locked
What is Event ID 141 from source Ntfs?

    Question

  • I encountered these two event logs in System today. I fear its related to shadow copy. They happened after I restored from shadow copy, after detecting that files were missing from the directory mentioned in the logs(!). What is Event ID 141 from source Ntfs

    Log Name:      System
    Source:        Application Popup
    Date:          21.09.2009 15:48:34
    Event ID:      26
    Task Category: None
    Level:         Information
    Keywords:      Classic
    User:          N/A
    Computer:      server2k8r2.domain.com
    Description:
    Application popup: Windows - Delayed Write Failed : Exception Processing Message 0xc000a082 Parameters 0x000007FEFD97715C 0x000007FEFD97715C 0x000007FEFD97715C 0x000007FEFD97715C
    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
      <System>
        <Provider Name="Application Popup" />
        <EventID Qualifiers="16384">26</EventID>
        <Level>4</Level>
        <Task>0</Task>
        <Keywords>0x80000000000000</Keywords>
        <TimeCreated SystemTime="2009-09-21T13:48:34.000000000Z" />
        <EventRecordID>16584</EventRecordID>
        <Channel>System</Channel>
        <Computer>server2k8r2.domain.com</Computer>
        <Security />
      </System>
      <EventData>
        <Data>Windows - Delayed Write Failed</Data>
        <Data>Exception Processing Message 0xc000a082 Parameters 0x000007FEFD97715C 0x000007FEFD97715C 0x000007FEFD97715C 0x000007FEFD97715C</Data>
      </EventData>
    </Event>


    Log Name:      System
    Source:        Ntfs
    Date:          21.09.2009 15:48:34
    Event ID:      141
    Task Category: None
    Level:         Warning
    Keywords:      Classic
    User:          N/A
    Computer:      server2k8r2.domain.com
    Description:
    The description for Event ID 141 from source Ntfs cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.

    If the event originated on another computer, the display information had to be saved with the event.

    The following information was included with the event:

    \Device\HarddiskVolumeShadowCopy126\Oppdrag\5 .. Tegning\Visualisering\Bilde til Avis\Thumbs.db

    the message resource is present but the message is not found in the string/message table

    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
      <System>
        <Provider Name="Ntfs" />
        <EventID Qualifiers="32772">141</EventID>
        <Level>3</Level>
        <Task>0</Task>
        <Keywords>0x80000000000000</Keywords>
        <TimeCreated SystemTime="2009-09-21T13:48:34.035450300Z" />
        <EventRecordID>16585</EventRecordID>
        <Channel>System</Channel>
        <Computer>server2k8r2.domain.com</Computer>
        <Security />
      </System>
      <EventData>
        <Data>
        </Data>
        <Data>\Device\HarddiskVolumeShadowCopy126\Oppdrag\5 .. Tegning\Visualisering\Bilde til Avis\Thumbs.db</Data>
        <Binary>0400040002003000000000008D00048000000000A20000C000000000000000000000000000000000A20000C0</Binary>
      </EventData>
    </Event>



    Monday, September 21, 2009 5:29 PM

Answers

  • Thanks. My problem disappeared after a firmware update.
    • Marked as answer by HAL07 Thursday, October 29, 2009 12:53 PM
    Thursday, October 29, 2009 12:52 PM

All replies

  • hi there,

    thank you for posting in windows forums,

    Please let us know the storage architecture that you are using in your org, so that it would be easy troubleshootign the issue.



    by the event id , this seems to be the problem with the HDD, the event occured while trying to copy /move the data from specific location or vice versa.

    make sure you have enabled write caching on the disk and also please do check the hard disk controller ( 80-wire , 40 pin cable ) should be used along with the HDC .

    further more

     


    sainath !analyze
    Tuesday, September 22, 2009 1:14 AM
    Moderator
  • This is a branch office server, running a Dell PowerEdge R710. It's Windows 2008 R2 64bit.
    The failure is located at disk RAID-5 on a PERC 6/E Adapter (firmware 6.2.0-0013, driver ver 4.05.01.64)
    Tuesday, September 22, 2009 5:44 AM
  • Hi there. a quick update on the issue. It seem to have been caused by bad BIOS or firmware on the internal Perc adapter (not the /E adapter). I no longer see these 141 events in system log. They seemed to be provoked by VSS somehow. Really dangerous as files went missing and such.

    Now I only have one error and that was two days ago:

    Log Name:      System
    Source:        VDS Basic Provider
    Date:          02.10.2009 18:31:23
    Event ID:      1
    Task Category: None
    Level:         Error
    Keywords:      Classic
    User:          N/A
    Computer:      server2k8r2.domain.com
    Description:
    Unexpected failure. Error code: D@01010004
    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
      <System>
        <Provider Name="VDS Basic Provider" />
        <EventID Qualifiers="49664">1</EventID>
        <Level>2</Level>
        <Task>0</Task>
        <Keywords>0x80000000000000</Keywords>
        <TimeCreated SystemTime="2009-10-02T16:31:23.000000000Z" />
        <EventRecordID>17639</EventRecordID>
        <Channel>System</Channel>
        <Computer>server2k8r2.domain.com</Computer>
        <Security />
      </System>
      <EventData>
        <Data>D@01010004</Data>
      </EventData>
    </Event>

    Can anybody tell me what this is?
    Monday, October 05, 2009 8:20 AM
  • Hi HAL07,

    VDS stands for virtual disk services this is a set of API supporting / used for managing disks , you can use VDS to manage volumes and disks.

    Generally when you install HITACHI or VMWARE storage solutions, these hardware vendors provide their custom VDI's whch translate the generic inbuilt VDI to their own custom VDI calls.

    with respect to the error i see that there was a problem with the VDI communication. One quick think which i can check is the storage logs.

    I would also involve the hardware / vendor support engineers to troubleshoot the issue.
    sainath !analyze
    Monday, October 05, 2009 8:40 AM
    Moderator
  • Thanks. My problem disappeared after a firmware update.
    • Marked as answer by HAL07 Thursday, October 29, 2009 12:53 PM
    Thursday, October 29, 2009 12:52 PM