Guest yepiknowiam Posted July 26, 2008 Posted July 26, 2008 Not sure if someone can help me out with this, but wanted to ask. We have 2 servers (HP ML350 G3) running server 2003 with sp2. About 5 days apart, both started to fail and have issues at the same time, identical errors in the event log. The main system errors are event id 333 (An I/O operation initiated by the Registry failed unrecoverably. The Registry could not read in or write out or flush one of the files that contain the system's image of the Registry) and event id 773 Server Agents. There also will be some warning at the same time in the application log related to prefdisk, which is weird because we don't track counters. From what I can tell the hard drives are both fine, chkdsk doesn't produce any errors. The hardware of these 2 servers are identical. The don't have all the same applications. We tried to uninstall the symantec antivirus, updated all the drivers and firmware on the servers, and the bios. I do not know if it's a hardware or application issue. They happened a few days apart, which is weird. Our hardware vendor can't seem to figure out what is wrong and I spent many hours researching online without much luck. Looking for any ideas or suggestions. It's hard to imagine two pieces of hardware on 2 servers would fail at the same time. I am a bit lost on this one.
Guest Dave Patrick Posted July 27, 2008 Posted July 27, 2008 Re: Question on event log errors This hotfix may help. http://support.microsoft.com/default.aspx?scid=kb;en-us;898060 -- Regards, Dave Patrick ....Please no email replies - reply in newsgroup. Microsoft Certified Professional Microsoft MVP [Windows] http://www.microsoft.com/protect "yepiknowiam" wrote: > Not sure if someone can help me out with this, but wanted to ask. > > We have 2 servers (HP ML350 G3) running server 2003 with sp2. About 5 > days > apart, both started to fail and have issues at the same time, identical > errors in the event log. > > The main system errors are event id 333 (An I/O operation initiated by the > Registry failed unrecoverably. The Registry could not read in or write out > or > flush one of the files that contain the system's image of the Registry) > and > event id 773 Server Agents. > > There also will be some warning at the same time in the application log > related to prefdisk, which is weird because we don't track counters. From > what I can tell the hard drives are both fine, chkdsk doesn't produce any > errors. > > The hardware of these 2 servers are identical. The don't have all the > same > applications. We tried to uninstall the symantec antivirus, updated all > the > drivers and firmware on the servers, and the bios. I do not know if it's > a > hardware or application issue. They happened a few days apart, which is > weird. > > Our hardware vendor can't seem to figure out what is wrong and I spent > many > hours researching online without much luck. > > Looking for any ideas or suggestions. It's hard to imagine two pieces of > hardware on 2 servers would fail at the same time. I am a bit lost on > this > one.
Guest yepiknowiam Posted July 27, 2008 Posted July 27, 2008 Re: Question on event log errors Thanks for the info. Most of the articles I've seen relate to sp1 and we are on sp2. They were working fine until about july 3rd. Its possible a windows update was applied that is giving problems, but I doubt it. Possible an update from symantec caused problems, but the uninstall didn't fix any thing. We never had any issues with these servers for years until a few weeks ago. It almost acts like it's out of memory, task manager is not showing any problems, but errors on the screen would tell you otherwise and also it causes the keyboard to stop working. No software was installed recently, other then your regular windows updates and the live update from symantec. My other thought is something in the registry is not getting release, probably due to symantec. Have you seen this happen before and how do you flush out the reg? "Dave Patrick" wrote: > This hotfix may help. > > http://support.microsoft.com/default.aspx?scid=kb;en-us;898060 > > > > -- > > Regards, > > Dave Patrick ....Please no email replies - reply in newsgroup. > Microsoft Certified Professional > Microsoft MVP [Windows] > http://www.microsoft.com/protect > > "yepiknowiam" wrote: > > Not sure if someone can help me out with this, but wanted to ask. > > > > We have 2 servers (HP ML350 G3) running server 2003 with sp2. About 5 > > days > > apart, both started to fail and have issues at the same time, identical > > errors in the event log. > > > > The main system errors are event id 333 (An I/O operation initiated by the > > Registry failed unrecoverably. The Registry could not read in or write out > > or > > flush one of the files that contain the system's image of the Registry) > > and > > event id 773 Server Agents. > > > > There also will be some warning at the same time in the application log > > related to prefdisk, which is weird because we don't track counters. From > > what I can tell the hard drives are both fine, chkdsk doesn't produce any > > errors. > > > > The hardware of these 2 servers are identical. The don't have all the > > same > > applications. We tried to uninstall the symantec antivirus, updated all > > the > > drivers and firmware on the servers, and the bios. I do not know if it's > > a > > hardware or application issue. They happened a few days apart, which is > > weird. > > > > Our hardware vendor can't seem to figure out what is wrong and I spent > > many > > hours researching online without much luck. > > > > Looking for any ideas or suggestions. It's hard to imagine two pieces of > > hardware on 2 servers would fail at the same time. I am a bit lost on > > this > > one. >
Guest yepiknowiam Posted July 27, 2008 Posted July 27, 2008 Re: Question on event log errors Also forgot to mention when these errors occur, often the event log will get cleared out and erased by the system. I have the error message at the office, basically gives you an error on screen that the file located in windows/config/system.evt cannot be written to and will be lost, consider moving the file... something along those lines. It does this on both servers. Also seen messages about not being to do a read-write to a certain directory. Event 2019 that relates to non-paged pool memory and WaitForMultipleObjects warnings. The hard drives are in a raid 1. "Dave Patrick" wrote: > This hotfix may help. > > http://support.microsoft.com/default.aspx?scid=kb;en-us;898060 > > > > -- > > Regards, > > Dave Patrick ....Please no email replies - reply in newsgroup. > Microsoft Certified Professional > Microsoft MVP [Windows] > http://www.microsoft.com/protect > > "yepiknowiam" wrote: > > Not sure if someone can help me out with this, but wanted to ask. > > > > We have 2 servers (HP ML350 G3) running server 2003 with sp2. About 5 > > days > > apart, both started to fail and have issues at the same time, identical > > errors in the event log. > > > > The main system errors are event id 333 (An I/O operation initiated by the > > Registry failed unrecoverably. The Registry could not read in or write out > > or > > flush one of the files that contain the system's image of the Registry) > > and > > event id 773 Server Agents. > > > > There also will be some warning at the same time in the application log > > related to prefdisk, which is weird because we don't track counters. From > > what I can tell the hard drives are both fine, chkdsk doesn't produce any > > errors. > > > > The hardware of these 2 servers are identical. The don't have all the > > same > > applications. We tried to uninstall the symantec antivirus, updated all > > the > > drivers and firmware on the servers, and the bios. I do not know if it's > > a > > hardware or application issue. They happened a few days apart, which is > > weird. > > > > Our hardware vendor can't seem to figure out what is wrong and I spent > > many > > hours researching online without much luck. > > > > Looking for any ideas or suggestions. It's hard to imagine two pieces of > > hardware on 2 servers would fail at the same time. I am a bit lost on > > this > > one. >
Guest Dave Patrick Posted July 27, 2008 Posted July 27, 2008 Re: Question on event log errors That's really strange. Please post the error when you get the chance. -- Regards, Dave Patrick ....Please no email replies - reply in newsgroup. Microsoft Certified Professional Microsoft MVP [Windows] http://www.microsoft.com/protect "yepiknowiam" wrote: > Also forgot to mention when these errors occur, often the event log will > get > cleared out and erased by the system. I have the error message at the > office, basically gives you an error on screen that the file located in > windows/config/system.evt cannot be written to and will be lost, consider > moving the file... something along those lines. > > It does this on both servers. Also seen messages about not being to do a > read-write to a certain directory. Event 2019 that relates to non-paged > pool > memory and WaitForMultipleObjects warnings. > > The hard drives are in a raid 1.
