Hi,
Hoping to get a few ideas on what might be the cause of this issue we are having.
Background
We have two hyper-v clusters running Server 2012R2.
Our AD environment is a mix of 2008R2 and one 2012R2 DC’s.
We have both 2008R2 and 2012R2 DC’s running virtualised on the Hyper-V clusters.
2008R2 DC is on a VHD disk.
2012R2 DC is on VHDX disk.
We have a number of other 2012R2 and 2008R2 servers on the clusters.
Issue
We have started seeing the above error being logged on the 2012R2 DC only. The 2008R2 DC’s do not show this error at all.
Event ID: 508
Source: ESENT
Level: Warning
svchost (2568) A request to write to the file «C:Windowssystem32LogFilesSumSvc.log» at offset 2023424 (0x00000000001ee000) for 4096 (0x00001000) bytes succeeded, but took an abnormally long time (15 seconds) to be serviced by the OS. This
problem is likely due to faulty hardware. Please contact your hardware vendor for further assistance diagnosing the problem.
lsass (628) A request to write to the file «\?Volume{538f044f-9c00-11e3-80c2-00155d1c0903}WindowsNTDSntds.dit» at offset 31342592 (0x0000000001de4000) for 8192 (0x00002000) bytes succeeded, but took an abnormally long time (15 seconds) to
be serviced by the OS. This problem is likely due to faulty hardware. Please contact your hardware vendor for further assistance diagnosing the problem.
Source: NTDS ISAM
NTDS (628) NTDSA: A request to write to the file «E:WindowsNTDSedb.log» at offset 1306624 (0x000000000013f000) for 4096 (0x00001000) bytes succeeded, but took an abnormally long time (21 seconds) to be serviced by the OS. This problem is likely
due to faulty hardware. Please contact your hardware vendor for further assistance diagnosing the problem.
Event ID 509
Source: NTDS ISAM
NTDS (628) NTDSA: A request to read from the file «E:WindowsNTDSntds.dit» at offset 243572736 (0x000000000e84a000) for 8192 (0x00002000) bytes succeeded, but took an abnormally long time (21 seconds) to be serviced by the OS. In addition, 0
other I/O requests to this file have also taken an abnormally long time to be serviced since the last message regarding this problem was posted 23679 seconds ago. This problem is likely due to faulty hardware. Please contact your hardware vendor for further
assistance diagnosing the problem.
Troubleshooting So Far
AV exceptions are in place for scanning
Backup (DPM 2012) disabled for testing
Moved 2012R2 DC to another virtual host
Moved 2012R2 DC to another storage server
The server is fully patched with all latest updates available from windows update.
Any assistance is appreciated.
Regards,
Denis Cooper
MCITP EA — MCT
Help keep the forums tidy, if this has helped please mark it as an answer
My Blog
LinkedIn: 
-
Edited by
Monday, February 24, 2014 9:29 AM
Hi,
Hoping to get a few ideas on what might be the cause of this issue we are having.
Background
We have two hyper-v clusters running Server 2012R2.
Our AD environment is a mix of 2008R2 and one 2012R2 DC’s.
We have both 2008R2 and 2012R2 DC’s running virtualised on the Hyper-V clusters.
2008R2 DC is on a VHD disk.
2012R2 DC is on VHDX disk.
We have a number of other 2012R2 and 2008R2 servers on the clusters.
Issue
We have started seeing the above error being logged on the 2012R2 DC only. The 2008R2 DC’s do not show this error at all.
Event ID: 508
Source: ESENT
Level: Warning
svchost (2568) A request to write to the file «C:Windowssystem32LogFilesSumSvc.log» at offset 2023424 (0x00000000001ee000) for 4096 (0x00001000) bytes succeeded, but took an abnormally long time (15 seconds) to be serviced by the OS. This
problem is likely due to faulty hardware. Please contact your hardware vendor for further assistance diagnosing the problem.
lsass (628) A request to write to the file «\?Volume{538f044f-9c00-11e3-80c2-00155d1c0903}WindowsNTDSntds.dit» at offset 31342592 (0x0000000001de4000) for 8192 (0x00002000) bytes succeeded, but took an abnormally long time (15 seconds) to
be serviced by the OS. This problem is likely due to faulty hardware. Please contact your hardware vendor for further assistance diagnosing the problem.
