locked
NTFS warnings and errors - ID 57 and 137 RRS feed

  • Question

  • Hi! since the 4th of january I've seen NTFS errors 57 and 137 in the event log of one of our servers.
    Saying:
    57 - The system failed to flush data to the transaction log. Corruption may occur
    137 - The default transaction resource manager on volume \\?\Volume{da4147bc-b6e1-11e5-aea0-005056af0080} encountered a non-retryable error and could not start.  The data contains the error code.

    I've seen other have the issue here in the forums, and I found an article saying this can be ignored.

    But does anyone know why they suddenly can appear? Everything was fine until the fourth at 6 PM

    The volumes mentioned in the 137 warning, cannot be found on the server.

    Why is a volume mentioned that is not on the server? How is the value created for a volume that is not there?

    Is there no solution to this?


    Freddy

    Monday, January 11, 2016 12:58 PM

Answers

  • With the help of a colleague we found the reason was Veeam backup in VmWare, and snapshots, in addition to a second BOOTPART partition for the drive the System partition was installed on. So it can be ignored, and there is no solution for it yet. 

    This issue known issue by VMware:
    https://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=2006849

    These errors (57,137 etc) applies on the Windows Server when we have two options configured:
    1) The server is backuped by VMware. Currently vmware snapshot is done every 3 hours and the error log is generated on that time:  

    Second Option - disk configuration on the server. These errors only are generated when we have splited main disk:

    VMware has no solutions currently. They only provides recommendations that these errors in windows has no impact to anything and we can ignore them. If we want to remove these errors i see only one possibility - to remove Bootpart from the main disk. This task will take quite lot of time and it will reguires to shutdown the server. If this solution only fixes logs, i don't see a benefit to spend lot of hours on it.
    Currently closing this ticket. because these events don't do any impact to the server. If you think that we should remove these errors from a event log - please reopen this ticket and i will provide manual for Operation team how they should fix it


    Freddy

    • Marked as answer by CesarTabares Thursday, February 18, 2016 9:19 AM
    Thursday, February 18, 2016 9:19 AM

All replies

  • Are there any "Disk" events just prior to the NTFS errors in the system event log?  If so, can you include the XML View data?
    Monday, January 11, 2016 1:28 PM
  • Hi CesarTabares,

    Thanks for your post.

    May I ask what's the operating system of the server? physical machines or virtual machine?

    Please perform a chkdsk /f do a check.

    Please also test the following hotfix to update NTFS.sys if it is a Windows 7/2008 R2 system:

    https://support.microsoft.com/en-us/kb/2618914

    Best Regards,

    Mary Dong


    Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    • Proposed as answer by Mary Dong Friday, January 22, 2016 9:38 AM
    • Marked as answer by Mary Dong Monday, January 25, 2016 1:34 AM
    • Unmarked as answer by CesarTabares Thursday, February 4, 2016 9:51 AM
    • Unproposed as answer by CesarTabares Thursday, February 4, 2016 9:51 AM
    Tuesday, January 12, 2016 6:02 AM
  • None, and the alerts are still appearing

    Freddy

    Thursday, February 4, 2016 9:45 AM
  • The operating system is Server 2008 R2 Standard

    It is a virtual VmWare machine

    It does not have that hotfix installed , but I don't know if that will help. It regards sectors on a disk.

    I'll continue looking for articles online that describe these errors

    EDIT: I see that most of the time, it occurs every three hours, more or less. The question is why. I've cloned it, not connected a network card, to see what happens.

    • Edited by CesarTabares Thursday, February 11, 2016 1:54 PM
    Thursday, February 4, 2016 10:01 AM
  • With the help of a colleague we found the reason was Veeam backup in VmWare, and snapshots, in addition to a second BOOTPART partition for the drive the System partition was installed on. So it can be ignored, and there is no solution for it yet. 

    This issue known issue by VMware:
    https://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=2006849

    These errors (57,137 etc) applies on the Windows Server when we have two options configured:
    1) The server is backuped by VMware. Currently vmware snapshot is done every 3 hours and the error log is generated on that time:  

    Second Option - disk configuration on the server. These errors only are generated when we have splited main disk:

    VMware has no solutions currently. They only provides recommendations that these errors in windows has no impact to anything and we can ignore them. If we want to remove these errors i see only one possibility - to remove Bootpart from the main disk. This task will take quite lot of time and it will reguires to shutdown the server. If this solution only fixes logs, i don't see a benefit to spend lot of hours on it.
    Currently closing this ticket. because these events don't do any impact to the server. If you think that we should remove these errors from a event log - please reopen this ticket and i will provide manual for Operation team how they should fix it


    Freddy

    • Marked as answer by CesarTabares Thursday, February 18, 2016 9:19 AM
    Thursday, February 18, 2016 9:19 AM
  • The solution I used is to disabling (not Manual) the VMware Snapshot Provider
    Tuesday, July 17, 2018 2:14 PM