Backup Exec Deduplication Option's deduplication engine (spoold) fails to start due to files deleted/quarantined by antivirus software. Deleted files may also result in corrupt, unrestorable images.

Article:TECH136166  |  Created: 2010-01-16  |  Updated: 2014-10-07  |  Article URL http://www.symantec.com/docs/TECH136166
Article Type
Technical Solution

Product(s)

Subject

Issue



Backup exec Dedupe Engine service fails to start as a result of deletion of files by the Antivirus software which are required by Backup exec Deduplication option. Deletion of Dedupe files by antivirus software may also result in corrupt, unrestorable images.

OR

Unable to start the Backup Exec Deduplication Service due to a missing bin or bhd file.

OR

Backup Exec Deduplication Engine Service fails to start and displays the following error : Error 1 : Incorrect Function


Error



In the Event Viewer the following application logs will be generated on the Backup Exec Server.

-------------------------------------------------------------------------

Log Name:      Application
Source:        spoold
Date:          12.9.2011 12:51:27
Event ID:      1
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      TEST.basware.com
Description:
The description for Event ID 1 from source spoold cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.
If the event originated on another computer, the display information had to be saved with the event.
The following information was included with the event:
25002: _storeCheckContainers: container data file F:\DeDupFolder\data/XXXX.bin is missing
 

-------------------------------------------------------------------------

ERR [000000000122F8E0]: 25002: _storeCheckContainers: container data file F:\DeDupFolder\data/XXXX.bin is missing.


Cause



Antivirus software deleted or quarantined the bin file from the Deduplication storage, here in this example "F:\DeDupFolder\data/XXXX.bin", where 'XXXX.bin' is the name of the missing bin file.


Solution



Introduction:
When running antivirus software on a Backup Exec Server where a Deduplication Storage Folder is installed, binary data files required for both the functioning of the Backup Exec Deduplication Engine, as well as the integrity of the Deduplication Storage Folder itself may be deleted. This may result in the Backup Exec Deduplication Engine stopping and failing to restart, or possible corruption of backups in the Deduplication Storage Folder.

What is Affected:
Backup Exec Servers--with antivirus software installed--that host a Deduplication Storage Folder. The Deduplication Storage Folder functionality was introduced in Backup Exec 2010.

How to Determine if Affected:
If the Deduplication Folder will not come online, check to see if the Backup Exec Deduplication Engine can be started.  If it cannot, check the <path-to-deduplication-storage-folder>\log\spoold.log for messages similar to the following:
...
June 16 08:46:07 ERR [000000000122F8E0]: 25002: _storeCheckContainers: container data file F:\DeDupFolder\data/70.bin is missing
June 16 08:46:07 ERR [000000000122F8E0]: 25002: Could not initialize DataStore Manager
June 16 08:46:07 ERR [000000000122F8E0]: 25002: _storeReleaseCtx: pthread_cond_destroy (The system cannot find the file specified. )
June 16 08:46:07 ERR [000000000122F8E0]: 25002: _storeReleaseCtx: pthread_cond_destroy (The system cannot find the file specified. )
June 16 08:46:07 ERR [000000000122F8E0]: 25002: _storeReleaseCtx: pthread_cond_destroy (The system cannot find the file specified. )
June 16 08:46:07 ERR [000000000122F8E0]: 25002: _storeReleaseCtx: pthread_cond_destroy (The system cannot find the file specified. )
...

Checking the data path (in this case, F:\DeDupFolder\data), it was discovered that the 70.bin file was missing:
Note: the associated .bhd files are still present.

When no antivirus software is used on the client side, the potential exists that backups made from those clients may contain files with virus signatures. In such cases, it is possible that it will end up in the Deduplication Storage Folder files where it could match a signature to any antivirus software running on that media server.

It is recommended that the antivirus software be configured to exclude the Deduplication Storage Folder or at least by ensuring that it won't automatically delete or quarantine files in the Deduplication Storage Folder.

Steps to Follow:

1) From the antivirus program check the Quarantine for XXXX.bin file, which is missing in F:\DeDupFolder\data location.
2) Manually export XXXX to the desktop. (Which will appear to have no extension '.bin').
3) Add the extension '.bin' to the exported file on the desktop.
4) Copy XXXX.bin to F:\DeDupFolder\data location (i.e. the deduplication storage )
5) Start postgresql service (Do not Start Backup Exec Deduplication Engine Service at this point)
6) Run Dcscan.exe --verify -q XXXX

If dcscan completes without errors then Backup Exec Deduplication Engine Service can be started and bin file left in the Deduplication Storage\Data folder

7) If Dcscan reports errors in the container then the bin file is corrupted and needs to be removed.


 

Please contact Backup Exec Support since a Internal Symantec Utility needs to be run to recreate the missing/corrupt bin file and confirm the Integrity of Content Router Database (crdb ). This is an Important procedure which needs to be carried out to ensure some backup set which are affected due to the missing/corrupt bin file (which contains dedupe segments) are identified.

 

NOTE:
1) Always make sure that your environment is running the latest version and patch level.
2) It is recommended that the antivirus software be configured to exclude the Deduplication Storage Folder or at least by ensuring that it won't automatically delete or quarantine files in the Deduplication Storage Folder.
3) Ensure Indexing on the Deduplication Folder is disabled as it might Interfere with some activities on deduplication.
4) Dcscan.exe is located at BE Install Path.
5) It is recommended to Backup the Deduplication Folder through Local Shadow Copy Components.

 



   


Supplemental Materials

SourceEvent ID
Value1
Description

 The description for Event ID 1 from source spoold cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.
If the event originated on another computer, the display information had to be saved with the event.
The following information was included with the event: 
25002: _storeCheckContainers: container data file D:\B2Ddedup\data/25441.bin is missing
 



Legacy ID



355634


Article URL http://www.symantec.com/docs/TECH136166


Terms of use for this information are found in Legal Notices