimate 64bit.

It does not help to disable Norton 360 on the source computer or Norton Antivirus 2008 on the target computer.

The Event Viewer consistently shows the same two VSS-related errors after Norton Ghost starts but before it fails. It makes no difference if the VSS service is started or stopped. The VSS errors do not appear elsewhere in the event log, only after Ghost starts.

The MSS event messages, however, are quite common, appearing throughout the log, and they may have nothing to do with the problem.

Here is the Norton Ghost error display...

-Errors exist.
--Unable to write to file.
---Error EBAB03F1: The specified network name is no longer available.
---Unable to set file size.
----Error EBAB03F1: The specified network name is no longer available.
----Unable to write to file.
-----Error EBAB03F1: The specified network name is no longer available.
-----Unable to set file size.
------Error EBAB03F1: The specified network name is no longer available.

Here are the source computer events, with the final error 
at the top and the "Ghost Starting" message at the bottom:
=====
Event Type: Error
Event Source:   Norton Ghost
Event Category: High Priority 
Event ID:   100
Date:       11/09/2009
Time:       9:40:26 AM
User:       N/A
Computer:   PAVILION2
Description:
Error EC8F17B7: Cannot create recovery points for job: 
Drive Backup of  (C:\) (3). 
Error E7D1001F: Unable to write to file. 
Error EBAB03F1: The specified network name is no longer available. 
Error E7D10046: Unable to set file size. 
Error EBAB03F1: The specified network name is no longer available. 
Error E7D1001F: Unable to write to file. 
Error EBAB03F1: The specified network name is no longer available. 
Error E7D10046: Unable to set file size. 
Error EBAB03F1: The specified network name is no longer available.
Details: 0xEBAB0005
Source: Norton Ghost

=====
Event Type: Information
Event Source:   MSSQL$SQLEXPRESS
Event Category: Server 
Event ID:   3421
Date:       11/09/2009
Time:       9:34:06 AM
User:       NT AUTHORITY\NETWORK SERVICE
Computer:   PAVILION2
Description:
Recovery completed for database ReportServer$SQLEXPRESSTempDB 
(database ID 6) in 1 second(s) (analysis 205 ms, redo 0 ms, 
undo 376 ms.) This is an informational message only. No user 
action is required.

For more information, see Help and Support Center at 
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 5d 0d 00 00 0a 00 00 00   ].......
0008: 15 00 00 00 50 00 41 00   ....P.A.
0010: 56 00 49 00 4c 00 49 00   V.I.L.I.
0018: 4f 00 4e 00 32 00 5c 00   O.N.2.\.
0020: 53 00 51 00 4c 00 45 00   S.Q.L.E.
0028: 58 00 50 00 52 00 45 00   X.P.R.E.
0030: 53 00 53 00 00 00 18 00   S.S.....
0038: 00 00 52 00 65 00 70 00   ..R.e.p.
0040: 6f 00 72 00 74 00 53 00   o.r.t.S.
0048: 65 00 72 00 76 00 65 00   e.r.v.e.
0050: 72 00 24 00 53 00 51 00   r.$.S.Q.
0058: 4c 00 45 00 58 00 50 00   L.E.X.P.
0060: 52 00 45 00 53 00 53 00   R.E.S.S.
0068: 00 00                     ..      

=====
Event Type: Information
Event Source:   MSSQL$SQLEXPRESS
Event Category: Server 
Event ID:   17137
Date:       11/09/2009
Time:       9:34:02 AM
User:       NT AUTHORITY\NETWORK SERVICE
Computer:   PAVILION2
Description:
Starting up database 'ReportServer$SQLEXPRESSTempDB'.

For more information, see Help and Support Center at 
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: f1 42 00 00 0a 00 00 00   ñB......
0008: 15 00 00 00 50 00 41 00   ....P.A.
0010: 56 00 49 00 4c 00 49 00   V.I.L.I.
0018: 4f 00 4e 00 32 00 5c 00   O.N.2.\.
0020: 53 00 51 00 4c 00 45 00   S.Q.L.E.
0028: 58 00 50 00 52 00 45 00   X.P.R.E.
0030: 53 00 53 00 00 00 18 00   S.S.....
0038: 00 00 52 00 65 00 70 00   ..R.e.p.
0040: 6f 00 72 00 74 00 53 00   o.r.t.S.
0048: 65 00 72 00 76 00 65 00   e.r.v.e.
0050: 72 00 24 00 53 00 51 00   r.$.S.Q.
0058: 4c 00 45 00 58 00 50 00   L.E.X.P.
0060: 52 00 45 00 53 00 53 00   R.E.S.S.
0068: 00 00                     ..      

