Jump to content
achilcott

klmeta.dat - Preventing Backups

Recommended Posts

We're currently using Kaspersky Endpoint Security for Windows 11.0.0.6499. This is via the LogMeIn Central Product.

We have the client installed on Windows Server 2016, Version 1607 (OS Build 14393.2551) and using Standard Windows Server Backup.

The logs located in:

%windir%\logs\windowsserverbackup

Report the following:

Error in deletion of [E:\System Volume Information\klmeta.dat] while pruning the target VHD: Error [0x80070020] The process cannot access the file because it is being used by another process

Even after placing an exception in Windows Server Backup for "E:\System Volume Information" it is still failing. 

I've tried disabling Kaspersky and running the backup then, but the same error continues to appear in the log files. I've searched the forums here and there was an issue logged in March:

https://forum.kaspersky.com/index.php?/topic/390254-kis2018-locking-drives-klmetadat/&tab=comments#comment-2786844

Which is similar to what I'm experiencing and as the Original Poster mentioned there has to be a better solution than uninstalling the EndPoint each time you need to run a backup job.

Has anybody else had issue with this or experience with the klmeta.dat file? Perhaps there is a way for this file to be removed or prevented from being created by Kaspersky. 

Share this post


Link to post
2 часа назад, achilcott сказал:

We're currently using Kaspersky Endpoint Security for Windows 11.0.0.6499. This is via the LogMeIn Central Product.

We have the client installed on Windows Server 2016, Version 1607 (OS Build 14393.2551) and using Standard Windows Server Backup.

The logs located in:


%windir%\logs\windowsserverbackup

Report the following:


Error in deletion of [E:\System Volume Information\klmeta.dat] while pruning the target VHD: Error [0x80070020] The process cannot access the file because it is being used by another process

Even after placing an exception in Windows Server Backup for "E:\System Volume Information" it is still failing. 

I've tried disabling Kaspersky and running the backup then, but the same error continues to appear in the log files. I've searched the forums here and there was an issue logged in March:

https://forum.kaspersky.com/index.php?/topic/390254-kis2018-locking-drives-klmetadat/&tab=comments#comment-2786844

Which is similar to what I'm experiencing and as the Original Poster mentioned there has to be a better solution than uninstalling the EndPoint each time you need to run a backup job.

Has anybody else had issue with this or experience with the klmeta.dat file? Perhaps there is a way for this file to be removed or prevented from being created by Kaspersky. 

Hello!

Pleas attach a full GSI from affected machine.

Also, for Windows server we have a specialized product - Kaspersky Security for Windows Servers.

Thank you!

Share this post


Link to post

Hi,

I try to upload the report, but receive an error -200 as per screenshot. File Size is 2.4MB. Is there anywhere else you will accept the report to be hosted?

shot.PNG

Edited by achilcott

Share this post


Link to post

Hi,

Thank you for that info!

Have you tried to disable KES self-defence before backup?

What was the result?

Thank you!

Share this post


Link to post
On 12/21/2018 at 4:03 AM, achilcott said:

We're currently using Kaspersky Endpoint Security for Windows 11.0.0.6499. This is via the LogMeIn Central Product.

We have the client installed on Windows Server 2016, Version 1607 (OS Build 14393.2551) and using Standard Windows Server Backup.

The logs located in:


%windir%\logs\windowsserverbackup

Report the following:


Error in deletion of [E:\System Volume Information\klmeta.dat] while pruning the target VHD: Error [0x80070020] The process cannot access the file because it is being used by another process

Even after placing an exception in Windows Server Backup for "E:\System Volume Information" it is still failing. 

I've tried disabling Kaspersky and running the backup then, but the same error continues to appear in the log files. I've searched the forums here and there was an issue logged in March:

https://forum.kaspersky.com/index.php?/topic/390254-kis2018-locking-drives-klmetadat/&tab=comments#comment-2786844

Which is similar to what I'm experiencing and as the Original Poster mentioned there has to be a better solution than uninstalling the EndPoint each time you need to run a backup job.

Has anybody else had issue with this or experience with the klmeta.dat file? Perhaps there is a way for this file to be removed or prevented from being created by Kaspersky. 

Hello.

This behavior is expected on part of KES, and caused by wbengine.exe activity which tries to remove KL files from System Volume Information folder without releasing locks on such files.

This can be avoided by recreating the OS backup task, adding KL files (klmeta.dat, iswift.dat, ichecker.dat) to exclusions.

Thank you.

Share this post


Link to post

×
×
  • Create New...

Important Information

We use cookies to make your experience of our websites better. By using and further navigating this website you accept this. Detailed information about the use of cookies on this website is available by clicking on more information.