Question on event log errors

  • Thread starter Thread starter yepiknowiam
  • Start date Start date
Y

yepiknowiam

Guest
Not sure if someone can help me out with this, but wanted to ask.

We have 2 servers (HP ML350 G3) running server 2003 with sp2. About 5 days
apart, both started to fail and have issues at the same time, identical
errors in the event log.

The main system errors are event id 333 (An I/O operation initiated by the
Registry failed unrecoverably. The Registry could not read in or write out or
flush one of the files that contain the system's image of the Registry) and
event id 773 Server Agents.

There also will be some warning at the same time in the application log
related to prefdisk, which is weird because we don't track counters. From
what I can tell the hard drives are both fine, chkdsk doesn't produce any
errors.

The hardware of these 2 servers are identical. The don't have all the same
applications. We tried to uninstall the symantec antivirus, updated all the
drivers and firmware on the servers, and the bios. I do not know if it's a
hardware or application issue. They happened a few days apart, which is
weird.

Our hardware vendor can't seem to figure out what is wrong and I spent many
hours researching online without much luck.

Looking for any ideas or suggestions. It's hard to imagine two pieces of
hardware on 2 servers would fail at the same time. I am a bit lost on this
one.
 
Re: Question on event log errors

This hotfix may help.

http://support.microsoft.com/default.aspx?scid=kb;en-us;898060



--

Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

"yepiknowiam" wrote:
> Not sure if someone can help me out with this, but wanted to ask.
>
> We have 2 servers (HP ML350 G3) running server 2003 with sp2. About 5
> days
> apart, both started to fail and have issues at the same time, identical
> errors in the event log.
>
> The main system errors are event id 333 (An I/O operation initiated by the
> Registry failed unrecoverably. The Registry could not read in or write out
> or
> flush one of the files that contain the system's image of the Registry)
> and
> event id 773 Server Agents.
>
> There also will be some warning at the same time in the application log
> related to prefdisk, which is weird because we don't track counters. From
> what I can tell the hard drives are both fine, chkdsk doesn't produce any
> errors.
>
> The hardware of these 2 servers are identical. The don't have all the
> same
> applications. We tried to uninstall the symantec antivirus, updated all
> the
> drivers and firmware on the servers, and the bios. I do not know if it's
> a
> hardware or application issue. They happened a few days apart, which is
> weird.
>
> Our hardware vendor can't seem to figure out what is wrong and I spent
> many
> hours researching online without much luck.
>
> Looking for any ideas or suggestions. It's hard to imagine two pieces of
> hardware on 2 servers would fail at the same time. I am a bit lost on
> this
> one.
 
Re: Question on event log errors

Thanks for the info. Most of the articles I've seen relate to sp1 and we are
on sp2.

They were working fine until about july 3rd. Its possible a windows update
was applied that is giving problems, but I doubt it. Possible an update from
symantec caused problems, but the uninstall didn't fix any thing. We never
had any issues with these servers for years until a few weeks ago.

It almost acts like it's out of memory, task manager is not showing any
problems, but errors on the screen would tell you otherwise and also it
causes the keyboard to stop working. No software was installed recently,
other then your regular windows updates and the live update from symantec.

My other thought is something in the registry is not getting release,
probably due to symantec. Have you seen this happen before and how do you
flush out the reg?

"Dave Patrick" wrote:

> This hotfix may help.
>
> http://support.microsoft.com/default.aspx?scid=kb;en-us;898060
>
>
>
> --
>
> Regards,
>
> Dave Patrick ....Please no email replies - reply in newsgroup.
> Microsoft Certified Professional
> Microsoft MVP [Windows]
> http://www.microsoft.com/protect
>
> "yepiknowiam" wrote:
> > Not sure if someone can help me out with this, but wanted to ask.
> >
> > We have 2 servers (HP ML350 G3) running server 2003 with sp2. About 5
> > days
> > apart, both started to fail and have issues at the same time, identical
> > errors in the event log.
> >
> > The main system errors are event id 333 (An I/O operation initiated by the
> > Registry failed unrecoverably. The Registry could not read in or write out
> > or
> > flush one of the files that contain the system's image of the Registry)
> > and
> > event id 773 Server Agents.
> >
> > There also will be some warning at the same time in the application log
> > related to prefdisk, which is weird because we don't track counters. From
> > what I can tell the hard drives are both fine, chkdsk doesn't produce any
> > errors.
> >
> > The hardware of these 2 servers are identical. The don't have all the
> > same
> > applications. We tried to uninstall the symantec antivirus, updated all
> > the
> > drivers and firmware on the servers, and the bios. I do not know if it's
> > a
> > hardware or application issue. They happened a few days apart, which is
> > weird.
> >
> > Our hardware vendor can't seem to figure out what is wrong and I spent
> > many
> > hours researching online without much luck.
> >
> > Looking for any ideas or suggestions. It's hard to imagine two pieces of
> > hardware on 2 servers would fail at the same time. I am a bit lost on
> > this
> > one.
>
 
Re: Question on event log errors

Also forgot to mention when these errors occur, often the event log will get
cleared out and erased by the system. I have the error message at the
office, basically gives you an error on screen that the file located in
windows/config/system.evt cannot be written to and will be lost, consider
moving the file... something along those lines.

