Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 51 Source: Disk

An error was detected on device <device path> during a paging operation.
Device: \Device\Harddisk2\D, error: IO_WARNING_PAGING_FAILURE - From a support forum, this was caused by an external USB drive (Seagate). After disabling the power-saving mode using Seagate management tools, the error stopped.
On a Windows Server 2012 R2, this error may occur when Windows Server Backup runs. If you have verified that the backup target is healthy and the backups are successful, the error can be safely ignored. In my case, I tested 2 different external hard drives, 2 different cables and 2 different interfaces (ESata and USB 3.0).  Since the error still occurred, hardware is not the issue.
Event shows on Server 2008 R2 when backing up Hyper-V volumes holding VMs with either Windows Backup or Shadowprotect. Drive referenced does not appear in Storage Manager but is actually the destination drive (NAS or USB).
I got this on a good system/boot disk as woke up from hibernation. Computer showed BSOD, and upon reboot chkdsk found an orphaned system file. However, no after effects were noticed.
This event occurred for me because a driver wasn't successfully installed for an external backup drive. The solution was to download the driver from the manufacturer's website and install it myself.

I received this error and a "USB-device not recognized" error with an external USB hard disk. I discovered that there were three USB cables between the USB port and the disk. I removed one of those extension USB cables and the problem was solved. 3x1.5m USB cables seem to be too much, 2x1.5m is ok.
This event may be recorded when a digital camera is attached to the system to transfer images from its internal hard drive to the computer. If the camera's batteries run out of power during this process one of the effects is the recording of this message. An example of device reported in such cases is "\Device\Harddisk2\DR10" - and it is the footprint of an IBM SmartMedia hard drive.

* * *

One common question about this event is how do you identify what is the actual drive/device mentioned in the event? For example, if the device path is \Device\Harddisk5\D and I have several drives installed or attached to my computer, which one is the actual Harddisk5? To identify it, open the Disk Management applet (diskmgmt.msc) and select a volume on the list displayed in the top panel. Under it, the list of drives and their number is displayed and you can match the hard disk number shown there with the one listed in the event description. For the example specified, the \Device\Harddisk5 device corresponds to hard disk 5 (an external hard disk attached via USB).
From a newsgroup post: "A Buggy NForce SATA driver caused the problem. Disabling Native Command Queuing (NCQ) in the Nvidia SATA driver resolved it". See the link to "Abit Forum Thread" for some other useful information.
In my case, going to "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\PrefetchParameters" and setting the value for "EnablePrefetcher" to 1 solved the problem.
In my case, the games were randomly shutting down and sometimes window pop-ups occurred saying Delayed Write Failure. There was a problem with my MFT (Master File Table) file. Using the program "Diskeeper", I changed its size (creating a new one). Note: you need to use the Diskeeper Professional version (There is a trial for it available). Since then I have not had any more problems with games shutting down or files being lost.

See ME174619 and ME227350 for information about the Master File Table.
In testing a new configuration on our terminal servers, we ran into this error under moderate user load. We started with two brand new servers with 8GB of RAM, using Windows 2003 Enterprise Server. We used the "/PAE" and the "/3GB" switches on the server to increase available memory to 8GB. The paging file was set to anywhere from 2048 to 4096. At one point, we let the server set the paging file at a whopping 8000 MB. The paging activity increased so much that it caused disk thrashing on the server and these errors were logged. The server would then slow to a crawl and more or less had to be rebooted. After removing the "/PAE" and the "/3GB" switches, the error has not been encountered under similar user loads. Rather than using the full 8GB of RAM, we put the RAM into 4GB with mirroring instead.
I received this error along with EventID 50 from source Ntfs (and EventID 11 from source disk and EventID 5 from source atapi), when I had the paging file and my virtual disks on the same physical disk. When I moved the paging file to another disk the errors stopped.
This event may occur when you try to write data to a Serial Bus Protocol 2 (SBP-2) device, such as an IEEE (Institute of Electrical and Electronics Engineers) 1394 drive. See ME885464 for a hotfix applicable to Microsoft Windows XP.

