Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 11 Source: Disk

The driver detected a controller error on \Device\Harddisk0\DR0
We had it due to failing battery on PERC 6/i. Changed Write Policy from Write Back to Write Through - the event stopped popping up.

P.S. The Write Through Policy was a temporary solution till the new controller battery has arrived.
I've had three of these errors pop up on our Level Platforms alerts. One of them I was able to find the cause by simply installing Dell OpenManager Server Administrator and taking a look at the storage.  The firmware driver was out of date. That would be a good first place to start. The other two alerts did not have a similar find.
I am getting this error using multiple drives in a Shintaro USB3 drive caddy. After lots of drive and cable swapping I have discovered it happens because I have the drive caddy plugged into a Noontec USB3 hub. When I bypass the hub and go straight to the PC it does not happen. I do not know yet if the problem is with the Noontec hub or the Shintaro drive dock.
In certain conditions, this error message is related to the S.M.A.R.T attribute 187 (Reported uncorrectable errors). When a physical sector of the disk is read by an application (e.g. a SMART test tool or a simple copy command) and a sector is "unstable", meaning that the drive electronics (hardware ECC) is unable to correctly read the sector, then Windows logs Event ID 11.
To solve the error, a full SMART scan with repair (reallocation of unstable sectors) should be performed.
I got this error after buying a new power supply. Luckily I found the reason after trying every solution I found on the Internet. It seems that the jumper setting from my IDE drive, which worked with my old power supply, wouldn't do so with the new supply. My jumper setting was "Force Dev1 present" and I changed it to "Master".

I got this error in my event viewer along with these:

Event ID: 129
Source: HpCISSs2
Description: Reset to device, \Device\RaidPort0, was issued.

Event ID: 24800
Source: Cissesrv
Description: Logical drive 1 configured on array controller [Embedded] returned a fatal error during a read/write request from/to the volume.
The fatal error details are as follows: logical block  address 171f3f8, block count 128, command 30, drive bus 1 and drive bay 1.

Logged a case with HP and they asked me to run the Array Diagnostic Utility. After running the tool (no downtime is required), the report show this:

SLOT 0 Smart Array E200i Controller ERROR REPORT:
   Array accelerator status:
      Valid data found at reset
      Hardware Problem detected with Cache board.
      Please replace Cache board.

So, it confims that this is due to hardware error on the Cache board and HP is going to replace it for me.
I was having this problem with a machine. I tried multiple cables and hard drives. What was causing the errors happened to be the hard drive carrier.
I got this error when I mistakenly browsed my USB card reader without a card in it. I did not disable the reader to resolve the problem; I just remember that if I get the error, it means there are no cards in that particular slot or in the reader.
I had this problem with a new computer. The event log would show a controller error for various drives ranging from Harddisk3 to Harddisk6. At first, I thought it was just a hardware problem with the system I got, but it's replacement suffered from the same thing. I ran full diagnostics on my two hard drives (a 250GB Deskstar SATA with 3 partitions that came with the system and a 120GB ATA Barracuda with 2 partitions that I installed later) and they both checked out okay. After some digging about how to proceed from the entry in the event log, I ran Disk Management (ie, diskmgmt.msc from Start/Run) and matched the "hard disks" that were failing to drive letters/numbers assigned to the multi-card reader with an internal USB connection that came with the computer. The errors were not associated with the Seagate or the Hitachi, which were mapped as Harddisk0 and Harddisk1 in Diskmanagement, or with the SATA/IDE controllers on the motherboard which simplified things significantly. Disabling the card reader through Device Manager seems to have stopped the intermittent error messages.
I have a drive enclosure from Lantec for an IDE drive. After troubleshooting the disk and possible bad IDE cable, it turned out that the enclosure was bad.
I had this problem with my Nforce 2 motherboard and it turned out to be the drivers fault. Installing the official drivers downloaded from NVidia solved the problem.
As per Adaptec: "Our testing indicates the event is generated on several models of hard disks used to boot to Windows 2000. Further investigation revealed Windows 2000 is generating (1E) Prevent/Allow Medium Removal commands to the boot device. This is an OPTIONAL SCSI command that may or may not be supported by the device. This event is logged in configurations where a DASD (Direct Access Storage Device [hard disk]) or a RAID array consisting of multiple DASD devices attached to an Adaptec controller is used as the boot media. The event will be logged for each device included in the bootable RAID array". See "Adaptec Support Answer ID: 2190", "Adaptec Support Answer ID: 2006" and "Adaptec Support Answer ID: 2110" if you have an Adaptec product.
If you have a server with SCSI drives and see a lot of EventIDs 11 and 15, this is a known issue and a hotfix has been released for Microsoft Windows Server 2003. See ME895573 to get the hotfix.
In one case, a computer was running Windows 2003 that had an Adaptec Ultra 160 (19160) SCSI Adapter that was being used to control separate C: and D: drives. After a while the D: drive failed. This resulted in the SCSI BIOS taking a long time to run and eventually timed out. When Windows loaded and this Event ID appeared, Windows took a long time to start up (even when the swap file was moved to the C: drive). The D: drive was not accessible. This event ID was accompanied by EventID 9 Source adpu160m, EventID 117 from source adpu160m, and EventID 10026 from source DCOM.
Resolution: Remove or replace the faulty hard drive.