It does this on both servers. Also seen messages about not being to do a
read-write to a certain directory. Event 2019 that relates to non-paged pool
memory and WaitForMultipleObjects warnings.

The hard drives are in a raid 1.

"Dave Patrick" wrote:

> This hotfix may help.
>
> http://support.microsoft.com/default.aspx?scid=kb;en-us;898060
>
>
>
> --
>
> Regards,
>
> Dave Patrick ....Please no email replies - reply in newsgroup.
> Microsoft Certified Professional
> Microsoft MVP [Windows]
> http://www.microsoft.com/protect
>
> "yepiknowiam" wrote:
> > Not sure if someone can help me out with this, but wanted to ask.
> >
> > We have 2 servers (HP ML350 G3) running server 2003 with sp2. About 5
> > days
> > apart, both started to fail and have issues at the same time, identical
> > errors in the event log.
> >
> > The main system errors are event id 333 (An I/O operation initiated by the
> > Registry failed unrecoverably. The Registry could not read in or write out
> > or
> > flush one of the files that contain the system's image of the Registry)
> > and
> > event id 773 Server Agents.
> >
> > There also will be some warning at the same time in the application log
> > related to prefdisk, which is weird because we don't track counters. From
> > what I can tell the hard drives are both fine, chkdsk doesn't produce any
> > errors.
> >
> > The hardware of these 2 servers are identical. The don't have all the
> > same
> > applications. We tried to uninstall the symantec antivirus, updated all
> > the
> > drivers and firmware on the servers, and the bios. I do not know if it's
> > a
> > hardware or application issue. They happened a few days apart, which is
> > weird.
> >
> > Our hardware vendor can't seem to figure out what is wrong and I spent
> > many
> > hours researching online without much luck.
> >
> > Looking for any ideas or suggestions. It's hard to imagine two pieces of
> > hardware on 2 servers would fail at the same time. I am a bit lost on
> > this
> > one.
>
 
Re: Question on event log errors

That's really strange. Please post the error when you get the chance.


--

Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

"yepiknowiam" wrote:
> Also forgot to mention when these errors occur, often the event log will
> get
> cleared out and erased by the system. I have the error message at the
> office, basically gives you an error on screen that the file located in
> windows/config/system.evt cannot be written to and will be lost, consider
> moving the file... something along those lines.
>
> It does this on both servers. Also seen messages about not being to do a
> read-write to a certain directory. Event 2019 that relates to non-paged
> pool
> memory and WaitForMultipleObjects warnings.
>
> The hard drives are in a raid 1.
 
Re: Question on event log errors

I would try booting in Safe Mode to see if you still get the errors. Then
perhaps enable services until you get the error. You could also use msconfig
to disable services at startup.
Anthony
http://www.airdesk.com



"yepiknowiam" <yepiknowiam@discussions.microsoft.com> wrote in message
news:CD2BB6DB-DD45-4673-9197-161FB22B0BFB@microsoft.com...
> Not sure if someone can help me out with this, but wanted to ask.
>
> We have 2 servers (HP ML350 G3) running server 2003 with sp2. About 5
> days
> apart, both started to fail and have issues at the same time, identical
> errors in the event log.
>
> The main system errors are event id 333 (An I/O operation initiated by the
> Registry failed unrecoverably. The Registry could not read in or write out
> or
> flush one of the files that contain the system's image of the Registry)
> and
> event id 773 Server Agents.
>
> There also will be some warning at the same time in the application log
> related to prefdisk, which is weird because we don't track counters. From
> what I can tell the hard drives are both fine, chkdsk doesn't produce any
> errors.
>
> The hardware of these 2 servers are identical. The don't have all the
> same
> applications. We tried to uninstall the symantec antivirus, updated all
> the
> drivers and firmware on the servers, and the bios. I do not know if it's
> a
> hardware or application issue. They happened a few days apart, which is
> weird.
>
> Our hardware vendor can't seem to figure out what is wrong and I spent
> many
> hours researching online without much luck.
>
> Looking for any ideas or suggestions. It's hard to imagine two pieces of
> hardware on 2 servers would fail at the same time. I am a bit lost on
> this
> one.
 
Re: Question on event log errors

Here are a couple of the messages:


{Delayed Write Failed} Windows was unable to save all the data for the file
\WINDOWS\system32\config\SysEvent.Evt. The data has been lost. This error may
be caused by a failure of your computer hardware or network connection.
Please try to save this file elsewhere.


{Delayed Write Failed} Windows was unable to save all the data for the file
\$Mft. The data has been lost. This error may be caused by a failure of your
computer hardware or network connection. Please try to save this file
elsewhere.


