event id 57 and event id 50 on primary cluster node

[ellie]

Hello,

After installing a new 64 b MS SQL 2005 SP2 instance on our prod SQL cluster
( 64b. windows 2003 ee sp2 ) I have noticed that every morning at exactly
same time the following warnings appear in windows system log:

Event Type: Warning
Event Source: Ftdisk
Event Category: Disk
Event ID: 57
Date: 5/31/2010
Time: 3:56:14 AM
User: N/A
Computer: PRG262
Description:
The system failed to flush data to the transaction log. Corruption may occur.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 00 00 00 00 01 00 16 01 ........
0008: 02 00 00 00 39 00 04 80 ....9..€
0010: 00 00 00 00 11 00 00 80 .......€
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 00 00 00 00 00 00 00 ........

Event Type: Warning
Event Source: Ntfs
Event Category: None
Event ID: 50
Date: 5/31/2010
Time: 3:56:33 AM
User: N/A
Computer: PRG262
Description:
{Delayed Write Failed} Windows was unable to save all the data for the file
. The data has been lost. This error may be caused by a failure of your
computer hardware or network connection. Please try to save this file
elsewhere.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 04 00 04 00 02 00 52 00 ......R.
0008: 00 00 00 00 32 00 04 80 ....2..€
0010: 00 00 00 00 11 00 00 80 .......€
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 00 00 00 00 00 00 00 ........
0028: 11 00 00 80 ...€

The changes made to the cluster are: two new shared disks and a new resource
group for sql and new sql instance. No failed cluster resources. no errors /
issues on any of cluster nodes before that .

Any help how to troubleshoot and get this fixed is highly appreciated.

[Justin Rich]

what is the storage setup like? i assume its fiber? is there a switch in the
mix? what manufacture? are all the drivers up to date?
any scheduled tasks? backup, AV scan, etc etc
any other events (even info ones) around that time? look for resource
changing ownership
which node does this happen with? primary or secondary?
have you moved the resources back and forth ok?

"ellie" <el...@discussions.microsoft.com> wrote in message
news:1F60673B-A3E9-427C...@microsoft.com...

[Edwin vMierlo [MVP]]

Usually this is an indication that an application is trying to write to a
clustered disk, after the disk is gone offline in cluster, or owned by
another node.
And that this application is not a clustered application.

Usual suspects: monitoring software, reporting software, a/v scanners ...
etc...

HTH,
Edwin.

"ellie" <el...@discussions.microsoft.com> wrote in message
news:1F60673B-A3E9-427C...@microsoft.com...

[ellie]

thanks much for replying to my post

Yes the shared disks are on our HP EVA800. Every node has two HBA QLE2460
and our sysadmins checked for any errors or warnings on the fiber and seems
like all is fine. we do know we have to update MPIO and HBA drrivers but so
far we have not had a single problem. I checked all sql jobs and nothing is
running on that node while warnings appear. av sw scans only server memory .
when the warnings are logged no other events are logged . this morning the
warnigs did appear at 3:56,4:09 and 5:54
I can successfully move the new resource group from primary to secondary and
back.

[ellie]

thanks much for the reply. Only sql is installed on the shared storage and
definately no failovers/ resource ownership change do occur before the
warnings.
"Edwin vMierlo [MVP]" wrote:

> .
>

[ellie]

when checked the cluster shared disks I did find the newly added disks have
crossed up disk ids. this happened because one id got reserved for unknown
usb device. Now the device is disabled but rescan after did not help.

How to fix this mess?