As per Microsoft: "This problem is typically caused by a failing cable that connects the drive to the computer". See MSW2KDB for more details on this event.

See ME885352 if the problem appears when you cancel an I/O operation to a raw USB 2.0-attached hard disk drive in Windows 2000 Server SP4.

From a newsgroup post: "I had event 11 errors and it was a bug in my IBM ServeRaid firmware. Under heavy disk I/O these errors would occur. I updated the firmware and raid drivers and the problem was resolved. Prior to finding out about this bug, I temporarily resolved the problem by defragging my hard drive to reduce disk I/O".

From a newsgroup post: "I had the same error on my MSI board, 1700 AMD XP, 512mb Ram, 2 hard drives each partitioned at 20x20, and Windows 2000 Advanced Server. I was able to fix this problem. It would seem that on many of the motherboards out there windows 2000 does not support different drive types. I change it so each drive was on its own IDE physical connection, and put my CDROM on the second channel as slave. I then removed the "Remote Storage Service". This took care of the errors in Event Viewer. If you have only one drive, ensure you do not have it configured to cable select and update to the latest IDE drivers from your motherboard manufacturer".
In my case, after I disabled S.M.A.R.T. for my IDE drive the problem has not appeared anymore.
Replacing the IDE cable helped me to fix this error.
Boot-up was also very slow when these errors began to occur. I found the cause to be a USB Compact Flash card reader. Boot-up returned to normal speed and errors went away after disconnecting the card reader.
In my case, there problem was the power source.
This problem confused me for weeks. At last I resolved it successfully. I run ms cluster on two pc. They both have a qlogic 1040b scsi adapter, directly connected to digital ba356 scsi storage box. One 1040b's scsi id is 6, and the other is 7. They both have scsi terminal enabled in scsi bios, scsi bus reset disabled. Former I set both adapters id at 7, and encounter event 11 and 9 in my event log.
I have had the above Event ID on my system logs which would show up as soon as the system had booted and at random times there after. This normally took the form of five or six of the above errors in quick succession. I thought this was due to one of the HD controllers playing up. Tried swapping drives, cables, ports and reinstalling the system on a clean disk. As soon as I installed the system the errors came back. Since then I have traced the problem to the HD caddies I had my drives in, which until last week worked fine. Since I removed the drives from the caddies and connected the IDE cable directly to the drives the error has not reoccurred since.
As per Microsoft: "ATA66 DMA transfer mode is not supported for the onboard IDE controller." See the link below.
One user solved this by disabling DMA in the BIOS and disabling the Write Cache in Windows 2000.
This error is more likely to have been caused if Intel ATA Mass Storage device driver is installed or if it is an incorrect version. This is especially true if Roxio EZCD Creator is installed. Possible solutions include: Uninstall the Intel driver and reinstall after Roxio EZCD Creator, simple do not use the Intel driver.

I've been encountering this problem for ages. At seemingly random times, my computer would lock itself solid. I had updated the bios on my motherboard to no avail. It finally turns out that the culprit is the USB CompactFlash reader attached to my machine. Any CF cards are mounted as IDE devices, even though they are really connected via USB. Simply removing any CF cards when they are not in use fixed this problem.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.