Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 15 Source: Disk

The device, \Device\Harddisk1\D, is not ready for access yet.
This problem occurs because a timing issue in the Logical Disk Manager Administrative Service causes a deadlock condition. See ME941692 for a hotfix applicable to Microsoft Windows Server 2003.
In one case, a computer was running Windows 2000 Server that had an Adaptec 2110S Ultra3 SCSI Adapter that was being used to control separate C: and D: drives. After a while when Windows loaded, this Event ID appeared. Eventually when the computer was started up, the first drive no longer appeared in the list displayed by the SCSI Adapter and it would not boot from the C: drive. This was due to the SCSI drive being misaligned on the SCSI drive caddie rails, which caused the SCSI connector at the back of the drive to push the socket at the back of the SCSI drive caddie out of alignment. The computer manufacturer repaired the problem.
I tracked this problem down to a FastTrak RAID controller on the system board that had no devices attached to it. After it was disabled in the BIOS, the problem went away.
As per Microsoft: "Check the version of the SCSI controller BIOS and the device firmware revision. Contact the manufacturer for the latest updates. Check the SCSI device driver version. The SCSI driver is located in the %SystemRoot%\System32\Drivers folder. Look for the version in the file properties, and check whether the SCSI manufacturer has a newer version". See the link to "Windows Cluster Service Troubleshooting and Maintenance" to download the original white paper.
On our HP cluster with MSA1000 SAN, one of the nodes showed more disks in Device Manager than the other, while he was the passive node at that time. Only the passive node reported event id 15, normally 4 times (once for every logical drive). Those extra disks were malfunctioning according to Device Manager, so I deleted (uninstalled) them, ran “scan for hardware changes”, and he found no new hardware. The errors never returned.

See the comments for event id 15 for scsi driver.
As per Microsoft: "The device either timed out or is not present". See MSW2KDB and ME311081 for details on this event.
In my case, the device referred to is a DVD-RAM drive. This error appears pretty regularly, but it doesn't seem to indicate any problems, as far as I can tell. One theory I have is that the device does take a little longer to become ready than windows is willing to wait (this is on a very fast machine, but that shouldn't make a difference).
This error appeared when I removed one of my hard disks from a mirrored volume.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.