Snapshots creating or locating corrupt files
Hello,
I have had two users that have been getting pop-ups periodically telling them that some files are corrupt and unreadable. The errors seem to coincide with a snapshot on their system. The attached file shows this for inetsrv but it happens for other files as well, and sometimes it even says \???? as the file. Generally the file location is in C:\Windows\System32. I have had them run checkdisk several times, each repair corrects the error until the next snapshot begins processing. At some point in time while the snapshot runs through, the errors resume. I've also had them verify system files are correct using sfc /scannow.
Perhaps the files have been corrupted for a long time and they were never accessed by the system, but I wanted to see if anyone else had run into this issue, and if there was a fix/workaround short of excluding that directory.
We are running Altiris RS 6.2 SP3, build 2801 and NS 6.0.6074 (SP3 + R9)
Thanks in adavance.
Comments
Are there any errors in the
Are there any errors in the application event log on the PC or the RS server during the snapshot? Also look for any errors or messages relating to OfmLvDrv in the System log on the PC. We had issues with OFM causing corruption on some PCs but chnages in the 2801 update fixed those. These may be new issues that need the attention of support. Also you can just add an exclude for that folder but if you are doing a Full System snaphot you may have issues with that approach.
May be a virus
I'm suspicious of that file; there shouldn't be a file (with no extension) named "inetsrv" in the System32 directory. There may be a directory named INETSRV there, but not a file. Is IIS installed on these machines? Have you scanned the machine for malware or viruses? When running chkdsk, are you running CHKDSK C: /R (to scan for corrupt blocks on the drive)? Can the file actually be accessed, and if so how big is it, and can you open it with Notepad or a hex editor software?
As kmccann suggests you could add an exclusion for a file named inetsrv.
Thanks,
Kyle
Symantec Trusted Advisor
For Forum threads, please click "Mark as Solution" if answered.
For all content, please give a thumbs up if you agree with or support the post.
Could be OFM driver
Jeffery,
Those errors are identical to ones we experienced in fall of last year due to the OFM driver writing over system files while trying to backup open files. Once we upgraded clients to 6.2 sp3 2801 the problems decreased but many users experienced errors in the case of .pst files. We have since upgraded to version 7 and the first snapshot that was run corrupted my system. We have since disabled the OFM driver in the registry for all machines running RS agent.
-Andy
Any update?
Jeff,
Any updates on this issue? Did you find a resolution? The snapshot is a read-only process so I wouldn't expect it to actually corrupt files.
Thanks,
Kyle
Symantec Trusted Advisor
For Forum threads, please click "Mark as Solution" if answered.
For all content, please give a thumbs up if you agree with or support the post.
Would you like to reply?
Login or Register to post your comment.