Have you used Windows 2008 and Windows 2008 R2 Hyper-V; created a snapshot, deleted it and then wondered why the snapshot files are still hanging around? Like to know what to expect and the EventIDs that are associated with snapshot removal?
Likely you will be familiar with .vhd files which are the disk storage files in currently released versions of Hyper-V. It is also possible for other organisations to leverage the .vhd format. Snapshot information is saved in a .avhd & .xml configuration file so that they contain the difference in activity in relation to the linked .vhd file. This is why they are called differencing disks too.
Ben Armstrong has posted several times on the underlying mechanics behind deleting snapshots and what goes on in the plumbing. If you don't currently subscribe to Ben’s blog I would highly recommend that you do so via the RSS feed here. If you search for snapshot information on his blog you will find:
That will tell you what you expect in terms of the underlying mechanics of how snapshots are removed etc. What EventIDs should you then look for in the event logs? TechNet has most of this covered off in the Virtual Machine Snapshot Operation section.
Feedback is also provided via the Hyper-V interface, as shown in the image below. This will track progress as a percentage. Note that this is not shown via the SCVMM summary pane, and to monitor snapshot deletion you can monitor for the associated event IDs.
Monitoring for completion of the merge is the critical aspect here. If the VM is powered on before the merge has completed in Windows 2008 and Windows 2008 R2 the merge is then aborted and the process of merging the differencing disk is stopped. The net result of this is that the .avhd file persists on disk and continues to consume disk space.
This is one of the reasons that snapshots are to be used judiciously in production environments. Another reason is that different vendors or product groups may or may not support Hypervisor based snapshots when their application is installed. Exchange is an example that does NOT support Hypervisor based snapshots. You will see this sort of wording around the product support requirements “
Some hypervisors include features for taking snapshots of virtual machines. Virtual machine snapshots capture the state of a virtual machine while it's running. This feature enables you to take multiple snapshots of a virtual machine and then revert the virtual machine to any of the previous states by applying a snapshot to the virtual machine. However, virtual machine snapshots aren't application aware, and using them can have unintended and unexpected consequences for a server application that maintains state data, such as Exchange. As a result, making virtual machine snapshots of an Exchange guest virtual machine isn't supported.”
The Hyper-V merge events are located under:
Applications and Services LogsWindows Hyper-V-VMMSAdmin
Deleting a snapshot results in EventID 19070 when the merge process starts and EventID 19080 when the merge has completed.
'E2K3-DC' background disk merge has been started. (Virtual machine ID D1205407-384D-4A0B-8028-765611B07537)
'E2K3-DC' background disk merge has been finished successfully. (Virtual machine ID D1205407-384D-4A0B-8028-765611B07537)
If the merge is interrupted this will result in EventID 19091 which has the following event text:
Background disk merge has been interrupted. (Virtual machine ID %2)
In case you are interested in events for other Hyper-V aspects, the Hierarchy of Managed Entities contains the EventIDs associated with the various components.
Windows Server 2012 Hyper-V will support live snapshot merge so having to power off VMs to merge .avhd files should minor issue in the future!
Cheers,
Rhoderick
