Windows QEMU Guest Agent VSS Provider service stops during qemu backup

[Joop Martens]

I’m currently implementing the QEMU Guest Agent on all my KVM Windows guests.

I’m using the stable VirtIO drivers and Guest agent from Fedora: https://fedoraproject.org/wiki/Windows_Virtio_Drivers

Both the stable and latest release do provide Qemu Windows Guest agent 7.0.0.10.

After the Guest agent installation I initially received VSS events with ID 8194:

 Volume Shadow Copy Service error: Unexpected error querying for the IVssWriterCallback interface. hr = 0x80070005, Access is denied.

This is often caused by incorrect security settings in either the writer or requestor process.
Operation:
   Gathering Writer Data
Context:

   Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220}

   Writer Name: System Writer

   Writer Instance ID: {6c777a34-53dd-4fb3-a4c9-b85d7e183e27}

I was able to fix this issue by adding local access permissions for the “Network Service” account at the Dcom security permissions:

On the client computer from the Start Menu, select Run
The Run dialog opens.
In the Open field type dcomcnfg and click OK.
The Component Services dialog opens.
Expand Component Services, Computers, and My Computer.
Right-click My Computer and click Properties on the pop-up menu.
The My Computer Properties dialog opens.
Click the COM Security tab.
Under Access Permission click Edit Default.
The Access Permissions dialog opens.
From the Access Permissions dialog, add the "Network Service" account with Local Access allowed.
Close all open dialogs.

Now an initial backup runs without any errors but this is causing the QEMU Guest Agent VSS Provider service to stop running without any error in the event log.

As a result a second backup will cause an error: MSDTC Client 2 with event ID: 4879:

MSDTC encountered an error (HR=0x80000171) while attempting to establish a secure connection with system SERVERNAME.

This is probably caused because the QEMU Guest Agent VSS Provider service isn’t running anymore.

I can manually start the QEMU Guest Agent VSS Provider service but every backup is causing the service to stop.

I’m seeing this behavior at all my Windows based guests running both Windows Server 2012 R2 and Windows Server 2008 R2.

 Since I can’t find any logging or troubleshooting possibilities for this particular service I'm open for suggestions how to troubleshoot this issue to receive detailed information about the reason why this services stops running during a backup.

qemu-server 3.4-3 amd64
Guest agent 7.0.0.10

[Joop Martens (joop-martens)]

After upgrading to QEMU guest agent 7.2.1 this issue disappeared.

The only minor "issue" that remains is that the QEMU Guest Agent VSS Provider service is being installed with start-up type: Automatic.

After a backup the service is automatically being stopped causing monitoring systems like the Windows server manager to complain about stopped services with start-up type automatic.

Because the Qemu guest agent starts the VSS provider service automatically when a backup is being triggered this can easily be solved by changing the start-up type to: manual.

I have now changed the start-up type to manual using GPO for all my Qemu Windows guests.

I have filed a bug report at Redhat with the request to change the service start-up type to manual for the provided MSI install packages.
https://bugzilla.redhat.com/show_bug.cgi?id=1286672

[Ravindra Teli (raviteli)]

Hi Joop,

From where did you find QEMU guest agent 7.2.1 ? I am looking for one for RHEL 7. Any idea where can I find it ?

Thanks,
Ravi

[Joop Martens (joop-martens)]

Hello Ravi,

You can find it at the Fedora Windows VirtIO Drivers wiki page that I provided in my first post.

Here's a direct link to the latest 7.2.1 guest agent:
https://fedorapeople.org/groups/virt/virtio-win/direct-downloads/archive-qemu-ga/qemu-ga-win-7.2.1-1/

[Joop Martens (joop-martens)]

Hello Ravi,

Just noticed that you are looking for a RHEL 7 guest agent instead of the Windows version.
Not sure what the latest Linux release is but the standard repos currently provide release 2.3.0.

If you need a newer version you need to search for a 3th party rpm or compile it yourself from source.

[Ravindra Teli (raviteli)]

Thanks Joop, I am looking for Windows 2012 guest agent only. Let me try the 7.2.1 guest agent.

[Ravindra Teli (raviteli)]

Well, I am still getting this error.
Volume Shadow Copy Service error: Unexpected error querying for the IVssWriterCallback interface. hr = 0x80070005, Access is denied.
. This is often caused by incorrect security settings in either the writer or requestor process.

Operation:
   Gathering Writer Data

Context:
   Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220}
   Writer Name: System Writer
   Writer Instance ID: {07dc130c-35da-4bd1-9948-2b4501249c3b}

[Ravindra Teli (raviteli)]

Finally it worked.

I had to carry out DCOM config that you suggested earlier in addition to installation of 7.2.1

Thanks,
Ravi

[Joop Martens (joop-martens)]

Have you tried my manual steps to fix this issue?

On the client computer from the Start Menu, select Run
The Run dialog opens.
In the Open field type dcomcnfg and click OK.
The Component Services dialog opens.
Expand Component Services, Computers, and My Computer.
Right-click My Computer and click Properties on the pop-up menu.
The My Computer Properties dialog opens.
Click the COM Security tab.
Under Access Permission click Edit Default.
The Access Permissions dialog opens.
From the Access Permissions dialog, add the "Network Service" account with Local Access allowed.
Close all open dialogs.

If the issue has not been fixed for you I suggest to reopen the bug (I'm the original bug reporter not the bug fixer)