Can't find process that is creating backups
2015-09-03 19:02:30.71 Backup Database backed up. Database: db_name, creation date(time): 2012/10/12(20:52:11), pages dumped: 3290021, first LSN: 276028:152755:172, last LSN: 276028:152827:1, number of dump devices: 1, device information: (FILE=1, TYPE=VIRTUAL_DEVICE: {'{95380B0A-D50B-408F-B95F-1AB8975BA7F8}5'}). This is an informational message only. No user action is required.
The fact that VIRTUAL_DEVICE
comes into the backup message clearly says that this is not backup scheduled by T-SQL Job or SQL Server so you wont find it anywhere in SQL Server. You either have some third party
tool or windows inbuilt backup mechanism
running which is taking this backup.
Now if you really want to find out the source of backup consult windows team or storage team and you would get a fair idea. If all the stakeholders say they do not have idea about the source of backup ( which is highly unlikely) you can stop such backup from happening by disabling SQL Server VSS writer
from Services.msc
.
Such Third party backups rely on SQL Server VSS writer services to connect to database and take backup.
Before proceeding above I would suggest you to talk to backup/windows admin if they are not aware about any such backup you can go ahead and disable this service. Otherwise you must not and you should consult more regarding this with them.
Please read Information Shedding Light on VSS Backups
I think I have found the process responsible for the backup.
I searched info in Windows System Event log and I found this lines in the temporal period interested by the backup:
Informazioni 16/09/2015 19:01:28 MSSQLSERVER 18264 Backup
Informazioni 16/09/2015 19:01:28 MSSQLSERVER 18264 Backup
Informazioni 16/09/2015 19:01:28 MSSQLSERVER 18264 Backup
Informazioni 16/09/2015 19:01:28 ESENT 2006 ShadowCopy
Informazioni 16/09/2015 19:01:28 ESENT 2006 ShadowCopy
Informazioni 16/09/2015 19:01:28 ESENT 2003 ShadowCopy
Informazioni 16/09/2015 19:01:28 ESENT 2003 ShadowCopy
Informazioni 16/09/2015 19:01:28 MSSQLSERVER 3198 Server
Informazioni 16/09/2015 19:01:28 MSSQLSERVER 3198 Server
Informazioni 16/09/2015 19:01:28 MSSQLSERVER 3198 Server
Informazioni 16/09/2015 19:01:28 MSSQLSERVER 3198 Server
Informazioni 16/09/2015 19:01:28 MSSQLSERVER 3198 Server
Informazioni 16/09/2015 19:01:28 MSSQLSERVER 3198 Server
Informazioni 16/09/2015 19:01:28 MSSQLSERVER 3198 Server
Informazioni 16/09/2015 19:01:28 MSSQLSERVER 3198 Server
Informazioni 16/09/2015 19:01:28 MSSQLSERVER 3198 Server
Informazioni 16/09/2015 19:01:25 MSSQLSERVER 3197 Server
Informazioni 16/09/2015 19:01:25 MSSQLSERVER 3197 Server
Informazioni 16/09/2015 19:01:25 MSSQLSERVER 3197 Server
Informazioni 16/09/2015 19:01:25 MSSQLSERVER 3197 Server
Informazioni 16/09/2015 19:01:25 MSSQLSERVER 3197 Server
Informazioni 16/09/2015 19:01:25 MSSQLSERVER 3197 Server
Informazioni 16/09/2015 19:01:25 MSSQLSERVER 3197 Server
Informazioni 16/09/2015 19:01:25 MSSQLSERVER 3197 Server
Informazioni 16/09/2015 19:01:25 ESENT 2001 ShadowCopy
Informazioni 16/09/2015 19:01:25 ESENT 2001 ShadowCopy
Informazioni 16/09/2015 19:01:25 ESENT 2001 ShadowCopy
Informazioni 16/09/2015 19:01:25 MSSQLSERVER 3197 Server
Informazioni 16/09/2015 19:01:23 ESENT 2005 ShadowCopy
Informazioni 16/09/2015 19:01:23 ESENT 2005 ShadowCopy
Informazioni 16/09/2015 19:01:11 BeVssProvider 0 Nessuna
Informazioni 16/09/2015 18:38:06 VSS 8224 Nessuna
Informazioni 16/09/2015 18:29:01 VSS 8224 Nessuna
You can clearly see the backup activity on MSSQLSERVER on top and short before other activity started by BeVssProvider, continuing with a ShadowCopy by ESENT.
I googled for these names and BeVssProvider is linked to Symantec Backup Exec™ for Windows Servers (http://systemexplorer.net/it/file-database/file/bevssprovider-exe).
So I guess that software is taking a snapshot of the machine every day (I'm not an expert in this domain).