N-central Help

KBA11007: Unable to Start File System Monitoring

Knowledge Base Article #:

11007

Applicable Versions:

CA ARCserve RHA R16

Date Created/Updated:

June 21, 2012

Background

When using Online Mode replication, CA leverages a "File System Monitoring Driver". This driver is called XOMF. The INF file for this driver is xomf3.inf (or xomfx64.inf).

If the XOMF driver is unable to attach to the root directories when starting the scenario, you may encounter the following error in the RHA messages log:

Unable to start File System Monitoring

Definitions

The following definitions must be understood to give context to these articles:

Master Server: This is the server that the CA ARCserve RHA Engine considers to be the original source of files that are replicated.

Procedure

This issue will also occur if the spool is not local to the master server.

The CA ARCserve RHA Engine uses a minifilter driver, XOMF, which is loaded when the scenario starts and unloaded when a scenario is stopped. If you receive the Unable the start file system monitoring error, this is indicative of a problem loading XOMF.

To determine the root cause of this error, you can use the Microsoft Filter Manager utility (fltmc.exe).

On the Master Server:

  1. Check that the driver (XOMF) is not loaded by typing the Fltmc command at a DOS prompt. This will show a list of all mini-filter drivers that are currently loaded. Run this command to make sure that xomf3*.sys is not loaded, it will be identified as XOMF.

    If the driver is currently loaded, unload it by using fltmc unload xomf

  2. Try to load the drive manually using the command: fltmc load xomf

    Does an error present itself in the CMD window?

    If not, then there is not a problem in starting the driver in general. However there may be a problem attaching to a given directory. Please proceed to the section below on Attaching the XOMF to the root directory.

    If an error is displayed, look into the root cause for the failure to load the driver. Here are the most common errors and their resolutions:

    1. Load failed with error: 0x80070002

      The system cannot find the file specified. While the file does exist in the system32\driver folder on the master server, the most common reason is that the driver is not properly registered. To re-register the driver, right-click on the INSTALLDIR\XOMF\xomf3.inf file on the master server and select the Install option.

    2. Load failed with error: 0x8007052

      A required privilege is not held by the client.

      1. Click Administrative Tools > User Rights Assignment > Local Security Policy.
      2. Under Load and Unload Drivers, verify that the local administrator group and the domain administrators group are both included.
      3. Also verify this Security Policy at the Domain level as Domain level policies supersede Local Security Policies.
    3. Load failed with error: 0x80070420

      An instance of the service is already running. This condition usually occurs after the Engine has been upgraded. While fltmc does not show XOMF loaded, this indicates that the driver was not properly unloaded (it may be only partially unloaded). In this case the only solution is rebooting. You may need to re-register the driver after the reboot.

      • Windows 2003 (x86) - To re-register the driver right click on INSTALLDIR\XOMF\xomf3.inf file on the master and select Install option.
      • Windows 2003 (x64) - To re-register the driver right click on INSTALLDIR\XOMF3x64\xomf3x64.inf file on the master and select Install option.
      • Windows 2008 (x86) - To re-register the driver right click on INSTALLDIR\XOMF8\xomf8.inf file on the master and select Install option.
      • Windows 2008 (x64) - To re-register the driver right click on INSTALLDIR\XOMF8x64\xomf8x64.inf file on the master and select Install option. Once the driver loads without issue you can run fltmc unload xomf to unload the driver. Running fltmc will show all drivers that are loaded.

Attaching the XOMF to the root directory

In instances that you receive the Unable to start file system monitoring error and the driver is able to be loaded, the issue may be in the attachment of the driver to the root directory of the scenario.

To test this possibility, perform the following:

  1. Run the command: fltmc attach xomf X:\Data1

    X:\Data1 is the full path to the root directory.

  2. This should be repeated for each root directory of the scenario.
  3. On successful completion of the command, you will see the following:

    ATTACH successful... Instance Name: xomf3 - Top Instance

  4. Once attached to each root directory, run fltmc without any parameters. This will show the driver loaded as well as the number of instances (this should equal the number of root directories attached):
    Filter Name                     Num Instances Frame
    ------------------------------  ------------- -----
    xomf                                   2        1
  5. Once the test is complete, unload the driver by running fltmc unload xomf
  6. Note any errors encountered at each stage of this process. If logging a case with SolarWinds MSP Technical Support, please ensure that you attach the output of all commands for review as well as all relevant logs and system information.
  7. If errors are reported during the logging consult the windows event log and relevant documentation for root cause.
  8. If no errors are reported during these procedures or if you would like assistance is interpreting and troubleshooting the scenario please contact us at http://support.n-able.com or by phone at 1-877-655-4689 and we will be happy to assist.

XOMF Driver Will Not Attach

If the XOMF driver is able to load but unable to attach to the directory, review the following Microsoft Knowledgebase Article:

http://support.microsoft.com/kb/975759

If this article applies to your system, please ensure that the patch is installed as this has been seen to cause these problems.

Source

This article is based on the information found in CA's internal KBA #536117. Sign in to https://support.ca.com to locate this article.