Creating a quiesced snapshot of a Windows virtual machine generates Event IDs 50, 57, 137, 140, 157, or 12289
search cancel

Creating a quiesced snapshot of a Windows virtual machine generates Event IDs 50, 57, 137, 140, 157, or 12289

book

Article ID: 316528

calendar_today

Updated On:

Products

VMware vSphere ESXi

Issue/Introduction

Symptoms:
When using the new version of VMware Tools in ESXi/ESX 4.1 Update 1 or newer, you experience these symptoms:
  • When a quiesced snapshot is created on a Windows Server 2003, Windows Server 2003 R2, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, or a Windows Server 2012 R2 virtual machine, or a Windows 2016  duplicate disks are created in the virtual machine.
  • The Event Viewer in the virtual machine displays one or more of these events:
     
    • Event ID: 50 NTFS Warning
      {delayed write failed} Windows was unable to save all the data for the file. The data has been lost. This error may be caused by a failure of your computer hardware or network connection. Please try to save this file elsewhere
       
    • Event ID: 57 NTFS Warning
      The system failed to flush data to the transaction log. Corruption may occur.
       
    • Event ID: 137 NTFS Error
      The default transaction resource manager on volume \\?\Volume{806289e8-6088-11e0-a168-005056ae003d} encountered a non-retryable error and could not start. The data contains the error code.
       
    • Event ID: 140 NTFS Warning
      The system failed to flush data to the transaction log. Corruption may occur in VolumeId:<> DeviceName: \Device\HarddiskVolume<>.(A device which does not exist was specified.).
       
    • Event ID: 157 Disk Warning
      Disk x has been surprise removed.


Environment

VMware vSphere ESXi 6.0
VMware vSphere ESXi 6.7
VMware vSphere ESXi 6.5

Resolution

To resolve this issue, see the Microsoft Knowledge Base articles 816004, 2951098, and 2958027.

Note: The preceding link was correct as of December 11, 2017. If you find the link is broken, provide feedback and a VMware employee will update the lin

Disclaimer: VMware is not responsible for the reliability of any data, opinions, advice, or statements made on third-party websites. Inclusion of such links does not imply that VMware endorses, recommends, or accepts any responsibility for the content of such sites.



Additional Information

This table provides more information about the events:

EventDescription
Event ID 50 NTFS WarningThe NTFS filesystem sees the volume as read-write. The volume is actually read-only so these operations fail to start and no modifications are made to the volume.
Event ID 57 NTFS WarningThis is misleading as no actual corruption occurs. The volume is actually read-only, so these operations fail and no modifications are made to the volume.
Event ID 137 NTFS WarningThe NTFS filesystem sees the volume as read-write. The volume is actually read-only so these operations fail and no modifications are made to the volume.
Event ID 140 NTFS WarningThis is misleading as no actual corruption occurs. The volume is actually read-only, so these operations fail and no modifications are made to the volume.
Event ID: 12289 VSS ErrorThis message is benign. This occurs when the virtual machine drives are queried to determine which are eligible for snapshots, and the floppy drive is not eligible.
Event ID: 157 Disk WarningThis message is benign. The volume is actually read-only, so these operations fail and no modifications are made to the volume.
 
Unable to take quiesced snapshot of Windows Server virtual machine with gpt disks without MSR partition
Failed to quiesce snapshot of the Windows 2008 R2 virtual machine
Windows 仮想マシンの静止スナップショットを作成すると、イベント ID の 50、57、137、140、157、または 12289 が生成される
创建 Windows 虚拟机的静默快照生成事件 ID 50、57、137、140、157 或 12289
Quiescing operations cause a Windows virtual machine to panic with a Stop 24 error on ntfs.sys

Powered by Wolken Software