NTFS Warnings and Errors during Windows Backup

Symptoms

When a Windows VM on VMware is protected by Clumio, a quiesced snapshot will be created as per the configured backup schedule. In some cases, this may result in Warning and Error messages that can be observed in the Windows logs.

The Windows Event Viewer may display the following one or more events:

• Event ID: 50 NTFS Warning
  {delayed write failed} Windows was unable to save all the data for the file. The data has been lost. This error may be caused by a failure of your computer hardware or network connection. Please try to save this file elsewhere
   
• Event ID: 57 NTFS Warning
  The system failed to flush data to the transaction log. Corruption may occur.
   
• Event ID: 137 NTFS Error
  The default transaction resource manager on volume \\?\Volume{806289e8-6088-11e0-a168-005056ae003d} encountered a non-retryable error and could not start. The data contains the error code.
   
• Event ID: 140 NTFS Warning
  The system failed to flush data to the transaction log. Corruption may occur in VolumeId:<> DeviceName: \Device\HarddiskVolume<>.(A device which does not exist was specified.).
   
• Event ID: 157 Disk Warning
  Disk x has been surprise removed.

Cause

Quiesced snapshots are attempted to ensure that VM's with VSS aware plugins ask applications to enter a safe state before the snapshot occurs. This is to prevent applications like SQL from being backed up in an inconsistent state. VMware creates a temporary disk as part of snapshot procedure, the disk removal will result in the errors logged.

Resolution

The behavior described here is a known and documented issue from VMware and Microsoft. While generally not harmful, the following VMware KB provides more detailed information on available Microsoft hotfixes and steps towards preventing the log messages from being reported. 

 https://kb.vmware.com/s/article/2006849