See "Dell Support Document Number: TT1091520" and "Dell Support Document Number: TT1091518" for additional information about this event.
As per Microsoft: "An input/output (I/O) request to a memory-mapped file failed and the operation was retried. If these events are logged regularly on a primary system drive, replace the device. Otherwise, no user action is required". See MSW2KDB for more details on this event.

This event may appear if you have a Windows server booting from a Storage Area Network (SAN). See ME305547 for more detailed information.

As per Microsoft: "This problem occurs if an Input/Output (I/O) operation to a hard disk is unsuccessful. When an I/O operation to a hard disk is unsuccessful, Windows Server 2003 logs Event ID 51 in the system log. This problem occurs even if the I/O operation is retried and is subsequently successful". See ME834910 for a hotfix.

As per Microsoft: "This problem occurs if you have installed one or more storage devices that do not support cache commands. The Windows 2000 SP4 Disk.sys driver writes many events to the system log when it performs write operations to a storage device that does not support cache commands". See ME830051 for a hotfix.

From a newsgroup post: "If you have Intel's Application Accelerator installed this is what can cause the error. I have found that it is a false detection and it is nothing to you should worry about. I read it on Intel's web site. I get this error sometimes but it never causes any problems".

See ME835473 for additional information on this event.

This error is generated along with EventID 32 from source Disk (and erroneously error 34), when Windows 2000 SP4 is installed in a system with and Iomega Zip 250. I have tracked this for several months without loss of data, and it appears to be spurious though it does fill up the System log.
From ME324916: "The Iomega Zip 250 drive does not support requests by the operating system to turn off write caching. Because of this, an Event ID 32 warning is logged in the event log. This warning is by design. Event ID 34s are then incorrectly generated in the event log every time you start your computer, although they are supposed to be Event ID 32s".
Per Ionut Marin's comment: "The Windows 2000 SP4 Disk.sys driver writes many events to the system log when it performs write operations to a storage device that does not support cache commands. See ME830051 for a hotfix".
To fix this problem I disabled the “Write cache” feature on my disk. To do this go to Device Manager -> Disk Drives, right click on your disk and choose Properties. Here you can disable this feature.
Intel's Application Accelerator does seem to cause, the event ID 51 in many instances. The best advice is to troubleshoot the actual code in each instance (see ME244780). I have now seen this in many computers, those I have built and my own. This code does seem to come up in all of them; they all use the chipset I845 or I850. Only with the most recent driver release from Intel ( does this happen. The drives and memory are fine. The specific code in each case is a 0x40 SRB_STATUS_QUEUE_FROZEN, I believe it’s an error in the IAA driver itself. Removing the IAA, removes the problem in each instance.
If this disk is your system disk or a disk that contains sensitive data, consider taking regular backups and/or replacing this disk as soon as possible. It will fail soon. In my system it started generating errors, it had degraded performance and it failed a month later.
I had the same message due to a faulty HDD.
I was burning a cd with Nero Burning Rom 6 + data verification. The data verification did freeze near 97%, and after 3 minutes I aborted the process and the event log reported this warning.
This will also occur on a Windows 2000 server connected to a compaq EMA SAN (HSG80s) utilizing triple-mirroring. When the "Broken" mirror set is inserted back into the SAN for remirroring, you will see this occur. Compaq claims this is entirely normal and from my end, has occurred since it was installed and has never affected anything.
According to Microsoft, this error can be hardware related. See the information provided for event 9 and 11.
On a Windows 2000 server, this error could be caused when a process is taking a long time to process data on the partition that holds the page file. Processes like a scheduled virus scan on all partitions, a file backup procedure, or just by having the page file on a fragmented and heavily utilized partition that has little free space.

If the error only happens at the same time as one of the above scheduled tasks, you may not need to worry, as long as it goes away after the task is done and the page file returns to normal.

Check Microsoft articles ME123747 and ME197379 to learn more about page file and performance.

This event occurs when multiple clusters that are attached to the same storage subsystem are not configured properly. See ME304415 and ME311081 links.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.