Question on event log errors

[Guest yepiknowiam]

Not sure if someone can help me out with this, but wanted to ask.

 

We have 2 servers (HP ML350 G3) running server 2003 with sp2. About 5 days

apart, both started to fail and have issues at the same time, identical

errors in the event log.

 

The main system errors are event id 333 (An I/O operation initiated by the

Registry failed unrecoverably. The Registry could not read in or write out or

flush one of the files that contain the system's image of the Registry) and

event id 773 Server Agents.

 

There also will be some warning at the same time in the application log

related to prefdisk, which is weird because we don't track counters. From

what I can tell the hard drives are both fine, chkdsk doesn't produce any

errors.

 

The hardware of these 2 servers are identical. The don't have all the same

applications. We tried to uninstall the symantec antivirus, updated all the

drivers and firmware on the servers, and the bios. I do not know if it's a

hardware or application issue. They happened a few days apart, which is

weird.

 

Our hardware vendor can't seem to figure out what is wrong and I spent many

hours researching online without much luck.

 

Looking for any ideas or suggestions. It's hard to imagine two pieces of

hardware on 2 servers would fail at the same time. I am a bit lost on this

one.

[Guest Dave Patrick]

Re: Question on event log errors

 

This hotfix may help.

 

http://support.microsoft.com/default.aspx?scid=kb;en-us;898060

 

 

 

--

 

Regards,

 

Dave Patrick ....Please no email replies - reply in newsgroup.

Microsoft Certified Professional

Microsoft MVP [Windows]

http://www.microsoft.com/protect

 

"yepiknowiam" wrote:

> Not sure if someone can help me out with this, but wanted to ask.

>

> We have 2 servers (HP ML350 G3) running server 2003 with sp2. About 5

> days

> apart, both started to fail and have issues at the same time, identical

> errors in the event log.

>

> The main system errors are event id 333 (An I/O operation initiated by the

> Registry failed unrecoverably. The Registry could not read in or write out

> or

> flush one of the files that contain the system's image of the Registry)

> and

> event id 773 Server Agents.

>

> There also will be some warning at the same time in the application log

> related to prefdisk, which is weird because we don't track counters. From

> what I can tell the hard drives are both fine, chkdsk doesn't produce any

> errors.

>

> The hardware of these 2 servers are identical. The don't have all the

> same

> applications. We tried to uninstall the symantec antivirus, updated all

> the

> drivers and firmware on the servers, and the bios. I do not know if it's

> a

> hardware or application issue. They happened a few days apart, which is

> weird.

>

> Our hardware vendor can't seem to figure out what is wrong and I spent

> many

> hours researching online without much luck.

>

> Looking for any ideas or suggestions. It's hard to imagine two pieces of

> hardware on 2 servers would fail at the same time. I am a bit lost on

> this

> one.

[Guest yepiknowiam]

Re: Question on event log errors

 

Thanks for the info. Most of the articles I've seen relate to sp1 and we are

on sp2.

 

They were working fine until about july 3rd. Its possible a windows update

was applied that is giving problems, but I doubt it. Possible an update from

symantec caused problems, but the uninstall didn't fix any thing. We never

had any issues with these servers for years until a few weeks ago.

 

It almost acts like it's out of memory, task manager is not showing any

problems, but errors on the screen would tell you otherwise and also it

causes the keyboard to stop working. No software was installed recently,

other then your regular windows updates and the live update from symantec.

 

My other thought is something in the registry is not getting release,

probably due to symantec. Have you seen this happen before and how do you

flush out the reg?

 

"Dave Patrick" wrote:

> This hotfix may help.

>

> http://support.microsoft.com/default.aspx?scid=kb;en-us;898060

>

>

>

> --

>

> Regards,

>

> Dave Patrick ....Please no email replies - reply in newsgroup.

> Microsoft Certified Professional

> Microsoft MVP [Windows]

> http://www.microsoft.com/protect

>

> "yepiknowiam" wrote:

> > Not sure if someone can help me out with this, but wanted to ask.

> >

> > We have 2 servers (HP ML350 G3) running server 2003 with sp2. About 5

> > days

> > apart, both started to fail and have issues at the same time, identical

> > errors in the event log.

