SentinelOne 4.1.6.118 causing random VSS Copy snapshot of 'C:\; D:\; EFI System Partition 1 on disk 0; Recovery Partition 0 on disk 0' on 'FS1' failed due to VSS error: FlushWritesTimeout

Anyone successfully backing up a server running SentinelOne 4.1.6.118 ?

The prior version of SentinelOne had a known issue VSS and upgrading to this version has stopped every backup from failing. Now I get only a couple failures during the day. All with the same error:

3/17/2021 11:32 AM The transfer of the backup of 'C:\; D:\; EFI System Partition 1 on disk 0; Recovery Partition 0 on disk 0' on 'FS1' failed details
3/17/2021 11:32 AM

VSS Copy snapshot of 'C:\; D:\; EFI System Partition 1 on disk 0; Recovery Partition 0 on disk 0' on 'FS1' failed due to VSS error: FlushWritesTimeout

The failures are all random. I have multiple systems in different environments experiencing the same issue's. The common factor being SentinelOne version 4.1.6.118.

  • If it's a VM, you can try to back up the VM agent-lessly and turn off guest quiescing, this it does not utilize VSS. Otherwise you can attempt to exclude the VSS writers for that one agent and then attempt to back it up: support.quest.com/.../understanding-agent-settings

    Also, if you do chose to exclude the writers, do a reboot of the agent server first to reset the VSS subsystem prior to testing. 

    Usually this is due to multiple VSS jobs running at the same time. My guess is Sentinel (or SQL or something else) on that back has a VSS job that runs when the RR backup is running and if 1 or more VSS tasks run at the same time, one generally fails and leaves VSS hung. 

  • I can exclude all the VSS writers?  Will this affect the backup that is being taken?

  • I missed this. It won't mess up the backup it just won't be quiesced. The VSS writers 'flush out' RAM, without them you'll backup whatever is already on disk at that moment, not what's in RAM. If you're familiar with VMware at all, same option when you take a snapshot and it asks if you want to quiesce the backup. Both are validate, just one flushes RAM before the snapshot is taken.