Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net. The EventId.Net for Splunk Add-on assumes that Splunk is collecting information from Windows servers and workstation via the Splunk Universal Forwarder.
|Source: Application Popup|
Application popup: System process-lost delayed write data: the system was attempting to transfer file data from Buffers to <network share>. The write operation failed and only some of the data may have been written to the file
|English: Request a translation of the event description in plain English.|
|Concepts to understand:|
What is delayed write?
By default, when the Microsoft Windows NT redirector opens a file for read or read/write access, the redirector utilizes the Windows NT system cache. Therefore, when data is written to the file, it is written to the cache and not immediately flushed to the redirector. The cache manager flushes the data at a later time. If an unrecoverable network error occurs while the data is being transferred to the remote server, it may cause the write request to fail and the above application popup to occur.
If occuring on a MS Proxy 2.0 server see ME286395.
Here is scenario where this event can occur:
1. You have an external hard disk (or storage unit)
2. You perform some file transfers to or from that external hard disk
3. You disconnect the external drive by unplugging the cable (i.e. the USB or Firewire)
In this case, especially if a large file transfer was performed shortly before unplugging the cable, the operating system may still have some data in the cache, not yet transferred to the actual hard disk. Since the disconnection of the hard disk is not "graceful" one, the operating system does not have the chance to actually flush all the data from the physical memory. This may cause some of the transferred file to become corrupted, it all depends on what data was still in the cache.
This problem can occur due to a defective network hardware, such as a hub or cable. See ME145952 for more details.
See the link to "Business Objects Support Article ID: c2007305" for additional information about this event.
Also check ME275704 for more details.
|Private comment: Subscribers only. See example of private comment|
|Links: Business Objects Support Article ID: c2007305|
|Search: Google - Bing - Microsoft - Yahoo - EventID.Net Queue (0) - More links...|
Send comments or solutions
- Notify me when updated