none
How to correct system event log warning ftdisk event id 57

    Question

  • Greetings,

     

    We have SBS 2003 SP2 (not R2). There are a number of these events in the system log which seem to be around to time SBS backup runs or when the USB hard drive used for SBS backup is ejected and removed from the server.

     

    I have followed the link in the log and read the text to resolve this issue, but I need to find out and stop whatever is causing this warning. Also, it is unclear which "transaction log" or drive Windows thinks is corrupt. Running Chkdsk on every drive letter (there are 4) every time this event happens is just not possible, let alone having to restart the server.

     

    Is there any way to find out what is causing this error so I can stop it from happening?

     

    Event Type:  Warning

    Event Source:  Ftdisk

    Event Category:  Disk

    Event ID:  57

    User:  N/A

    Description:

    The system failed to flush data to the transaction log. Corruption may occur.

     

    Thank you for your help.

    Paul

     

    Thursday, January 06, 2011 8:08 AM

Answers

  • Hi Paul,

    1. Yes I mean Device Manager. Sorry for the confusion.

    2. Try to Uninstall the device when it is connected with system --- This will remove its driver so that next time it will be reinstalled when connected.

    3. Uninstall hidden devices under Disk Drives and USB Controllers are enough. Storage Volume Shadow Copies are not related. These hidden devices are drivers for devices which connected to the computer before (but not connected currently). Remove these devices so that drivers will be reinstalled in next connection.

    In addition, if it is a hardware issue like Boon mentioned, you may try a reformat. Just remember backup files first.


    Shaon Shan |TechNet Subscriber Support in forum |If you have any feedback on our support, please contact tngfb@microsoft.com
    Monday, January 10, 2011 8:37 AM
    Moderator
  • Hello Shaon,

     

    I know it has been a few days since my last update. If anyone is still reading this thread, here is the latest.

     

    I uninstalled all hidden (grayed) devices under "Disk drives" and "Universal Serial Bus controllers".

     

    Connected two [2] different USB hard drives to the server.

     

    One of them was the same make (Seagate) and model as the one we had been using and getting the "ftdisk" warnings about, lets call this one Drive-A.

     

    The other one was from a different vendor (Western Digital), let's call this one Drive-B.

     

    While Drive-A is connected, and idle (not being written to) we get an "ftdisk" warning about every 17-20 minutes until it is "removed safely". While the drive is being written to, there are no "ftdisk" events (only before and after). This is the same thing that was happening when the original drive was connected. Chkdsk shows no errors on this drive. Drive formatted as a single NTFS partition.

     

    While Drive-B is connected, and idle (not being written to) there were no "ftdisk" warning events logged. I don't know if the drive ever power cycled, but it didn't happen while I was in the room.

     

    I now believe this event may be happening due to a problem or design feature of the Seagate drive(s).

     

    While I had the Seagate drive connected, I was reviewing (from the server console screen) some event logs and had the device manager open. I noticed the device manager screen refresh and also noticed the power light on the drive turn off. Then the drive powered back on right away, the device manager screen updated, and I was presented with the wonderful Microsoft "Autoplay" dialog window. This coincided with the "ftdisk" warnings in the system event log.

     

    This same power cycling and event logs are happening on two other computers (WinXP & Win7 x64) though the event source in Win7 is "Ntfs".

     

    So I will be contacting Seagate for their input on this issue. Will see where that goes and update this thread "as the drive turns".

     

    Thanks for everyone's help.

    Paul

     

    Tuesday, January 18, 2011 10:20 PM

All replies

  • Hi Paul,

    From following article:

    http://www.eventid.net/display.asp?eventid=57&eventno=2197&source=Ftdisk&phase=1

    The issue can be caused if USB device is removed incorrectly.

    Please try to connect the USB device again, go to Device Management, find the device in USB Device list, right click to remove it. Then test if issue still exists.