There are more, like I mentioned in my previous posts, but those confused me
a little, they always follow with a bunch of event id 333 application popup
errors.

"Dave Patrick" wrote:

> That's really strange. Please post the error when you get the chance.
>
>
> --
>
>
 
Re: Question on event log errors

Hello yepiknowiam,

Have a look here, even if 2003 is not mentioned:
http://support.microsoft.com/?kbid=330174

http://support.microsoft.com/kb/818408

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm

> Here are a couple of the messages:
>
> {Delayed Write Failed} Windows was unable to save all the data for the
> file \WINDOWS\system32\config\SysEvent.Evt. The data has been lost.
> This error may be caused by a failure of your computer hardware or
> network connection. Please try to save this file elsewhere.
>
> {Delayed Write Failed} Windows was unable to save all the data for the
> file \$Mft. The data has been lost. This error may be caused by a
> failure of your computer hardware or network connection. Please try to
> save this file elsewhere.
>
> There are more, like I mentioned in my previous posts, but those
> confused me a little, they always follow with a bunch of event id 333
> application popup errors.
>
> "Dave Patrick" wrote:
>
>> That's really strange. Please post the error when you get the chance.
>>
>> --
>>
 
Re: Question on event log errors

The symptoms all point to writing to the disk. These articles may help.
Since you have two servers doing the same thing I think I'd look at the
hardware. Possibly the scsi bus terminations and or controller firmware are
to blame.

http://support.microsoft.com/kb/816004/en-us
http://support.microsoft.com/kb/890352/en-us
http://support.microsoft.com/kb/154690/


--

Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

"yepiknowiam" wrote:
> Here are a couple of the messages:
>
>
> {Delayed Write Failed} Windows was unable to save all the data for the
> file
> \WINDOWS\system32\config\SysEvent.Evt. The data has been lost. This error
> may
> be caused by a failure of your computer hardware or network connection.
> Please try to save this file elsewhere.
>
>
> {Delayed Write Failed} Windows was unable to save all the data for the
> file
> \$Mft. The data has been lost. This error may be caused by a failure of
> your
> computer hardware or network connection. Please try to save this file
> elsewhere.
>
>
> There are more, like I mentioned in my previous posts, but those confused
> me
> a little, they always follow with a bunch of event id 333 application
> popup
> errors.
 
Re: Question on event log errors

Thanks for the info. I forwarded this off to my hardware vendor that is
assisting me. One of the first things we tried was updating all the drivers
and firmware, but its possible we missed something.

"Dave Patrick" wrote:

> The symptoms all point to writing to the disk. These articles may help.
> Since you have two servers doing the same thing I think I'd look at the
> hardware. Possibly the scsi bus terminations and or controller firmware are
> to blame.
>
> http://support.microsoft.com/kb/816004/en-us
> http://support.microsoft.com/kb/890352/en-us
> http://support.microsoft.com/kb/154690/
>
>
> --
>
> Regards,
>
> Dave Patrick ....Please no email replies - reply in newsgroup.
> Microsoft Certified Professional
> Microsoft MVP [Windows]
> http://www.microsoft.com/protect
>
> "yepiknowiam" wrote:
> > Here are a couple of the messages:
> >
> >
> > {Delayed Write Failed} Windows was unable to save all the data for the
> > file
> > \WINDOWS\system32\config\SysEvent.Evt. The data has been lost. This error
> > may
> > be caused by a failure of your computer hardware or network connection.
> > Please try to save this file elsewhere.
> >
> >
> > {Delayed Write Failed} Windows was unable to save all the data for the
> > file
> > \$Mft. The data has been lost. This error may be caused by a failure of
> > your
> > computer hardware or network connection. Please try to save this file
> > elsewhere.
> >
> >
> > There are more, like I mentioned in my previous posts, but those confused
> > me
> > a little, they always follow with a bunch of event id 333 application
> > popup
> > errors.
>
>
 
Re: Question on event log errors

You're welcome. Also look at terminations and or cabling.


--

Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

"yepiknowiam" wrote:
> Thanks for the info. I forwarded this off to my hardware vendor that is
> assisting me. One of the first things we tried was updating all the
> drivers
> and firmware, but its possible we missed something.
 
Re: Question on event log errors

One of the vendors worked with microsoft and installed a hotfix.

http://support.microsoft.com/default.aspx?scid=kb;en-us;950310

Those are 2 of the symptoms, so hopefully it solves the problem.

"Dave Patrick" wrote:

> You're welcome. Also look at terminations and or cabling.
>
>
> --
>
> Regards,
>
> Dave Patrick ....Please no email replies - reply in newsgroup.
> Microsoft Certified Professional
> Microsoft MVP [Windows]
> http://www.microsoft.com/protect
>
> "yepiknowiam" wrote:
> > Thanks for the info. I forwarded this off to my hardware vendor that is
> > assisting me. One of the first things we tried was updating all the
> > drivers
> > and firmware, but its possible we missed something.
>
 
Back
Top