=====
Event Type: Error
Event Source:   VSS
Event Category: None
Event ID:   5013
Date:       11/09/2009
Time:       9:28:32 AM
User:       N/A
Computer:   PAVILION2
Description:
Volume Shadow Copy Service error: Shadow Copy writer 
ContentIndexingService called routine RegQueryValueExW 
which failed with status 0x80070002 (converted to 
0x800423f4).

For more information, see Help and Support Center at 
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 57 53 48 43 4f 4d 4e 43   WSHCOMNC
0008: 32 32 39 32 00 00 00 00   2292....
0010: 57 53 48 43 49 43 00 00   WSHCIC..
0018: 32 38 37 00 00 00 00 00   287.....

=====
Event Type: Error
Event Source:   VSS
Event Category: None
Event ID:   5013
Date:       11/09/2009
Time:       9:28:32 AM
User:       N/A
Computer:   PAVILION2
Description:
Volume Shadow Copy Service error: Shadow Copy writer 
ContentIndexingService called routine 
RegQueryValueExW which failed with status 
0x80070002 (converted to 0x800423f4).

For more information, see Help and Support Center 
at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 57 53 48 43 4f 4d 4e 43   WSHCOMNC
0008: 32 32 39 32 00 00 00 00   2292....
0010: 57 53 48 43 49 43 00 00   WSHCIC..
0018: 32 38 37 00 00 00 00 00   287.....

=====
Event Type: Error
Event Source:   VSS
Event Category: None
Event ID:   12302
Date:       11/09/2009
Time:       9:28:32 AM
User:       N/A
Computer:   PAVILION2
Description:
Volume Shadow Copy Service error: An internal 
inconsistency was detected in trying to contact 
shadow copy service writers.  Please check to see 
that the Event Service and Volume Shadow Copy 
Service are operating properly.

For more information, see Help and Support Center 
at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 42 55 45 43 58 4d 4c 43   BUECXMLC
0008: 33 36 33 37 00 00 00 00   3637....
0010: 42 55 45 43 58 4d 4c 43   BUECXMLC
0018: 33 36 30 37 00 00 00 00   3607....

=====
Event Type: Information
Event Source:   Norton Ghost
Event Category: High Priority 
Event ID:   100
Date:       11/09/2009
Time:       9:27:57 AM
User:       N/A
Computer:   PAVILION2
Description:
Info 6C8F1F63: The drive-based backup job, 
Drive Backup of  (C:\) (3), has been started manually.
Details: 
Source: Norton Ghost
Breck Carter
  • 181
  • 2
  • 9

4 Answers4

1

Just spotted this question and realize I'm a bit late to the party.

Anyways... a mapped drive network disconnection on a workstation OS after 15 minutes indicates that the server service believes the connection is idle, and is disconnecting it.

To fix this, enter this on the command line:

net config server /autodisconnect:-1

Chris Thorpe
  • 9,903
  • 22
  • 32
  • The server drive is being pounded by a 50G Norton Ghost backup process when the failure occurs, hardly an idle situation. But, if I ever go back to using a network drive instead of USB drive, I'll try that. Thanks! – Breck Carter Apr 19 '10 at 10:36
  • True that. We found a similar situation with a mapped drive where an application was making regular log writes. Still timed out after 15 mins. Very strange behavior. – Chris Thorpe Apr 19 '10 at 11:13
1

If you're running Ghost under Windows on what is quite a low spec machine the problem could well be one of the system unable to cope with all that's happening. This could result in internal process delays thay can cause network timeout issues, resulting in an apparent loss of connectivity. Ghost is rather intolerant of such things. Two things can be tried.

  1. If possible lock the CPU speed to maximum
  2. Try running Ghost under safe mode with networking, if that is even possible

If the latter works it is indicative of too much system load while Ghost is running under a normal boot up.