    If so, try following steps:

    1. Right click My computer, and chooses properties.
    2. Click the "Advanced" tab, and then click "Environment Variables"
    3. Click "New" under the "System Variables"

    4. Enter "DEVMGR_SHOW_NONPRESENT_DEVICES" (without quotations) in the Variable Name, and set Variable Value to 1.
    5. Click OK to apply the change.
    6. Right click My Computer, choose Properties, and then choose Hardware from the tab, click Device Manager.

    7. Enter Device Manager, and choose "View" from the tab and "Click Show Hidden Devices".
    8. Please browse the Device Manager to check if there are any problem devices (there will be a yellow "!" next to the item if there is a problem) or hidden device (Which is grey), right click on it and choose uninstall if any.

    Restart the computer, and devices and controllers will be reinstalled automatically.
     


    Shaon Shan |TechNet Subscriber Support in forum |If you have any feedback on our support, please contact tngfb@microsoft.com
    Thursday, January 06, 2011 9:02 AM
    Moderator
  • Hello Shaon,

     

    Thanks for your reply.

     

    During my quest to solve this, I did come across the same web link and others that pointed to USB drives being unplugged "unsafely" [not using "Safely Remove Hardware" in the system tray or some other 3rd-party utility]. For the record, the System events ONLY occur when the drive is connected to the server. And they usually occur at a rate of 1 every 16-21 minutes until the drive is "safely removed".

     

    There are times when two exact events are logged at the same time (to the second). There is also longer (38-40 minute) gaps between events when the server starts and stops other services, but then the 16-21 minute interval starts again.

     

    You wrote:

    Please try to connect the USB device again, go to Device Management, find the device in USB Device list, right click to remove it. Then test if issue still exists.

     

    My reply:

    I'm not sure where to start "Device Management", but if you mean "Device Manager", when the drive is connected, it is listed under "Disk drives" and the right-click menu only has "Disable" and "Uninstall" that seem like logical options. I did not try either of these yet. Did you mean this utility and one of these options?

     

    So I used a 3rd-party USB utility from NirSoft (USBDeview.exe) to "Disconnect" the USB hard drive, because "Safely Remove Hardware" feature in this server doesn't always work (example: the system tray balloon states the drive is safe to remove and then, the drive reattaches again with autoplay popping up just like it was reconnected).

    By the way, I can be setting at the server console doing something, and the autoplay window just pops up for this drive like it was just plugged in, but the drive has been plugged in all the while. I really need to disable the autoplay feature on this server, unless SBS depends on it for something. I do not need the feature.

     

    Now looking at device manager using View > Show hidden devices, there are STILL no devices with problems <!>. As with most Microsoft OS's however, there are a lot of hidden devices (devices once connected) <grayed out>.

     

    Just to note, since the USB drive was "disconnected", the ftdisk events have stopped.

     

    Question:

    Do you really want me to uninstall ALL these hidden devices in ALL branches of the tree, or only under the "Disk drives" branch?  There are a lot under the "Storage Volume Shadow Copies" branch.

     

    Question:

    Will uninstalling any grayed out device cause any failure of our server or loss of data?

     

    Also, since this server is production and used during the day, I can't reboot until after hours.

     

    Please review my questions and comments and let me know how to proceed safely.

     

    Thanks,

    Paul

     

    Thursday, January 06, 2011 8:47 PM
  • It is possible that your USB HDD is failing? Have you tried reformatting it, or using another drive?

     


    Regards, Boon Tee - PowerBiz Solutions, Australia - www.powerbiz.net.au
    Thursday, January 06, 2011 11:10 PM
  • Hello Boon,

     

    I have not connected a different drive to the server for some time. The drive is new, formatted as NTFS, no autoruns, and works fine on all other PC's it is connected to. Hope not to have to reformat. Now you have my interest peaked though. I will connect to another PC and see if I get any "ftdisk" events from it.

     

    By the way, whenever this "ftdisk" event happens, is there any way to determine which drive windows thinks is corrupt, so chkdsk can be run on the suspect drive?

     

    Thanks for your help.

