다음을 통해 공유

Event ID 50 - NTFS Delayed Write Lost

  • 아티클

We see often alerts in SCOM around "NTFS - Write Delayed Lost" which is worth to investigate further and here is a example how to look more close on this

From below KB:

"an event ID 50 message is logged if a generic error occurs when Windows is trying to write information to the disk. This error occurs when Windows is trying to commit data from the file system Cache Manager (not hardware level cache) to the physical disk. This behavior is part of the memory management of Windows. For example, if a program sends a write request, the write request is cached by Cache Manager and the program is told the write is completed successfully. At a later point in time, Cache Manager tries to lazy write the data to the physical disk. When Cache Manager tries to commit the data to disk, an error occurs writing the data, and the data is flushed from the cache and discarded. Write-back caching improves system performance, but data loss and volume integrity loss can occur as a result of lost delayed-write failures"?

{Delayed Write Failed} Windows was unable to save all the data for the file \:$I30:$INDEX_ALLOCATION. The data has been lost. This error may be caused by a failure of your computer hardware or network connection. Please try to save this file elsewhere.

Or

The driver detected a controller error on \Device\Harddisk1\DR1.

If you open the eventlog from source system and filter for event 50 you will get the event details

In this example host SERVER1 is showing error code 0x80040032 which is IO_LOST_DELAYED_WRITE and status code is key here and this tells us 0xC000026E which equals STATUS_VOLUME_DISMOUNTED. Still not how this could happen but this is a way to better understand what is exactly causing this

more details on how decode the error / status can be found here ->

https://support.microsoft.com/en-us/help/816004/description-of-the-event-id-50-error-message

hope this helps,

Ramazan

Comments

  • Anonymous
    October 18, 2017
    Hello,i see these errors time to time during vm's/datastore backups in vmware. i just created a script to close these during backup operations.