Problem description

File Server backups fail intermittently or hang during the folder listing/queued state with error codes such as PHOENIX-228, PHOENIX-189, or PHOENIX-187.

Commonly observed behaviors include:

Scheduled backups stay in a queued state or terminate unexpectedly.
Manual backups may temporarily succeed after restarting the Druva Enterprise Workloads service.
Issues frequently manifest after upgrading the Druva agent from an older version (e.g., v7 to a higher release) or when endpoint protection policies are updated on the host server.

Cause

Endpoint protection, antivirus (AV), or Endpoint Detection and Response (EDR) security software (such as CrowdStrike, Panda Security, etc.) interferes with Druva binaries and processes.

This interference usually happens in one of two ways:

Process Termination: The AV/EDR software blocks or unexpectedly terminates the FS plugin's child process because new executable binaries introduced during an agent upgrade are missing from existing exclusion lists.
Inline Hooking / DLL Injection: Third-party AV/EDR software injects monitoring DLLs (e.g., PSNInjComm64.dll, PSNInjTools64.dll) into active Druva processes (e.g., PhoenixFSSnapshot.exe or PhoenixFSBackupAgent.exe), causing abrupt termination without standard crash logs.

Traceback

Log Paths

Review the File Server logs located at: C:\ProgramData\Druva\EnterpriseWorkloads\logs\FS

Common Log Patterns & Findings

CrowdStrike / Process Termination:
```
[Error] FS plugin child process terminated unexpectedly [Info] Backup job stuck in queued state
```
(Note: Representative log patterns; exact wording may vary depending on agent version and environment.)
Panda / DLL Injection:
- Procmon logs show third-party AV DLL creation while PhoenixFSSnapshot.exe is running.
- Process dumps reveal injected third-party DLLs within PhoenixFSBackupAgent.exe.

Resolution

Step 1: Verify Antivirus / EDR Interference

Collect and analyze the following diagnostic files:

Procmon logs captured during the backup run.(How to capture & Download Procmon Logs in Windows)
Windows Event Logs (System and Application).
Process Dumps for affected Druva executables (PhoenixFSSnapshot.exe, PhoenixFSBackupAgent.exe). (How to capture & download Process Dump in Windows for a Specific Process)

Check for unexpected termination of Druva processes or third-party DLL injections into key executables.

Step 2: Configure Antivirus & EDR Exclusions

Work with your IT Security / Antivirus administration team to configure global exclusions for Druva Enterprise Workloads processes and directories.

Path Exclusions:

Exclude the entire Druva installation directory and working folders:

C:\Program Files\Druva\EnterpriseWorkloads
C:\ProgramData\Druva\EnterpriseWorkloads

Process / Executable Exclusions:

Ensure all active Druva binaries (especially new/updated executables post-agent upgrade) are excluded from real-time scanning, behavioral monitoring, and process termination rules:

PhoenixFSSnapshot.exe
PhoenixFSBackupAgent.exe
All executable processes under C:\Program Files\Druva\EnterpriseWorkloads\

Note: Security solutions that utilize aggressive inline process hooking may continue to interfere even with folder-level exclusions. In such scenarios, explicit process-level exclusions or policy adjustments within the EDR console (e.g., CrowdStrike Falcon, Panda Security) are required.

⚠️ Important: In persistent cases where interference continues despite all exclusions being applied, complete removal of the AV/EDR agent from the host may be necessary as a last resort to confirm the root cause and restore backup functionality. Coordinate with your IT Security team before proceeding.

Step 3: Schedule Adjustment (If Applicable)

If backup windows overlap with heavy security scans or system maintenance tasks, adjust the Druva backup schedule (e.g., shifting the start time by 1 hour) to prevent schedule conflicts.

Include and exclude filters

Antivirus / EDR Console Exclusions

To prevent agent interference, add the following path and process exclusions in your AV/EDR management software:

Directory Exclusions:
- C:\Program Files\Druva\EnterpriseWorkloads\*
- C:\ProgramData\Druva\EnterpriseWorkloads\*
Process Exclusions:
- PhoenixFSSnapshot.exe
- PhoenixFSBackupAgent.exe

Verification

Restart the Druva Enterprise Workloads service on the host server via Windows Services (services.msc).
Trigger a manual backup from the Druva console to confirm execution completes past the folder listing phase.
Verify that subsequent scheduled backups run successfully without hanging or failing.

File Server Backup Fails or Hangs Due to Antivirus / EDR Interference (PHOENIX-228, PHOENIX-189, PHOENIX-187)