Source: NTDS ISAM
NTDS (628) NTDSA: A request to write to the file «E:WindowsNTDSedb.log» at offset 1306624 (0x000000000013f000) for 4096 (0x00001000) bytes succeeded, but took an abnormally long time (21 seconds) to be serviced by the OS. This problem is likely
due to faulty hardware. Please contact your hardware vendor for further assistance diagnosing the problem.
Event ID 509
Source: NTDS ISAM
NTDS (628) NTDSA: A request to read from the file «E:WindowsNTDSntds.dit» at offset 243572736 (0x000000000e84a000) for 8192 (0x00002000) bytes succeeded, but took an abnormally long time (21 seconds) to be serviced by the OS. In addition, 0
other I/O requests to this file have also taken an abnormally long time to be serviced since the last message regarding this problem was posted 23679 seconds ago. This problem is likely due to faulty hardware. Please contact your hardware vendor for further
assistance diagnosing the problem.
Troubleshooting So Far
AV exceptions are in place for scanning
Backup (DPM 2012) disabled for testing
Moved 2012R2 DC to another virtual host
Moved 2012R2 DC to another storage server
The server is fully patched with all latest updates available from windows update.
Any assistance is appreciated.
Regards,
Denis Cooper
MCITP EA — MCT
Help keep the forums tidy, if this has helped please mark it as an answer
My Blog
LinkedIn:
-
Edited by
Monday, February 24, 2014 9:29 AM
Hi,
Hoping to get a few ideas on what might be the cause of this issue we are having.
Background
We have two hyper-v clusters running Server 2012R2.
Our AD environment is a mix of 2008R2 and one 2012R2 DC’s.
We have both 2008R2 and 2012R2 DC’s running virtualised on the Hyper-V clusters.
2008R2 DC is on a VHD disk.
2012R2 DC is on VHDX disk.
We have a number of other 2012R2 and 2008R2 servers on the clusters.
Issue
We have started seeing the above error being logged on the 2012R2 DC only. The 2008R2 DC’s do not show this error at all.
Event ID: 508
Source: ESENT
Level: Warning
svchost (2568) A request to write to the file «C:Windowssystem32LogFilesSumSvc.log» at offset 2023424 (0x00000000001ee000) for 4096 (0x00001000) bytes succeeded, but took an abnormally long time (15 seconds) to be serviced by the OS. This
problem is likely due to faulty hardware. Please contact your hardware vendor for further assistance diagnosing the problem.
lsass (628) A request to write to the file «\?Volume{538f044f-9c00-11e3-80c2-00155d1c0903}WindowsNTDSntds.dit» at offset 31342592 (0x0000000001de4000) for 8192 (0x00002000) bytes succeeded, but took an abnormally long time (15 seconds) to
be serviced by the OS. This problem is likely due to faulty hardware. Please contact your hardware vendor for further assistance diagnosing the problem.
Source: NTDS ISAM
NTDS (628) NTDSA: A request to write to the file «E:WindowsNTDSedb.log» at offset 1306624 (0x000000000013f000) for 4096 (0x00001000) bytes succeeded, but took an abnormally long time (21 seconds) to be serviced by the OS. This problem is likely
due to faulty hardware. Please contact your hardware vendor for further assistance diagnosing the problem.
Event ID 509
Source: NTDS ISAM
NTDS (628) NTDSA: A request to read from the file «E:WindowsNTDSntds.dit» at offset 243572736 (0x000000000e84a000) for 8192 (0x00002000) bytes succeeded, but took an abnormally long time (21 seconds) to be serviced by the OS. In addition, 0
other I/O requests to this file have also taken an abnormally long time to be serviced since the last message regarding this problem was posted 23679 seconds ago. This problem is likely due to faulty hardware. Please contact your hardware vendor for further
assistance diagnosing the problem.
