Random huge amounts of --Event Viewer-- entries that cycle on and off, without a clear pattern, or confirmed reason.


Query01

Member
Local time
6:09 PM
Posts
54
OS
Windows 11\Home
These huge amount of Event-Viewer entries are mostly 'warnings' pointing to disk, Dcom, DeviceSetupManager and others. Sprinkled with a few errors. The major concern is --the Event-Viewer\warnings with the Source: disk; this is causing severe data-loss. While researching the 'disk' warnings, they keep pointing to usb connected hdd's and/or their connection. Not only is the laptop, hdd docking stations and the hdd's newly purchased items, all of them have been swapped-out; and these Event-Viewer disk warnings continue at random dates and times, without any sort of pattern.

There is nothing wrong with the external usb-connected hardware, that the logs are pointing to.

These random huge amount of Event-Viewer entries will also happen with Dcom and others, stated above, and for whatever reason 'SFC /scannow' never finds anything. Just before drafting this post, I restored the box in question back to a 20231204 manual Restore-point; absolutely no installed apps were affected. The immediate results were the repeated string of Event-Viewer\Dcom entries stopped, along with other huge amounts of random Event-Viewer\warnings.

Additionally, this box is running a portable version of 'Notepad++, with it being pinned to the taskbar. After the successful Restore-Point, starting Notepad++ from the pinned taskbar icon does not work; Win-11 offers to remove the icon/shortcut. On the other hand, Left-clicking and existing txt associated with Notepad++ as the default app, will both open with the portable Notepad++, once opened, the pinned Notepad++ will toggle the open instance of Notepad++. After the current instance of Notepad++ is closed, the taskbar\pinned Notepad++ icon\shortcut, will refuse to function and right-clicking will not offer a 'properties' menu item --allowing any editing.

This truly smells like Windows-11

To be clear I'm asking for feedback as to why:
--does Win-11\Event-Viewer thinks there are disk issues
--is Win-11Event-Viewer randomly generating huge amounts of entries Pre_Restore-Point, but after a successful restore, the Event-Viewer stops and/or severely slows down generating those same huge amounts of data?
--given the above, is SFC /scannow not finding anything?

Finally, how to resolve the odd behavior with the Notepad++ icon/shortcut pinned to the taskbar? Yeah, I get "make another shortcut", but why did it break? How to stop it from breaking again?

Respectfully
 

My Computer

System One

  • OS
    Windows 11\Home
@Query01
As far as the entries in Event Viewer are concerned, if they don't point to specific errors or issues, then you can mostly ignore them. Just clear the logs and continue.

If you are experiencing actual issues/errors then by all means check the Event Viewer and look for relevant entries.

Since most of the EV entries you mentioned, point to USB drive/s, then you should open a CMD window and run chkdsk DriveLetter: /F on those USB drive/s to make sure there are no issues with the drives.

Also, try using different USB ports when connecting the drives, if possible and make sure all of your USB drivers are up to date.

Are you using the PortableApps.com version of Notepad++?
Where is Notepad++ located?
How did you add the taskbar icon for Notepad++ (please be precise)?
 

My Computer

System One

  • OS
    Windows 11 Pro
    Computer type
    PC/Desktop
    CPU
    Ryzen 9 3900X
    Motherboard
    ASUS ROG Strix X570-E Gaming
    Memory
    G-Skill RipjawsV F4-3600C18 (16GB x 2)
    Graphics Card(s)
    Gigabyte RX 5700 XT Gaming OC
    Sound Card
    Realtek ALC1220P
    Monitor(s) Displays
    ASUS VE278 (x 2)
    Screen Resolution
    1920x1080
    Hard Drives
    Samsung 850 Pro 256GB
    Samsung 970 Pro NVMe 512GB (x 2)
    ST10000VN0004 10TB (x 2)
    ST10000VN0008 10TB (x 2)
    ST4000VN000 4TB (x 2)
    PSU
    Corsair HX1000
    Case
    Corsair Carbide 400R
    Cooling
    AMD Wraith Prism (Stock)
    Keyboard
    Logitech G213
    Mouse
    Logitech G502
    Internet Speed
    100Mbps down / 40Mbps up
    Browser
    Firefox - Chrome - Edge
    Antivirus
    Windows Defender - Clamwin
@Query01
Since most of the EV entries you mentioned, point to USB drive/s, then you should open a CMD window and run chkdsk DriveLetter: /F on those USB drive/s to make sure there are no issues with the drives.

