Problem description

VMware restore using file level restores (FLR) with GOS_SVC1 Error (Guest OS Service)
Restoring files/folders to Same VM/Alternate VM fail with the same error

Cause:

Client Virtual Machine Firewall is blocking the TCP port required for FLR file copy operations.

Troubleshooting

Review failed FLR Job ID by downloading the detailed log.
- Search for Job Log in bundle:
  EnterpriseWorkloadsFL.<job_id>.<timestamp>.log
- Error message found in job log: error="Failed to prepare for restore job" msg="Service unavailable: Service Unavailable: Post \"https://X.X.X.X:61358/guestossvc/v1/getAccessToken\": dial tcp X.X.X.X:61358: connect: connection refused"
Verify client vm firewall or security software is enabled or other firewalls configurations between client vm and vmware proxy
Re-Attempt FLR while monitoring networking connectivity
- On Client VM
  - netstat -tn to monitoring for open TCP port for Guest OS Service
- On VMware Proxy
  - Monitoring FLR job log - Monitoring for FLR TCP port request
    tail -f /var/log/Druva/EnterpriseWorkloads/vmware/restore/<backupset_id>/<job_id>/EnterpriseWorkloadsFL.<job_id>.<timestamp>.log
nc -vz <destination VM IP> <TCP port select by FLR attempt>

Resolution

Allow required TCP Port Communication through the Firewall configuration
- Option 1: Disable Firewall
- Option 2: Create firewall rule for inbound TCP communication with the range of the following ports: [49125 - 65535] for all VMware proxies. By default the VMware proxy will select a TCP port dynamic for FLR operations.
- Option 3: Create firewall rule for inbound for a specific TCP port to be used by the VMware Proxies.
  - Select TCP port within the range of [49125 - 65535], Should not be used by any other service
  - On the VMMware Proxy: Modify the VMware Configuration file to use this port.
    File Location: /etc/Druva/EnterpriseWorkloads/vmware/VMwareConfig.yaml
    Modify two lines that contain: flr_guest_vm_port_range:
    flr_guest_vm_port_range:[ <Enter TCP Port Number> ]
    Example: Flr_guest_vm_port_range: [52481]
  - Restart Durva-Enterprise Workload Service
    systemctl restart Druva-EnterpriseWorkloads.service
  - On the VMware Guest: Modify Firewall configuration on Client or network firewall between VM and Proxy

Additional Troubleshooting Insights

In some scenarios, Logs may point to issues accessing guest OS files despite the guestossvc.exe process being active.

Observed Log Error Example:

level=error ts=2025-07-21T10:59:04.186558303Z filename=guest_os.go:133 Method=DownloadFile Message="Failed to initiate file transfer from guest, Attempt 0" ErrorMessage="ServerFaultCode: File C:\\ProgramData\\Druva\\EnterpriseWorkloads\\vmware\\9432\\guest_os_info.txt was not found"

Root Cause in This Case:

GuestOS service was running and generating required files under %ProgramData%\EnterpriseWorkloads\VMware\<JobID>, but was unable to complete the restore due to a blocked inbound firewall rule.
Once the rule was allowed, the FLR operation completed successfully.

Validation Steps:

Login to target server and check guestossvc logs:
Navigate to:
%ProgramData%\EnterpriseWorkloads\VMware\<JOBID>\
Open:
- guest_os_info.txt — for guest OS communication details
- .\logs\GuestOSSvc.<jobid>.<timestamp>.log — to find the ephemeral TCP port used
Validate Port Availability:
- Identify the ephemeral port from the logs
- Run the following command on the Target VM (CMD as Administrator):
  netstat -ano | findstr ":<port>"
- Check if the port is in LISTENING or ESTABLISHED state during the restore
- If process never moves beyond LISTENING, then the Druva proxy may not be reaching the guest process on that port and most common reason is Firewall rules still blocking the inbound port

Firewall Rule Reference:

Ensure the inbound rule for "File and Printer Sharing" is enabled. Refer to this article for more on configuring this rule.

VMware FLR fails with GOS_SVC1 Error