John Gardeniers
  • 27,262
  • 12
  • 53
  • 108
  • The source machine is a 3Ghz P4 laptop; the CPU is below 10%, the network at 25% (I have throttled Ghost network usage), and the computer is responsive to other applications like Firefox. The target computer is a 2.66Ghz Core2 Quad, completely idle except for the traffic; cpu is negligible and network is 25%. It is somewhat suspicious that the failure happens at roughly the same time: about 20 to 25 minutes into a run... one would think a load-related issue would manifest itself more randomly. Moreover, Ghost *used* to work, at 100% network usage, and the hardware hasn't changed. – Breck Carter Sep 11 '09 at 18:32
  • OK, see what happens if you run a disk check (with repair) prior to trying Ghost again. Sometimes when I use Ghost (version 8) from a BartPE CD disk errors result in strange Ghost failures, with completely misleading error messages. – John Gardeniers Sep 11 '09 at 22:55
1

This isn't really an answer to the question, but it is a solution to the problem: Switch from using a network drive as the target for a Norton Ghost 14 backup, and use a locally attached USB 2 external drive... 100% reliable over several days, and more than twice as fast as a backup across a 100Mb TCP/IP LAN.

In other words, I've given up on fixing the EBAB03F1 symptom :)

Another note: A different computer, using Norton Ghost version 9, has never had any problems backing up across the same 100Mb TCP/IP LAN to the same drive on the same target computer. The EBAB03F1 problem was probably introduced by version 10... that's the version that was originally in use on the problem computer, and it was the reason to upgrade to version 14.

Anyway, there are advantages and disadvantates to USB drives. One advantage is price: dropping fast, to the point adding a USB external drive to every workstation for backup purposes is a viable alternative. Local printers, local backups, sometimes the simple brute force solution is the best solution.

Breck Carter
  • 181
  • 2
  • 9
0

Are you running the Ghost session from within Windows? Or are you using the boot disk to create the image? There is also the possibility that the volume shadow copies on the source disk are corrupt and Ghost is choking on them. I usually have better luck creating images from a boot disk-maybe try that?

Josh Budde
  • 2,378
  • 14
  • 7
  • I am running from within Windows, which *used* to work (although I did have this same symptom a long time ago, and solved it by replacing the router). I don't need or want VSS copies, and I would rather not mess with boot disks. I am currently exploring the possibility that MSS Express *is* the culprit since if memory serves, it was installed after the last time Ghost worked... and it may be MSS Express that is invoking VSS since there was an MSS VSS service started. I will post results here. – Breck Carter Sep 11 '09 at 14:52
  • That sounds like a good idea. Search Server might be making shadow copies of files to do their indexing against a static copy – Josh Budde Sep 11 '09 at 14:55
  • I tried "enabling network throttling" as described at http://seer.entsupport.symantec.com/docs/298080.htm ...setting it to half speed (6400 KB/sec) did not help. For a second test, I did two things (bad experimental practice, I know)... I throttled back to 3200 KB/sec AND stopped all MSS services including the VSS-related MSS service. Ghost ran longer, 25 minutes, but still failed. – Breck Carter Sep 11 '09 at 15:01
  • Since I didn't stop MSS/VSS until *after* Ghost started, I should try another test. – Breck Carter Sep 11 '09 at 15:02
  • With Ghost networking throttled to one-quarter speed, and with all MSS-related services stopped, Ghost failed after 25 minutes. The Volume Shadow Copy service itself was running, and the two VSS events described earlier did occur again... so, MSS is probably not the culprit. Next test: turn off the Volume Shadow Copy service. – Breck Carter Sep 11 '09 at 15:34
  • ...and, rebooting both machines had no effect. Neither has waving a dead chicken over the keyboard. – Breck Carter Sep 11 '09 at 18:33
  • About 1 minute before the most recent failure, 4 errors appeared in the *target* computer's event log that talk about network errors. There's not much that's meaningful to me, but here's some of the data: Log Name: System Source: srv Event ID: 2012 While transmitting or receiving data, the server encountered a network error. 0000040001002C0000000000DC07008000000000840100C00000000000000000000000000000000086050000 – Breck Carter Sep 11 '09 at 18:56
  • I misremember how to edit my own question... or do I not have enough points? I would like to add the entire contents of the network error above. – Breck Carter Sep 11 '09 at 18:57
  • A test using a different drive on the target computer resulted in a "delayed write failed" message on the source computer... a slightly different visual symptom, same old event log messages. There's lots of discussion of this symptom on the web; I tried this on the target: Control Panel - Device Manger - Disk drives - right mouse on drive - Properties - Policies - uncheck "Enable write caching on the disk". Result: no more "delayed write failed" message, but Ghost still fails. FWIW both the target and source are up to date with respect to Windows updates. – Breck Carter Sep 11 '09 at 19:38