> >

> > The main system errors are event id 333 (An I/O operation initiated by the

> > Registry failed unrecoverably. The Registry could not read in or write out

> > or

> > flush one of the files that contain the system's image of the Registry)

> > and

> > event id 773 Server Agents.

> >

> > There also will be some warning at the same time in the application log

> > related to prefdisk, which is weird because we don't track counters. From

> > what I can tell the hard drives are both fine, chkdsk doesn't produce any

> > errors.

> >

> > The hardware of these 2 servers are identical. The don't have all the

> > same

> > applications. We tried to uninstall the symantec antivirus, updated all

> > the

> > drivers and firmware on the servers, and the bios. I do not know if it's

> > a

> > hardware or application issue. They happened a few days apart, which is

> > weird.

> >

> > Our hardware vendor can't seem to figure out what is wrong and I spent

> > many

> > hours researching online without much luck.

> >

> > Looking for any ideas or suggestions. It's hard to imagine two pieces of

> > hardware on 2 servers would fail at the same time. I am a bit lost on

> > this

> > one.

>

[Guest yepiknowiam]

Re: Question on event log errors

 

Also forgot to mention when these errors occur, often the event log will get

cleared out and erased by the system. I have the error message at the

office, basically gives you an error on screen that the file located in

windows/config/system.evt cannot be written to and will be lost, consider

moving the file... something along those lines.

 

It does this on both servers. Also seen messages about not being to do a

read-write to a certain directory. Event 2019 that relates to non-paged pool

memory and WaitForMultipleObjects warnings.

 

The hard drives are in a raid 1.

 

"Dave Patrick" wrote:

> This hotfix may help.

>

> http://support.microsoft.com/default.aspx?scid=kb;en-us;898060

>

>

>

> --

>

> Regards,

>

> Dave Patrick ....Please no email replies - reply in newsgroup.

> Microsoft Certified Professional

> Microsoft MVP [Windows]

> http://www.microsoft.com/protect

>

> "yepiknowiam" wrote:

> > Not sure if someone can help me out with this, but wanted to ask.

> >

> > We have 2 servers (HP ML350 G3) running server 2003 with sp2. About 5

> > days

> > apart, both started to fail and have issues at the same time, identical

> > errors in the event log.

> >

> > The main system errors are event id 333 (An I/O operation initiated by the

> > Registry failed unrecoverably. The Registry could not read in or write out

> > or

> > flush one of the files that contain the system's image of the Registry)

> > and

> > event id 773 Server Agents.

> >

> > There also will be some warning at the same time in the application log

> > related to prefdisk, which is weird because we don't track counters. From

> > what I can tell the hard drives are both fine, chkdsk doesn't produce any

> > errors.

> >

> > The hardware of these 2 servers are identical. The don't have all the

> > same

> > applications. We tried to uninstall the symantec antivirus, updated all

> > the

> > drivers and firmware on the servers, and the bios. I do not know if it's

> > a

> > hardware or application issue. They happened a few days apart, which is

> > weird.

> >

> > Our hardware vendor can't seem to figure out what is wrong and I spent

> > many

> > hours researching online without much luck.

> >

> > Looking for any ideas or suggestions. It's hard to imagine two pieces of

> > hardware on 2 servers would fail at the same time. I am a bit lost on

> > this

> > one.

>

[Guest Dave Patrick]

Re: Question on event log errors

 

That's really strange. Please post the error when you get the chance.

 

 

--

 

Regards,

 

Dave Patrick ....Please no email replies - reply in newsgroup.

Microsoft Certified Professional

Microsoft MVP [Windows]

http://www.microsoft.com/protect

 

"yepiknowiam" wrote:

> Also forgot to mention when these errors occur, often the event log will

> get

> cleared out and erased by the system. I have the error message at the

> office, basically gives you an error on screen that the file located in

> windows/config/system.evt cannot be written to and will be lost, consider

> moving the file... something along those lines.

>

> It does this on both servers. Also seen messages about not being to do a

> read-write to a certain directory. Event 2019 that relates to non-paged

> pool

> memory and WaitForMultipleObjects warnings.

>

> The hard drives are in a raid 1.

