Troubleshoot the event ID 50 error message

This article helps troubleshoot the event ID 50 error message.

Symptoms

When Windows writes information to the physical disk, it might log the following event messages in the System log:

Event ID: 50
Event Type: Warning
Event Source: Ftdisk
Description: {Lost Delayed-Write Data} The system was attempting to transfer file data from buffers to \Device\HarddiskVolume4. The write operation failed, and only some of the data may have been written to the file.
Data:
0000: 00 00 04 00 02 00 56 00
0008: 00 00 00 00 32 00 04 80
0010: 00 00 00 00 00 00 00 00
0018: 00 00 00 00 00 00 00 00
0020: 00 00 00 00 00 00 00 00
0028: 11 00 00 80

Event ID: 26
Event Type: Information
Event Source: Application Popup
Description: Windows - Delayed Write Failed : Windows was unable to save all the data for the file \Device\HarddiskVolume4\Program Files\Microsoft SQL Server\MSSQL$INSTANCETWO\LOG\ERRORLOG. The data has been lost. This error may be caused by a failure of your computer hardware or network connection.

Please try to save this file elsewhere.

These event messages mean exactly the same thing and are generated for the same reasons. This article focuses on event ID 50.

More information

There are several different sources for an event ID 50 message. For example, an event ID 50 message that's logged from a MRxSmb source occurs if there's a network connectivity problem that involves the redirector. This article addresses event ID 50 messages that refer to disk write problems. Review the event ID 50 message to verify that it refers to a disk write problem and that this article applies.

In this context, Windows logs an event ID 50 message if a generic error occurs when Windows tries to write information from the file system Cache Manager (not the hardware-level cache) to the physical disk. This write behavior, known as write-back or delayed-write caching, is part of the memory management function of Windows. Write-back caching improves system performance. However, failures in the delayed-write operations might cause a loss of data or volume integrity.

Typically, when an application sends a write request to Windows, Cache Manager caches the write request and reports to the application that the write was successful. Later, Cache Manager writes the data to the physical disk and then clears the cache. If an error occurs during the write operation, the data is lost when Cache Manager clears the cache.

Applications or processes that write non-critical data, such as logging processes, use Cache Manager to improve overall performance. Applications that write critical data, such as SQL Server, do not use Cache Manager. Such applications set a FILE_FLAG_NO_BUFFERING flag to guarantee that the transaction is completed directly to disk. Direct-to-disk writes never generate event ID 50 messages.

An event ID 50 message is similar to an event ID 9 or an event ID 11 message. Although the error isn't as serious as the error that's indicated by the event ID 9 or event ID 11 message, you can use the same troubleshooting techniques for an event ID 50 message as you do for an event ID 9 and an event ID 11 message. However, remember that anything that's in the stack can cause lost-delay writes, such as filter drivers and mini-port drivers.

Decoding the example event

The Symptoms section of this article provides the following example of an event ID 50 message:

Event ID: 50
Event Type: Warning
Event Source: Ftdisk
Description: {Lost Delayed-Write Data} The system was attempting to transfer file data from buffers to \Device\HarddiskVolume4. The write operation failed, and only some of the data may have been written to the file.
Data:
0000: 00 00 04 00 02 00 56 00
0008: 00 00 00 00 32 00 04 80
0010: 00 00 00 00 00 00 00 00
0018: 00 00 00 00 00 00 00 00
0020: 00 00 00 00 00 00 00 00
0028: 11 00 00 80

How to identify the target disk

You can identify the disk that was the target of the write operation by using the symbolic link that's listed for the drive in the "Description" section of the event ID message, for example: \Device\HarddiskVolume4.

How to decode the data section

Event ID 50 messages (and also event ID 9, 11, 51 or similar "DISK" messages) include binary data that you can use to help identify the problem. The message includes the following data section:

Data:
0000: 00 00 04 00 02 00 56 00
0008: 00 00 00 00 32 00 04 80
0010: 00 00 00 00 00 00 00 00
0018: 00 00 00 00 00 00 00 00
0020: 00 00 00 00 00 00 00 00
0028: 11 00 00 80

The following table describes what each offset of this message represents.

The NT Status error code

The final status code is the most important piece of information in an event ID 50 message. This is the error code that's returned when the write request is made, and it's the key source of information. In the example, the final status code is listed at 0x28 at the sixth line of the data set. In starts with "0028:" and includes the four octets in this line:

0028: 11 00 00 80

When you convert the hexadecimal data in the event ID 50 message to the status code, remember that the values are represented in the little-endian format. Because the status code is the only piece of information that you're interested in, it might be easier to view the data in WORDS format instead of BYTES. If you do this, the bytes will be in the correct format and the data might be easier to interpret quickly.

To change your view of the data, select Words in the Event Properties window. In the Data Words view, the data section of the example reads as follows:

() Bytes (.) 
Words 0000: 00040000 00560002 00000000 80040032 0010: 00000000 00000000 00000000 00000000 0020: 00000000 00000000 80000011

In this case, the final status code is 0x80000011. This status code maps to STATUS_DEVICE_BUSY and implies that the device is currently busy. This was the reason that the write operation failed.

For more information about NT status codes, see Using NTSTATUS Values. The list of codes is also available in the Windows Software Developers Kit (SDK), in the NTSTATUS.H file.

The event category code

In the example, the event category code (the code that's associated with event ID 50) is listed in the second line. This line starts with "0008:" and it includes the last 4 bytes of the following line:

0008: 00 00 00 00 32 00 04 80

In this case, the error code is 0x80040032, which corresponds to IO_LOST_DELAYED_WRITE. This information appears in the event description as "Lost Delayed-Write Data."