    Paul

     

    Friday, January 07, 2011 12:08 AM
  • The last time I had warnings like this, I lost the whole drive volume when I rebooted. I had to recover this using some HDD utilities. It appeared that the Partition Boot sector was scrambled.

    Make sure you have a good backup and then try to run CHKDSK on all the system drives. You will then be prompted to reboot to make this happen.

     


    Regards, Boon Tee - PowerBiz Solutions, Australia - www.powerbiz.net.au
    Friday, January 07, 2011 12:15 AM
  • Hello Boon,

     

    So you think the USB drive being plugged in a causing the servers SCSI hard drives to be corrupted and not the USB drive?

     

    Thanks for your help.

    Paul

     

    Friday, January 07, 2011 1:00 AM
  • It's hard to say. I had server corruption on one of my servers once before. But there are many other servers that have not had this problem.

    Try the reboot, then stick in another USB HDD to test.

     


    Regards, Boon Tee - PowerBiz Solutions, Australia - www.powerbiz.net.au
    Friday, January 07, 2011 1:53 AM
  • Hi Paul,

    1. Yes I mean Device Manager. Sorry for the confusion.

    2. Try to Uninstall the device when it is connected with system --- This will remove its driver so that next time it will be reinstalled when connected.

    3. Uninstall hidden devices under Disk Drives and USB Controllers are enough. Storage Volume Shadow Copies are not related. These hidden devices are drivers for devices which connected to the computer before (but not connected currently). Remove these devices so that drivers will be reinstalled in next connection.

    In addition, if it is a hardware issue like Boon mentioned, you may try a reformat. Just remember backup files first.


    Shaon Shan |TechNet Subscriber Support in forum |If you have any feedback on our support, please contact tngfb@microsoft.com
    Monday, January 10, 2011 8:37 AM
    Moderator
  • Hello Shaon,

     

    I know it has been a few days since my last update. If anyone is still reading this thread, here is the latest.

     

    I uninstalled all hidden (grayed) devices under "Disk drives" and "Universal Serial Bus controllers".

     

    Connected two [2] different USB hard drives to the server.

     

    One of them was the same make (Seagate) and model as the one we had been using and getting the "ftdisk" warnings about, lets call this one Drive-A.

     

    The other one was from a different vendor (Western Digital), let's call this one Drive-B.

     

    While Drive-A is connected, and idle (not being written to) we get an "ftdisk" warning about every 17-20 minutes until it is "removed safely". While the drive is being written to, there are no "ftdisk" events (only before and after). This is the same thing that was happening when the original drive was connected. Chkdsk shows no errors on this drive. Drive formatted as a single NTFS partition.

     

    While Drive-B is connected, and idle (not being written to) there were no "ftdisk" warning events logged. I don't know if the drive ever power cycled, but it didn't happen while I was in the room.

     

    I now believe this event may be happening due to a problem or design feature of the Seagate drive(s).

     

    While I had the Seagate drive connected, I was reviewing (from the server console screen) some event logs and had the device manager open. I noticed the device manager screen refresh and also noticed the power light on the drive turn off. Then the drive powered back on right away, the device manager screen updated, and I was presented with the wonderful Microsoft "Autoplay" dialog window. This coincided with the "ftdisk" warnings in the system event log.

     

    This same power cycling and event logs are happening on two other computers (WinXP & Win7 x64) though the event source in Win7 is "Ntfs".

     

    So I will be contacting Seagate for their input on this issue. Will see where that goes and update this thread "as the drive turns".

     

    Thanks for everyone's help.

    Paul

     

    Tuesday, January 18, 2011 10:20 PM
  • So I will be contacting Seagate for their input on this issue. Will see where that goes and update this thread "as the drive turns".

    Paul, I face the  same issue on dozens of servers and we do use Seagate External USB drives.  Did you ever confirm the issue is due to the drives from this vendor?

    Thanks.

    Joe

    Thursday, April 12, 2012 5:56 PM