[Guest Anthony [MVP]]

Re: Question on event log errors

 

I would try booting in Safe Mode to see if you still get the errors. Then

perhaps enable services until you get the error. You could also use msconfig

to disable services at startup.

Anthony

http://www.airdesk.com

 

 

 

"yepiknowiam" <yepiknowiam@discussions.microsoft.com> wrote in message

news:CD2BB6DB-DD45-4673-9197-161FB22B0BFB@microsoft.com...

> Not sure if someone can help me out with this, but wanted to ask.

>

> We have 2 servers (HP ML350 G3) running server 2003 with sp2. About 5

> days

> apart, both started to fail and have issues at the same time, identical

> errors in the event log.

>

> The main system errors are event id 333 (An I/O operation initiated by the

> Registry failed unrecoverably. The Registry could not read in or write out

> or

> flush one of the files that contain the system's image of the Registry)

> and

> event id 773 Server Agents.

>

> There also will be some warning at the same time in the application log

> related to prefdisk, which is weird because we don't track counters. From

> what I can tell the hard drives are both fine, chkdsk doesn't produce any

> errors.

>

> The hardware of these 2 servers are identical. The don't have all the

> same

> applications. We tried to uninstall the symantec antivirus, updated all

> the

> drivers and firmware on the servers, and the bios. I do not know if it's

> a

> hardware or application issue. They happened a few days apart, which is

> weird.

>

> Our hardware vendor can't seem to figure out what is wrong and I spent

> many

> hours researching online without much luck.

>

> Looking for any ideas or suggestions. It's hard to imagine two pieces of

> hardware on 2 servers would fail at the same time. I am a bit lost on

> this

> one.

[Guest yepiknowiam]

Re: Question on event log errors

 

Here are a couple of the messages:

 

 

{Delayed Write Failed} Windows was unable to save all the data for the file

\WINDOWS\system32\config\SysEvent.Evt. The data has been lost. This error may

be caused by a failure of your computer hardware or network connection.

Please try to save this file elsewhere.

 

 

{Delayed Write Failed} Windows was unable to save all the data for the file

\$Mft. The data has been lost. This error may be caused by a failure of your

computer hardware or network connection. Please try to save this file

elsewhere.

 

 

There are more, like I mentioned in my previous posts, but those confused me

a little, they always follow with a bunch of event id 333 application popup

errors.

 

"Dave Patrick" wrote:

> That's really strange. Please post the error when you get the chance.

>

>

> --

>

>

[Guest Meinolf Weber]

Re: Question on event log errors

 

Hello yepiknowiam,

 

Have a look here, even if 2003 is not mentioned:

http://support.microsoft.com/?kbid=330174

 

http://support.microsoft.com/kb/818408

 

Best regards

 

Meinolf Weber

Disclaimer: This posting is provided "AS IS" with no warranties, and confers

no rights.

** Please do NOT email, only reply to Newsgroups

** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm

> Here are a couple of the messages:

>

> {Delayed Write Failed} Windows was unable to save all the data for the

> file \WINDOWS\system32\config\SysEvent.Evt. The data has been lost.

> This error may be caused by a failure of your computer hardware or

> network connection. Please try to save this file elsewhere.

>

> {Delayed Write Failed} Windows was unable to save all the data for the

> file \$Mft. The data has been lost. This error may be caused by a

> failure of your computer hardware or network connection. Please try to

> save this file elsewhere.

>

> There are more, like I mentioned in my previous posts, but those

> confused me a little, they always follow with a bunch of event id 333

> application popup errors.

>

> "Dave Patrick" wrote:

>

>> That's really strange. Please post the error when you get the chance.

>>

>> --

>>

[Guest Dave Patrick]

Re: Question on event log errors

 

The symptoms all point to writing to the disk. These articles may help.

Since you have two servers doing the same thing I think I'd look at the

hardware. Possibly the scsi bus terminations and or controller firmware are

to blame.

 

http://support.microsoft.com/kb/816004/en-us

http://support.microsoft.com/kb/890352/en-us

http://support.microsoft.com/kb/154690/

 

 

--

 

Regards,

 

Dave Patrick ....Please no email replies - reply in newsgroup.