Troubleshooting So Far
AV exceptions are in place for scanning
Backup (DPM 2012) disabled for testing
Moved 2012R2 DC to another virtual host
Moved 2012R2 DC to another storage server
The server is fully patched with all latest updates available from windows update.
Any assistance is appreciated.
Regards,
Denis Cooper
MCITP EA — MCT
Help keep the forums tidy, if this has helped please mark it as an answer
My Blog
LinkedIn:
-
Edited by
Monday, February 24, 2014 9:29 AM
-
#1
EVGA GeForce GTX 970 04G-P4-2978-KR 4GB FTW GAMING w/ACX 2.0, Silent Cooling Graphics Card
CORSAIR RMx RM750X 750W ATX12V / EPS12V 80 PLUS GOLD
AMD FX-8350 Black Edition Vishera 8-Core 4.0 GHz (4.2 GHz Turbo) Socket AM3+ 125W FD8350FRHKBOX Desktop Processor
GIGABYTE GA-990FXA-UD5 R5 (rev. 1.0) AM3+ AMD 990FX SATA 6Gb/s USB 3.0 ATX AMD Motherboard
HyperX Fury Black Series 16GB (2 x 8GB) 240-Pin DDR3 SDRAM DDR3 1600
And the event details are:
— <Event xmlns=»http://schemas.microsoft.com/win/2004/08/events/event»>
— <System>
<Provider Name=»ESENT» />
<EventID Qualifiers=»0″>508</EventID>
<Level>3</Level>
<Task>7</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime=»2016-08-18T17:52:12.241672100Z» />
<EventRecordID>382</EventRecordID>
<Channel>Application</Channel>
<Computer>DESKTOP-99BECKT</Computer>
<Security />
</System>
— <EventData>
<Data>taskhostw</Data>
<Data>3880</Data>
<Data>WebCacheLocal:</Data>
<Data>C:UsersHugoAppDataLocalMicrosoftWindowsWebCacheV01.log</Data>
<Data>507904 (0x000000000007c000)</Data>
<Data>4096 (0x00001000)</Data>
<Data>36</Data>
</EventD
— <Event xmlns=»http://schemas.microsoft.com/win/2004/08/events/event»>
— <System>
<Provider Name=»ESENT» />
<EventID Qualifiers=»0″>533</EventID>
<Level>3</Level>
<Task>1</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime=»2016-08-18T17:52:12.241672100Z» />
<EventRecordID>383</EventRecordID>
<Channel>Application</Channel>
<Computer>DESKTOP-99BECKT</Computer>
<Security />
</System>
— <EventData>
<Data>taskhostw</Data>
<Data>3880</Data>
<Data>WebCacheLocal:</Data>
<Data>C:UsersHugoAppDataLocalMicrosoftWindowsWebCacheWebCacheV01.dat</Data>
<Data>98304 (0x0000000000018000)</Data>
<Data>32768 (0x00008000)</Data>
<Data>36</Data>
</EventData>
</Event>
And the General view:
taskhostw (3880) WebCacheLocal: A request to write to the file «C:UsersHugoAppDataLocalMicrosoftWindowsWebCacheV01.log» at offset 507904 (0x000000000007c000) for 4096 (0x00001000) bytes succeeded, but took an abnormally long time (36 seconds) to be serviced by the OS. This problem is likely due to faulty hardware. Please contact your hardware vendor for further assistance diagnosing the problem.
-
- Jun 12, 2015
-
- 61,167
-
- 5,188
-
- 166,290
- 10,454
-
#14
-
- Jun 12, 2015
-
- 61,167
-
- 5,188
-
- 166,290
- 10,454
-
#3
Sorry haha. I have a 1 TB western digital HDD and a 250 Gb samsung SSD. And both barley have anything on them. After I ran the test with the link you gave me nothing worked but what information I did get was when I safe booted and I turned off all the 3rd party application that google chrome still froze.
-
- Jun 12, 2015
-
- 61,167
-
- 5,188
-
- 166,290
- 10,454
-
#4
Event 508:
If the event is just one odd occurrence, then it may be just a transient problem. If it happens on regular basis then the specified drive should be checked for problems (run chkdsk, make sure you have enough free space and physical memory — running low on memory may affect all the disk operations).
http://www.eventid.net/display-eventid-508-source-ESENT-eventno-5580-phase-1.htm
try a checkdisk on both drives, you don’t fall into last two.
