Creating a quiesced snapshot of a Windows virtual machine generates Event IDs 50, 57, 137, 140, 157, or 12289
book
Article ID: 316528
calendar_today
Updated On:
Products
VMware vSphere ESXi
Issue/Introduction
Symptoms: When using the new version of VMware Tools in ESXi/ESX 4.1 Update 1 or newer, you experience these symptoms:
When a quiesced snapshot is created on a Windows Server 2003, Windows Server 2003 R2, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, or a Windows Server 2012 R2 virtual machine, or a Windows 2016 duplicate disks are created in the virtual machine.
The Event Viewer in the virtual machine displays one or more of these events:
Event ID: 50 NTFS Warning {delayed write failed} Windows was unable to save all the data for the file. The data has been lost. This error may be caused by a failure of your computer hardware or network connection. Please try to save this file elsewhere
Event ID: 57 NTFS Warning The system failed to flush data to the transaction log. Corruption may occur.
Event ID: 137 NTFS Error The default transaction resource manager on volume \\?\Volume{806289e8-6088-11e0-a168-005056ae003d} encountered a non-retryable error and could not start. The data contains the error code.
Event ID: 140 NTFS Warning The system failed to flush data to the transaction log. Corruption may occur in VolumeId:<> DeviceName: \Device\HarddiskVolume<>.(A device which does not exist was specified.).
Event ID: 157 Disk Warning Disk x has been surprise removed.
To resolve this issue, see the Microsoft Knowledge Base articles 816004, 2951098, and 2958027.
Note: The preceding link was correct as of December 11, 2017. If you find the link is broken, provide feedback and a VMware employee will update the lin
Disclaimer: VMware is not responsible for the reliability of any data, opinions, advice, or statements made on third-party websites. Inclusion of such links does not imply that VMware endorses, recommends, or accepts any responsibility for the content of such sites.
Additional Information
This table provides more information about the events:
Event
Description
Event ID 50 NTFS Warning
The NTFS filesystem sees the volume as read-write. The volume is actually read-only so these operations fail to start and no modifications are made to the volume.
Event ID 57 NTFS Warning
This is misleading as no actual corruption occurs. The volume is actually read-only, so these operations fail and no modifications are made to the volume.
Event ID 137 NTFS Warning
The NTFS filesystem sees the volume as read-write. The volume is actually read-only so these operations fail and no modifications are made to the volume.
Event ID 140 NTFS Warning
This is misleading as no actual corruption occurs. The volume is actually read-only, so these operations fail and no modifications are made to the volume.
Event ID: 12289 VSS Error
This message is benign. This occurs when the virtual machine drives are queried to determine which are eligible for snapshots, and the floppy drive is not eligible.
Event ID: 157 Disk Warning
This message is benign. The volume is actually read-only, so these operations fail and no modifications are made to the volume.