If you find the inner workings of Exchange data backups using Volume Shadown Copy (VSS) a bit mystifying take comfort in not being alone. Administrators may ask, What s all the freezing and thawing I m seeing in my event logs? What is the Exchange VSS Writer really, and what is it doing to my databases? How does it create a snapshot of a 685GB database in less than 65 seconds? If you ever asked these questions but only felt more confused with the answers, here s a guide to clear some of that up. To understand how a VSS backup of Exchange works it s critical to understand the basics of VSS itself. There is some excellent documentation on TechNet and MSDN on this, as well as the Windows Server Core Team blog, My esteemed colleague Randy Monteleone sums up the basics of VSS very nicely early in his post, while also providing links (repeated here) to some good TechNet primers on VSS: If you re already familiar with at least the basics of VSS, then look forward to Part 7 in this series, where we will break down the events that occur in a VSS Exchange backup, and how Exchange logs them in the application event log.
Everything you need to know about conference championship
If you need a quick primer or refresher on VSS basics and the Exchange Writer I ve condensed them into some visual points below to complement the references above. Bear in mind that VSS solutions for Exchange, and for all applications, vary greatly between different hardware and software configurations. There are clone and COW snapshots, hardware and software solutions, just a very wide variety of technologies based on the core VSS subsystem. For the purposes of understanding Exchange backups we re only going to illustrate one specific type of solution out of the multitude. Detailed below is what s called copy-on-write, or COW snapshots.
In a COW snapshot-based VSS backup of Exchange we have the creation of snapshots of the disks where Exchange data is hosted. No matter what is getting backed up, even if it s a single database file and a few logs, VSS creates a snapshot of the entire disk where any data is stored. So what is a snapshot? A volume snapshot is an area of space inside what s called shadow storage, which is itself a typically small area of space on the disk located in its System Volume Information folder. After a disk snapshot is created a change to any data block from that time forward cannot get written until a copy of that block s data before the change (as it was when the snapshot was created) gets written to the differencing area in shadow storage.
Everything You Need to Know About Destiny 2 IGN
In this way the data on the disk at the time the snapshot was created is preserved, block by block, in the shadow storage area. The snapshot data is then available either from the original disk, if the data blocks requested haven t changed, or from the differencing area if they have. The fundamentals of this are illustrated below: A minute later one of the blocks gets written to, but not before the data as it was at 6PM gets preserved in the differencing area: As the actual disk changes the data as it was at 6PM gets written into shadow storage, preserving a record of the disk as it was in that moment:
In the figure above a backup server requests data from the snapshot of blocks 7 and 58. Block 58 from 6PM is preserved in the snapshot, so it s copied directly from shadow storage. Block 7 is unchanged since 6PM, so it is copied via the VSS driver VOLSNAP. SYS, which operates much like a filter driver underneath the NTFS. SYS file system driver.
By working in the IRP stack (the part of kernel memory that manages disk I/O) underneath the file system it can read blocks of data without NTFS objecting that a file is in use. VOLSNAP. SYS is also responsible for ensuring blocks are copied over to shadow storage if a write is requested to them, hence the name Copy On Write. Here is more about VOLSNAP. SYS from Tim McMichael:
Now that we ve got the basics of a COW snapshot down let s look at how it works with Exchange, along with some other major concepts: So we know that any disk that stores Exchange data gets a snapshot created of it by VSS.