Guest Anthony [MVP] Posted July 27, 2008 Posted July 27, 2008 Re: Question on event log errors I would try booting in Safe Mode to see if you still get the errors. Then perhaps enable services until you get the error. You could also use msconfig to disable services at startup. Anthony http://www.airdesk.com "yepiknowiam" <yepiknowiam@discussions.microsoft.com> wrote in message news:CD2BB6DB-DD45-4673-9197-161FB22B0BFB@microsoft.com... > Not sure if someone can help me out with this, but wanted to ask. > > We have 2 servers (HP ML350 G3) running server 2003 with sp2. About 5 > days > apart, both started to fail and have issues at the same time, identical > errors in the event log. > > The main system errors are event id 333 (An I/O operation initiated by the > Registry failed unrecoverably. The Registry could not read in or write out > or > flush one of the files that contain the system's image of the Registry) > and > event id 773 Server Agents. > > There also will be some warning at the same time in the application log > related to prefdisk, which is weird because we don't track counters. From > what I can tell the hard drives are both fine, chkdsk doesn't produce any > errors. > > The hardware of these 2 servers are identical. The don't have all the > same > applications. We tried to uninstall the symantec antivirus, updated all > the > drivers and firmware on the servers, and the bios. I do not know if it's > a > hardware or application issue. They happened a few days apart, which is > weird. > > Our hardware vendor can't seem to figure out what is wrong and I spent > many > hours researching online without much luck. > > Looking for any ideas or suggestions. It's hard to imagine two pieces of > hardware on 2 servers would fail at the same time. I am a bit lost on > this > one.
Guest yepiknowiam Posted July 27, 2008 Posted July 27, 2008 Re: Question on event log errors Here are a couple of the messages: {Delayed Write Failed} Windows was unable to save all the data for the file \WINDOWS\system32\config\SysEvent.Evt. The data has been lost. This error may be caused by a failure of your computer hardware or network connection. Please try to save this file elsewhere. {Delayed Write Failed} Windows was unable to save all the data for the file \$Mft. The data has been lost. This error may be caused by a failure of your computer hardware or network connection. Please try to save this file elsewhere. There are more, like I mentioned in my previous posts, but those confused me a little, they always follow with a bunch of event id 333 application popup errors. "Dave Patrick" wrote: > That's really strange. Please post the error when you get the chance. > > > -- > >
Guest Meinolf Weber Posted July 27, 2008 Posted July 27, 2008 Re: Question on event log errors Hello yepiknowiam, Have a look here, even if 2003 is not mentioned: http://support.microsoft.com/?kbid=330174 http://support.microsoft.com/kb/818408 Best regards Meinolf Weber Disclaimer: This posting is provided "AS IS" with no warranties, and confers no rights. ** Please do NOT email, only reply to Newsgroups ** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm > Here are a couple of the messages: > > {Delayed Write Failed} Windows was unable to save all the data for the > file \WINDOWS\system32\config\SysEvent.Evt. The data has been lost. > This error may be caused by a failure of your computer hardware or > network connection. Please try to save this file elsewhere. > > {Delayed Write Failed} Windows was unable to save all the data for the > file \$Mft. The data has been lost. This error may be caused by a > failure of your computer hardware or network connection. Please try to > save this file elsewhere. > > There are more, like I mentioned in my previous posts, but those > confused me a little, they always follow with a bunch of event id 333 > application popup errors. > > "Dave Patrick" wrote: > >> That's really strange. Please post the error when you get the chance. >> >> -- >>
Guest Dave Patrick Posted July 27, 2008 Posted July 27, 2008 Re: Question on event log errors The symptoms all point to writing to the disk. These articles may help. Since you have two servers doing the same thing I think I'd look at the hardware. Possibly the scsi bus terminations and or controller firmware are to blame. http://support.microsoft.com/kb/816004/en-us http://support.microsoft.com/kb/890352/en-us http://support.microsoft.com/kb/154690/ -- Regards, Dave Patrick ....Please no email replies - reply in newsgroup. Microsoft Certified Professional Microsoft MVP [Windows] http://www.microsoft.com/protect "yepiknowiam" wrote: > Here are a couple of the messages: > > > {Delayed Write Failed} Windows was unable to save all the data for the > file > \WINDOWS\system32\config\SysEvent.Evt. The data has been lost. This error > may > be caused by a failure of your computer hardware or network connection. > Please try to save this file elsewhere. > > > {Delayed Write Failed} Windows was unable to save all the data for the > file > \$Mft. The data has been lost. This error may be caused by a failure of > your > computer hardware or network connection. Please try to save this file > elsewhere. > > > There are more, like I mentioned in my previous posts, but those confused > me > a little, they always follow with a bunch of event id 333 application > popup > errors.
