Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 50 Source: Ftdisk

{Lost Delayed-Write Data} The system was attemting to transfer file data from Buffers to \Device\Harddisk\Volume4. The write operation failed, and only some of the data may have been written to the file.
I had the same problem with a Proliant DL360 connected to a MSA50. I ran dmdiag.exe and determined that we had problems with one of the partitions on the disk 2. This problem was due to one of the Array Controller not being recognized by the system. I reinstalled the driver, rebooted and the system recognized the Array Controller again.
From newsgroup posts:
- "Try disabling write cache on your scsi controller. Also try to update your scsi controller's driver."
- "Found Norton AV update was causing problem. If you are running Norton AV, try uninstalling it, reboot to see if problem persists."
- "In my case it turned out that the memory modules were defective (I discovered errors by using the memtest86+ utility)."
As per Microsoft: "This problem occurs because an unexpected PnP event may trigger a drive letter change for a physical disk resource in a Windows 2000 server cluster, taking the disk off-line". To resolve this problem, obtain the latest service pack for Microsoft Windows 2000. See ME815616 for more details.

Also check "Event ID 50 from source Disk", "Event ID 50 from source Disk", and "Veritas Support Document ID: 233732" for more information on this event.
This issue was on a HP (compaq) Server attached to a SAN. It appears that Windows 2000 SP3 has an incompatibility issue with HP (Compaq)SecurePath Software. I was told by Compaq that Microsoft was working on a hotfix for this. To fix, you have 2 options:
1. Uninstall SecurePath (Requires that you uninstall the second HBA). SecurePath Software is used on Servers that have 2 or more HBA controllers that attach the server to the SAN.
2. Option 2 is to uninstall SP3 and go back to SP2. There should be an uninstall directory after you installed SP3. If not your only option is Option 1.

I encountered this problem with a notebook running Windows NT where the Advanced Power Management implementation was flawed. The APM BIOS was simply stopping the hard drive and hence the warning. Try to disable power management from BIOS and from the OS if you suspect a similar problem.
You may need to use dmdiag.exe from the Win2000 resource kit to determine which disk and volume is experiencing this error. See the link below.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.