Creating a quiesced snapshot of a Windows virtual machine generates Event IDs 15, 50, 57, 137, 140, 157, or 12289

Products

• VMware vSphere ESXi

Issue/Introduction

When using the new version of VMware Tools in ESXi, the following symptoms may appear:

• When a quiesced snapshot is created on a Windows Server 2003, Windows Server 2003 R2, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, or a Windows Server 2012 R2 virtual machine, or a Windows 2016, or a Windows 2022 duplicate disks are created in the virtual machine.
• The Event Viewer in the virtual machine displays one or more of these events:
   
  • Event ID: 15 Disk Warning: The device, \Device\HarddiskX\DRX, is not ready for access yet.


  • Event ID: 50 NTFS Warning
{delayed write failed} Windows was unable to save all the data for the file. The data has been lost. This error may be caused by a failure of your computer hardware or network connection. Please try to save this file elsewhere
    
    
  • Event ID: 57 NTFS Warning
The system failed to flush data to the transaction log. Corruption may occur.
 
  • Event ID: 137 NTFS Error
The default transaction resource manager on volume \\?\Volume{806289e8-6088-11e0-a168-005056ae003d} encountered a non-retryable error and could not start. The data contains the error code.
 
  • Event ID: 140 NTFS Warning
The system failed to flush data to the transaction log. Corruption may occur in VolumeId:<> DeviceName: \Device\HarddiskVolume<>.(A device which does not exist was specified.).
 
  • Event ID: 157 Disk Warning
Disk x has been surprise removed.

Environment

VMware vSphere ESXi

Cause

During a quiesced snapshot, the VMware Snapshot Provider hot-adds temporary writable disks (shadow copy volumes) to the Guest OS.

When the snapshot completes, these disks are hot-removed. Windows logs these warnings because the disks are removed without a graceful guest-level ejection.

Resolution

To resolve this issue, refer to the Microsoft Knowledge Base articles 816004, 2951098, and 2958027.

Disclaimer: VMware is not responsible for the reliability of any data, opinions, advice, or statements made on third-party websites. Inclusion of such links does not imply that VMware endorses, recommends, or accepts any responsibility for the content of such sites.

Workaround:

Configure your third-party backup software to take non-quiesced (crash-consistent) snapshots instead of quiesced snapshots.

Disabling file system quiescing within your backup tool parameters prevents temporary shadow volumes from being added and removed during backups, eliminating these event logs.

Additional Information

This table provides additional information about the events:

Event	Description
Event ID 50 NTFS Warning	The NTFS filesystem sees the volume as read-write. The volume is actually read-only so these operations fail to start and no modifications are made to the volume.
Event ID 57 NTFS Warning	This is misleading as no actual corruption occurs. The volume is actually read-only, so these operations fail and no modifications are made to the volume.
Event ID 137 NTFS Warning	The NTFS filesystem sees the volume as read-write. The volume is actually read-only so these operations fail and no modifications are made to the volume.
Event ID 140 NTFS Warning	This is misleading as no actual corruption occurs. The volume is actually read-only, so these operations fail and no modifications are made to the volume.
Event ID: 12289 VSS Error	This message is benign. This occurs when the virtual machine drives are queried to determine which are eligible for snapshots, and the floppy drive is not eligible.
Event ID: 157 Disk Warning	This message is benign. The volume is actually read-only, so these operations fail and no modifications are made to the volume.

 

Unable to take quiesced snapshot of Windows Server virtual machine with gpt disks without MSR partition
Failed to quiesce snapshot of the Windows 2008 R2 virtual machine
Windows 仮想マシンの静止スナップショットを作成すると、イベント ID の 50、57、137、140、157、または 12289 が生成される