Hi
I have a question about Ntfs events being logged when a System State backup takes place.
Our domain controller is a Windows 2008 Server Standard Ed, 32bit running on a Dell Poweredge R410. The server contains 2 hard drives setup in a RAID 1 array. Device Manager shows the 'Disk drives' as 'Dell VIRTUAL DISK SCSI Disk Device'. The 'drive' contains two partitions, C and D. Drive C: has 14GB free and drive D: has 78GB free.
I have scheduled a batch file to run twice a day at 6am and 6pm which backs up the System State to the D: drive. I allow two days of backups to accumulate before deleting older backups. The batch file is laid out as follows:
wbadmin start systemstatebackup -backuptarget:D: -quiet
This works fine.
However, occassionally, the System log shows Ntfs Event 55 and 137. These only occur when the System State backup is in progress.
Log Name: System
Source: Ntfs
Date: 05/08/2012 06:18:09
Event ID: 55
Task Category: (2)
Level: Error
Keywords: Classic
User: N/A
Computer: Phobos.htlincs.local
Description:
The file system structure on the disk is corrupt and unusable. Please run the chkdsk utility on the volume VHD.
Log Name: System
Source: Ntfs
Date: 04/08/2012 06:18:16
Event ID: 137
Task Category: (2)
Level: Error
Keywords: Classic
User: N/A
Computer: Phobos.htlincs.local
Description:
The default transaction resource manager on volume VHD encountered a non-retryable error and could not start. The data contains the error code.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Ntfs" />
<EventID Qualifiers="49156">137</EventID>
<Level>2</Level>
<Task>2</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2012-08-04T05:18:16.388Z" />
<EventRecordID>517280</EventRecordID>
<Channel>System</Channel>
<Computer>Phobos.htlincs.local</Computer>
<Security />
</System>
<EventData>
<Data>
</Data>
<Data>VHD</Data>
<Binary>1C0004000200300002000000890004C000000000340000C000000000000000000000000000000000340000C0</Binary>
</EventData>
</Event>
The errors are intermittent and only occur when the System State backup is being created. The System Log on the server presently runs from 11 July and since that time 13 Ntfs events have been logged:
http://img706.imageshack.us/img706/426/ntfsevent55.jpg
These errors have been logged since I began using this method to backup the System State just over a year ago.
When I run chkdsk no errors are identified.
There are various versions of ntfs.sys within the Windows directory:
6.0.6001.22435
C:\Windows\winsxs\x86_microsoft-windows-ntfs_31bf3856ad364e35_6.0.6001.22435_none_a6df5de8361d0358
6.0.6002.18005
C:\Windows\winsxs\x86_microsoft-windows-ntfs_31bf3856ad364e35_6.0.6002.18005_none_a85ca2c91a0d64df
6.0.6002.22138
C:\Windows\winsxs\x86_microsoft-windows-ntfs_31bf3856ad364e35_6.0.6002.22138_none_a8c8d0ae3340a481
Do I need to be concerned about these events?
Thanks!