-
#5
Event 508:
If the event is just one odd occurrence, then it may be just a transient problem. If it happens on regular basis then the specified drive should be checked for problems (run chkdsk, make sure you have enough free space and physical memory — running low on memory may affect all the disk operations).
http://www.eventid.net/display-eventid-508-source-ESENT-eventno-5580-phase-1.htm
try a checkdisk on both drives, you don’t fall into last two.
Nope tried it on both and it says nothing is wrong with both of them
-
- Jun 12, 2015
-
- 61,167
-
- 5,188
-
- 166,290
- 10,454
-
#6
right click start button
choose command prompt (admin)
type SFC /scannow and press enter
this scans system files and may fix this behaviour
-
#7
right click start button
choose command prompt (admin)
type SFC /scannow and press enter
this scans system files and may fix this behaviour
Nope nothing. I did notice my RAM sticks were not in the same color I’m not sure if that could be the cause but so far no freezes in 30min of use
-
- Jun 12, 2015
-
- 61,167
-
- 5,188
-
- 166,290
- 10,454
-
#8
533 appears to be a logon failure: Event 533 is logged on the workstation or server where the user failed to logon. https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=533
I checked around and found a few explanations for the event you listed. The common theme for this event was that it is indicating a faulty drive or controller. Here are some of the explanations for the event 508, I got them from eventid.net you have to be a member to see the results so I will paste some of what I found.«As per Microsoft: «This Warning event is logged when the Exchange database engine tries to write to the named file and encounters a delayed response from the operating system in performing that write operation. This is a warning, not an error, because the operation eventually finishes, although it is slow. This might indicate a hardware problem, probably with the disk controller, a disk, or other storage component». See MSEX2K3DB for more information about this event»
https://www.experts-exchange.com/questions/23306210/Sporadic-networking-performance-issues-only-event-ID-508-from-ESE-to-suggest-problem.html
i think 533 is a result of 508, you must have been trying to logon to a site online and the ssd was too slow to respond, and the logon timed out in the 30 second freeze time.
All signs point at ssd, you may not believe it but that is what PC is telling you. Only other choice is drivers, I don’t think flashing bios would fix this, and you say you have latest now.
-
#9
533 appears to be a logon failure: Event 533 is logged on the workstation or server where the user failed to logon. https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=533
I checked around and found a few explanations for the event you listed. The common theme for this event was that it is indicating a faulty drive or controller. Here are some of the explanations for the event 508, I got them from eventid.net you have to be a member to see the results so I will paste some of what I found.«As per Microsoft: «This Warning event is logged when the Exchange database engine tries to write to the named file and encounters a delayed response from the operating system in performing that write operation. This is a warning, not an error, because the operation eventually finishes, although it is slow. This might indicate a hardware problem, probably with the disk controller, a disk, or other storage component». See MSEX2K3DB for more information about this event»
https://www.experts-exchange.com/questions/23306210/Sporadic-networking-performance-issues-only-event-ID-508-from-ESE-to-suggest-problem.html
i think 533 is a result of 508, you must have been trying to logon to a site online and the ssd was too slow to respond, and the logon timed out in the 30 second freeze time.
All signs point at ssd, you may not believe it but that is what PC is telling you. Only other choice is drivers, I don’t think flashing bios would fix this, and you say you have latest now.
I ran a benchmark test with my SSD and it seems it be really slow with random read and write.
