Event ID 57 on a windows 2003 Service pack 2

[Sabo, Eric]

We are getting the following event on one node in our cluster - we verified
that the cluster has no problem connecting to the ISCSI Storage.

the only article I can find for this is KB 885688.

The only ones one refer to HP driver issues, but this is on a Dell PowerEdge
1955 server.

Event Type: Warning
Event Source: Ftdisk
Event Category: Disk
Event ID: 57
Date: 1/3/2008
Time: 12:07:28 PM
User: N/A
Computer: XXXXXXXX

Description:
The system failed to flush data to the transaction log. Corruption may
occur.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 00 00 00 00 01 00 16 01 ........
0008: 02 00 00 00 39 00 04 80 ....9..€
0010: 00 00 00 00 11 00 00 80 .......€
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 00 00 00 00 00 00 00 ........

[Edwin vMierlo [MVP]]

Usually when you see this, the disks or groups or the whole cluster
terminates before you get ID 57's.

If indeed the disk/group/cluster is failing just before this ID, then this
is expected
e.g. disk offline or failed, something is still trying to write or OS trying
to flush from cache... but disk offline --> that will get you a 57.

So the ID 57 is only a "symptom" not a "cause"

look for other events prior to this, especially from source clussvc

[Sabo, Eric]

I got a whole bunch of these events in my system log and the cluster
resource never came off line.

How does on correct this?

We are using ISCSI storage if that matters.

[Chuck [MSFT]]

Review KB 931266 for applicability to your situation. There is no hotfix or
magic registry entry to fix this, and like you said, you are seeing no
failures which is typical. Normally, when we hear about this error in
particular, people are just trying to understand what is happening and
perhaps clean up there logs a little bit. Hopefully you have not setup any
monitoring software to alarm on this event.

[Edwin vMierlo [MVP]]

I have to ask: are you sure the disk was actually online on the node when
the ID 57 happened ?

I have seen this that "software" is accessing disks, but does not realise
the disk is in a cluster, hence it will try to access the disk, even when
the disk is not online on that particular node

Second instance I have seen, in a multi node cluster (node A, B and C),
given the following situation

- Disk R: has possible owners configured as node A and node B
- Disk R: is presented to all 3 nodes to the cluster
- ID 57's seen on Node C

Obviously Disk R: cannot come online on Node C, as it is not a possible
owner !
Hence, why would software on Node C even try to access the disk !
I never got to the real root cause of this, but there are two solutions
- set possible owners of disk R: to all nodes in the cluster, or
- do not present the Disk R: to node C (mask it away)

[Sabo, Eric]

it is weird because only one node experiences these issues.

I went through and check the node and it has the hotfixes, nic driver as the
other two.

[Gmamata]

did you solve this issue? I'm also facing the same problem..