Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 50 Source: MRxSmb

{Lost Delayed-Write Data} The system was attempting to transfer file data from Buffers to \Device\LanmanRedirector. The write operation failed, and only some of the data may have been written to the file.
From Microsoft: "By default, when the Microsoft Windows NT redirector opens a file for read or read/write access, the redirector utilizes the Windows NT system cache. Therefore, when data is written to the file, it is written to the cache and not immediately flushed to the redirector. The cache manager flushes the data at a later time. If an unrecoverable network error occurs while the data is being transferred to the remote server, it may cause the write request to fail and the above application popup to occur.
User Action: There may have been a loss of data. Decide if the missing data is important enough to restore the file from backup and redo the file operations that led up to the message."

From a newsgroup post: "This is a networking problem. I have the same issue here on a small network, and have been unable to track it down. Basically I have seen it when copying files to a shared drive on another PC, usually between Win2K and 98. The problem also occurs with UNC addresses \\servername\drive. My only suggestion would be to make sure the pieces in the network have the latest drivers and bios, especially the network cards."
We had a client who was receiving this error on Win XP Pro SP3 systems trying to write back to a database file on a 2011 SBS server. It was very intermittent. The culprit was Kaspersky Anti-virus 2010. It wasn't the NDIS filter causing it but the anti-virus program it self.
I experienced this error on XP workstations across the domain trying to write data to a Microsoft 2003 server. Pinging the server showed 0 loss, speed tests where nominal, yet applications were crashing and/or very slow. The server had been rebooted while being connected to a LAN on which a defective switch was active which was disrupting all LAN communication. After this switch was disconnected the problem persisted, yet the connections seemed to be fine. A reboot of the server fixed the problem.
I suspect the server to have attributed bad properties of some kind to the LAN connection when the defective switch was active and the server was rebooted.
In my case, the problem occurred because auto sensing set the network speed to "100MBit half-duplex". Manually changing the network speed and duplex to "100MBit full-duplex" solved the error instantly.
In my case, I found that changing the default WINS settings from "Use NetBIOS from DHCP server..." to "Use NetBIOS over TCP/IP" solves the problem.

In my case, the network is working (Internet), but saving Office files directly to the network drive is very slow. Sometimes the roaming profile gets corrupted. The solution for me was to uninstall the Network Card driver and the TCP/IP protocol, restart Windows 2000 and again install the network card driver and the TCP/IP protocol.
We are running a Citrix Environment and we redirect profiles. After an upgrade to 2003 SP1, we experienced Delay Write Loss on the Citrix servers. See ME899409. You will need to call for the hotfix but after you apply it and reboot, things will go back to normal.
This issue may occur if a non-Microsoft program that is installed on your computer uses an outdated kernel-mode filter driver. See ME822219 for details.

See MSW2KDB for additional information about this event.
See ME831373 for a hotfix applicable to Microsoft Windows NT 4.0 Service Pack 6a.
See ME890352 for a hotfix applicable to Microsoft Windows Server 2003.
Have a look at ME816004.
See also ME325487 link below.
Have a look at Microsoft Knowledge base Article ME293842.
A "Delayed Write Failed" error can occur because the client redirector does not calculate the SMB signature properly". See ME321733.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.