Microsoft Certified Professional

Microsoft MVP [Windows]

http://www.microsoft.com/protect

 

"yepiknowiam" wrote:

> Here are a couple of the messages:

>

>

> {Delayed Write Failed} Windows was unable to save all the data for the

> file

> \WINDOWS\system32\config\SysEvent.Evt. The data has been lost. This error

> may

> be caused by a failure of your computer hardware or network connection.

> Please try to save this file elsewhere.

>

>

> {Delayed Write Failed} Windows was unable to save all the data for the

> file

> \$Mft. The data has been lost. This error may be caused by a failure of

> your

> computer hardware or network connection. Please try to save this file

> elsewhere.

>

>

> There are more, like I mentioned in my previous posts, but those confused

> me

> a little, they always follow with a bunch of event id 333 application

> popup

> errors.

[Guest yepiknowiam]

Re: Question on event log errors

 

Thanks for the info. I forwarded this off to my hardware vendor that is

assisting me. One of the first things we tried was updating all the drivers

and firmware, but its possible we missed something.

 

"Dave Patrick" wrote:

> The symptoms all point to writing to the disk. These articles may help.

> Since you have two servers doing the same thing I think I'd look at the

> hardware. Possibly the scsi bus terminations and or controller firmware are

> to blame.

>

> http://support.microsoft.com/kb/816004/en-us

> http://support.microsoft.com/kb/890352/en-us

> http://support.microsoft.com/kb/154690/

>

>

> --

>

> Regards,

>

> Dave Patrick ....Please no email replies - reply in newsgroup.

> Microsoft Certified Professional

> Microsoft MVP [Windows]

> http://www.microsoft.com/protect

>

> "yepiknowiam" wrote:

> > Here are a couple of the messages:

> >

> >

> > {Delayed Write Failed} Windows was unable to save all the data for the

> > file

> > \WINDOWS\system32\config\SysEvent.Evt. The data has been lost. This error

> > may

> > be caused by a failure of your computer hardware or network connection.

> > Please try to save this file elsewhere.

> >

> >

> > {Delayed Write Failed} Windows was unable to save all the data for the

> > file

> > \$Mft. The data has been lost. This error may be caused by a failure of

> > your

> > computer hardware or network connection. Please try to save this file

> > elsewhere.

> >

> >

> > There are more, like I mentioned in my previous posts, but those confused

> > me

> > a little, they always follow with a bunch of event id 333 application

> > popup

> > errors.

>

>

[Guest Dave Patrick]

Re: Question on event log errors

 

You're welcome. Also look at terminations and or cabling.

 

 

--

 

Regards,

 

Dave Patrick ....Please no email replies - reply in newsgroup.

Microsoft Certified Professional

Microsoft MVP [Windows]

http://www.microsoft.com/protect

 

"yepiknowiam" wrote:

> Thanks for the info. I forwarded this off to my hardware vendor that is

> assisting me. One of the first things we tried was updating all the

> drivers

> and firmware, but its possible we missed something.

[Guest yepiknowiam]

Re: Question on event log errors

 

One of the vendors worked with microsoft and installed a hotfix.

 

http://support.microsoft.com/default.aspx?scid=kb;en-us;950310

 

Those are 2 of the symptoms, so hopefully it solves the problem.

 

"Dave Patrick" wrote:

> You're welcome. Also look at terminations and or cabling.

>

>

> --

>

> Regards,

>

> Dave Patrick ....Please no email replies - reply in newsgroup.

> Microsoft Certified Professional

> Microsoft MVP [Windows]

> http://www.microsoft.com/protect

>

> "yepiknowiam" wrote:

> > Thanks for the info. I forwarded this off to my hardware vendor that is

> > assisting me. One of the first things we tried was updating all the

> > drivers

> > and firmware, but its possible we missed something.

>

[Guest Dave Patrick]

Re: Question on event log errors

 

Sounds good. Thanks for letting us know.

 

 

--

 

Regards,

 

Dave Patrick ....Please no email replies - reply in newsgroup.

Microsoft Certified Professional

Microsoft MVP [Windows]

http://www.microsoft.com/protect

 

"yepiknowiam" wrote:

> One of the vendors worked with microsoft and installed a hotfix.

>

> http://support.microsoft.com/default.aspx?scid=kb;en-us;950310

>

> Those are 2 of the symptoms, so hopefully it solves the problem.