-
- Jun 12, 2015
-
- 61,167
-
- 5,188
-
- 166,290
- 10,454
-
#10
-
#11
Sequential Read: 2563
Sequential Write: 1140
Random Read: 62282
Random Write: 22469
-
- Jun 12, 2015
-
- 61,167
-
- 5,188
-
- 166,290
- 10,454
-
#12
Sequential Read: 2563
Sequential Write: 1140
Random Read: 62282
Random Write: 22469
are you running rapid through Samsung Magician? I only ask as your sequential is way bigger than mine but I am not running rapid
mine are (we both had same SSD)
SR: 548
SW: 484
RR: 95725
RW: 82982
your random scores are still lower so, especially the Random write
rapid mode is essentially a RAMDISK that the magician software creates in your system for the SSD to use. the memory in SSDs is slower then your ram. but using the ram means your risk of data loss in a power failure should be greater since your SSD is using it as a buffer of sorts.IF samsung is using the rapid mode test results in their official benchmarks for these drives, what they are doing would be considered a scam because its not testing the drives, its testing a ramdisk.
i have a brand new samsung 850 pro 256GB and i have the same issue. using magician Without rapid mode my scores are.
Sequential read — 547 MB/s (expected 550 but good enough)
Sequential write — 502 MB/s (expected 520 but good enough)Random read — 61893 IOPs (expected 100,000)
Random write — 50409 IOPs (expected 90,000)
http://www.tomshardware.com/answers/id-2507951/850-evo-low-iops.html
looking through that thread, one possible thing you can do is install latest Intel Raid Storage Technology drivers, it seems it might speed you up, but your random read/write scores are very low. Also seems AMD motherboards supply slower scores than Intel ones.
If you used samsung magician to do benchmarks, it seems it isn’t very accurate. http://www.tomshardware.com/answers/id-2573130/brand-samsung-850-evo-250gb-low-random-read-write-iops.html
try running As SSD benchmark
as a comparison — these are my scores
-
#13
Sequential Read: 2563
Sequential Write: 1140
Random Read: 62282
Random Write: 22469
are you running rapid through Samsung Magician? I only ask as your sequential is way bigger than mine but I am not running rapid
mine are (we both had same SSD)
SR: 548
SW: 484
RR: 95725
RW: 82982
your random scores are still lower so, especially the Random write
rapid mode is essentially a RAMDISK that the magician software creates in your system for the SSD to use. the memory in SSDs is slower then your ram. but using the ram means your risk of data loss in a power failure should be greater since your SSD is using it as a buffer of sorts.IF samsung is using the rapid mode test results in their official benchmarks for these drives, what they are doing would be considered a scam because its not testing the drives, its testing a ramdisk.
i have a brand new samsung 850 pro 256GB and i have the same issue. using magician Without rapid mode my scores are.
Sequential read — 547 MB/s (expected 550 but good enough)
Sequential write — 502 MB/s (expected 520 but good enough)Random read — 61893 IOPs (expected 100,000)
Random write — 50409 IOPs (expected 90,000)
http://www.tomshardware.com/answers/id-2507951/850-evo-low-iops.html
looking through that thread, one possible thing you can do is install latest Intel Raid Storage Technology drivers, it seems it might speed you up, but your random read/write scores are very low. Also seems AMD motherboards supply slower scores than Intel ones.
If you used samsung magician to do benchmarks, it seems it isn’t very accurate. http://www.tomshardware.com/answers/id-2573130/brand-samsung-850-evo-250gb-low-random-read-write-iops.html
try running As SSD benchmark
Yes I am running Rapid without it my random stuff are 9000 or lower
-
- Jun 12, 2015
-
- 61,167
-
- 5,188
-
- 166,290
- 10,454
-
#14
-
#15
My machine was freezing for 30 seconds or more at a time and it was maddening. Anyone with these ESENT issues should use a good quality Trojan or rootkit sniffer to see if that’s the issue.
-
#16
I was hoping you could interpret these numbers for me after running a scan. The last couple days I have been having random freezing, which last for about 15-30 seconds, then returns to normal. I have updated all drivers, checked memory, run disk check, system file checker, etc. with no resolution. During this test I noticed in the upper left hand corner, in German lol, it says PCI IDE controller-bad. Here are the numbers:
292.37 — 163.84
14.36 — 50.72
18.37 — 82.32
0.261 — 0.304
Score 62 — 156
I would appreciate any help you could provide.
-
- Jun 12, 2015
-
- 61,167
-
- 5,188
-
- 166,290
- 10,454
-
#17
- Advertising
- Cookies Policies
- Privacy
- Term & Conditions
- Topics