Guest yepiknowiam Posted July 28, 2008 Posted July 28, 2008 Re: Question on event log errors Thanks for the info. I forwarded this off to my hardware vendor that is assisting me. One of the first things we tried was updating all the drivers and firmware, but its possible we missed something. "Dave Patrick" wrote: > The symptoms all point to writing to the disk. These articles may help. > Since you have two servers doing the same thing I think I'd look at the > hardware. Possibly the scsi bus terminations and or controller firmware are > to blame. > > http://support.microsoft.com/kb/816004/en-us > http://support.microsoft.com/kb/890352/en-us > http://support.microsoft.com/kb/154690/ > > > -- > > Regards, > > Dave Patrick ....Please no email replies - reply in newsgroup. > Microsoft Certified Professional > Microsoft MVP [Windows] > http://www.microsoft.com/protect > > "yepiknowiam" wrote: > > Here are a couple of the messages: > > > > > > {Delayed Write Failed} Windows was unable to save all the data for the > > file > > \WINDOWS\system32\config\SysEvent.Evt. The data has been lost. This error > > may > > be caused by a failure of your computer hardware or network connection. > > Please try to save this file elsewhere. > > > > > > {Delayed Write Failed} Windows was unable to save all the data for the > > file > > \$Mft. The data has been lost. This error may be caused by a failure of > > your > > computer hardware or network connection. Please try to save this file > > elsewhere. > > > > > > There are more, like I mentioned in my previous posts, but those confused > > me > > a little, they always follow with a bunch of event id 333 application > > popup > > errors. > >
Guest Dave Patrick Posted July 29, 2008 Posted July 29, 2008 Re: Question on event log errors You're welcome. Also look at terminations and or cabling. -- Regards, Dave Patrick ....Please no email replies - reply in newsgroup. Microsoft Certified Professional Microsoft MVP [Windows] http://www.microsoft.com/protect "yepiknowiam" wrote: > Thanks for the info. I forwarded this off to my hardware vendor that is > assisting me. One of the first things we tried was updating all the > drivers > and firmware, but its possible we missed something.
Guest yepiknowiam Posted July 30, 2008 Posted July 30, 2008 Re: Question on event log errors One of the vendors worked with microsoft and installed a hotfix. http://support.microsoft.com/default.aspx?scid=kb;en-us;950310 Those are 2 of the symptoms, so hopefully it solves the problem. "Dave Patrick" wrote: > You're welcome. Also look at terminations and or cabling. > > > -- > > Regards, > > Dave Patrick ....Please no email replies - reply in newsgroup. > Microsoft Certified Professional > Microsoft MVP [Windows] > http://www.microsoft.com/protect > > "yepiknowiam" wrote: > > Thanks for the info. I forwarded this off to my hardware vendor that is > > assisting me. One of the first things we tried was updating all the > > drivers > > and firmware, but its possible we missed something. >
Guest Dave Patrick Posted July 31, 2008 Posted July 31, 2008 Re: Question on event log errors Sounds good. Thanks for letting us know. -- Regards, Dave Patrick ....Please no email replies - reply in newsgroup. Microsoft Certified Professional Microsoft MVP [Windows] http://www.microsoft.com/protect "yepiknowiam" wrote: > One of the vendors worked with microsoft and installed a hotfix. > > http://support.microsoft.com/default.aspx?scid=kb;en-us;950310 > > Those are 2 of the symptoms, so hopefully it solves the problem.
Recommended Posts