Video Screencast Help

Backup exec 2012 on Hyper V host - FilterManager event 3

Created: 29 Oct 2012 | 7 comments

Hello All

We have Backup Exec 2012 SBE running on a Windows Server 2008 R2 SP1 host which has the Hyper-V role enabled and 2 W2k8 VMs. All fully patched.

After backing up virtual machines we are seeing an error message:-

04:24:07 Error FilterManager 3 Filter Manager failed to attach to volume '\Device\Harddisk2\DR23'.  This volume will be unavailable for filtering until a reboot.  The final status was 0xc03a001c.

This error repeats 3 times in total.

It always coincides with a backup ending:-

Start time             : 29 October 2012 04:10:46
End time               : 29 October 2012 04:24:33

After each backup, the number in \Device\Harddisk2\DRxx increases by 1.

And, I see increasing numbers of entries in the registry under HKLM\SYSTEM\CurrentControlSet\Enum\STORAGE\VolumeSnapshot

It seems that snapshots are created and recorded in the registry but not deleted from there when finished with.

In the past there was a serious problem where the registry increased in size dramatically (KB982210) but this is not happening here.

As far as I can see the backups are working successfully.

But, what causes FilterManager error 3? And, how can I resolve it?

Is it an error caused by Backup Exec?

Thanks in advance


Comments 7 CommentsJump to latest comment

Nasharat Maner's picture

1) Did you try rebooting the machine and trying backup again?

2) The error indicates that there is problem with File Screen Filter Driver which is nothing
but AV driver. Do you have Antivirus Installed on the server?.

Navigate to following reg key HKLM\SYSTEM\CurrentControlSet\Services\FileScreenFilter Change "START" key to a value of "4" to disable FileScreenFilter driver.

scott4197's picture

thanks for the reply.

1) reboot has no effect

2) there is no AV installed on the host machine.

the registry key "HKLM\SYSTEM\CurrentControlSet\Services\FileScreenFilter" is not present.

The filter manager is actually part of Windows Server 2008 R2.

It seems that backup exec creates snapshots during the backup and temporarily mounts them before later detaching them. When the filtermanager detects that a volume has been created it tries to attach to it, but the volume has already been dismounted at that point, causing the error.

I suspect the error doesn't matter but I wonder if someone can confirm this.

Nasharat Maner's picture


This issue is specific to Windows 2008 R2 OS with Hyper-V, did you check for any update/hotfix for the same?

There seems to be some issues around this configuration.

scott4197's picture

Hi Nasharat

Thank you for your reply.

I have searched everywhere for an answer to this issue without success. I am quite sure there is no hotfix.

Other people have the same issue when using VSS-based backup software, such as DPM. No answers exist on Microsoft forums.

Have staff at Symantec experienced this issue when testing Backup Exec?

Has the exact cause been identified?

swisssingha's picture

scott4197, could you resolve your issue? if so, i would appreciate if you would share your solution.. we have exactly the same issue here (without Hyper-V).

  • Windows 2008 R2 SP1 with BE 2012 SP1a
  • no AV installed
  • reboot has no effect
  • registry key is not present
  • NO Hyper-V installed on the server. ONLY BE!
scott4197's picture

Hello swisssingha

I think this issue cannot be resolved. Also, I suspect that it is not serious, either.

An explanation I found in the Microsoft partner community ( by Eric Guo was:-

"When you run backup, it will create VSS snapshots. To the OS, these snapshots are local volumes. And these "volumes" are temporarily mounted at that time. Thus, Filter Manager at that time try to attach the filter driver registered to the new "volume" which failed. As these are only snapshot, not real volumes, I think you could just safely ignore these Filter Manager events. It won't hurt any operations."

My worry initially was that a registry bloat problem was taking place, similar to that mentioned in Microsoft kb982210.

On our system, registry key HKLM\SYSTEM\CurrentControlSet\Enum\STORAGE\VolumeSnapshot contains hundreds of sequentially numbered entries corresponding to each snapshot.

However, after a reboot, it seems the entries are recycled, so there is not a danger of the registry being overwhelmed.

This issue in my case was caused by backup software that uses shadow copy technology. I also understand that Microsoft data protection manager and acronis can give the same errors.

Some people have suggested disabling the filtermanager altogether but that can reduce the security of files on the server - i.e. it is a really bad idea.

Some related error messages can occur if the operating system makes shadow copies during the backup, so it is best to ensure any shadow copies take place well before or after the backup occurs.

Overall, as there appeared to be no answer and as my backups are working the solution was therefore a very simple - do nothing.

If I discover anything new I will post on this thread.

Good luck!

swisssingha's picture

Hi scott4197

Thanks for your answer! Appreciated.

- swisssingha