Also, try using different USB ports when connecting the drives, if possible and make sure all of your USB drivers are up to date.
@trumpy81
The above has already been done, as well as, S.M.A.R.T. included with OEM drive specific software: Seatools, WD Dashboard. Nothing is defective in these drives.
Are you using the PortableApps.com version of Notepad++?
No
How did you add the taskbar icon for Notepad++ (please be precise)?
From the Notepad++ extracted folder, right-click notepad++.exe, pin to taskbar.
 

My Computer

System One

  • OS
    Windows 11\Home
@Query01
Where did you extract the folder, was it to an internal drive or a USB drive?
 

My Computer

System One

  • OS
    Windows 11 Pro
    Computer type
    PC/Desktop
    CPU
    Ryzen 9 3900X
    Motherboard
    ASUS ROG Strix X570-E Gaming
    Memory
    G-Skill RipjawsV F4-3600C18 (16GB x 2)
    Graphics Card(s)
    Gigabyte RX 5700 XT Gaming OC
    Sound Card
    Realtek ALC1220P
    Monitor(s) Displays
    ASUS VE278 (x 2)
    Screen Resolution
    1920x1080
    Hard Drives
    Samsung 850 Pro 256GB
    Samsung 970 Pro NVMe 512GB (x 2)
    ST10000VN0004 10TB (x 2)
    ST10000VN0008 10TB (x 2)
    ST4000VN000 4TB (x 2)
    PSU
    Corsair HX1000
    Case
    Corsair Carbide 400R
    Cooling
    AMD Wraith Prism (Stock)
    Keyboard
    Logitech G213
    Mouse
    Logitech G502
    Internet Speed
    100Mbps down / 40Mbps up
    Browser
    Firefox - Chrome - Edge
    Antivirus
    Windows Defender - Clamwin
There's your issue.

Whenever a USB drive is disconnected/reconnected it can be assigned a different GUID etc. This essentially means that the shortcut no longer points to a valid location, which is why Windows offers to remove the dead shortcut.

Move the Notepad++ folder to an internal drive and then add the taskbar shortcut etc...

Fingers crossed, that should solve your issue.

By all means keep a backup copy on the USB drive, just in case.
 

My Computer

System One

  • OS
    Windows 11 Pro
    Computer type
    PC/Desktop
    CPU
    Ryzen 9 3900X
    Motherboard
    ASUS ROG Strix X570-E Gaming
    Memory
    G-Skill RipjawsV F4-3600C18 (16GB x 2)
    Graphics Card(s)
    Gigabyte RX 5700 XT Gaming OC
    Sound Card
    Realtek ALC1220P
    Monitor(s) Displays
    ASUS VE278 (x 2)
    Screen Resolution
    1920x1080
    Hard Drives
    Samsung 850 Pro 256GB
    Samsung 970 Pro NVMe 512GB (x 2)
    ST10000VN0004 10TB (x 2)
    ST10000VN0008 10TB (x 2)
    ST4000VN000 4TB (x 2)
    PSU
    Corsair HX1000
    Case
    Corsair Carbide 400R
    Cooling
    AMD Wraith Prism (Stock)
    Keyboard
    Logitech G213
    Mouse
    Logitech G502
    Internet Speed
    100Mbps down / 40Mbps up
    Browser
    Firefox - Chrome - Edge
    Antivirus
    Windows Defender - Clamwin
There's your issue.

Whenever a USB drive is disconnected/reconnected it can be assigned a different GUID etc. This essentially means that the shortcut no longer points to a valid location, which is why Windows offers to remove the dead shortcut.

Move the Notepad++ folder to an internal drive and then add the taskbar shortcut etc...

Fingers crossed, that should solve your issue.

By all means keep a backup copy on the USB drive, just in case.
@trumpy81 , Thank you. If a new GUID was issued, why is the taskbar pin able to toggle the UI after the app is running?
 

My Computer

System One

  • OS
    Windows 11\Home
Thank you. If a new GUID was issued, why is the taskbar pin able to toggle the UI after the app is running?
I'm not sure I'm understanding your point?
 

My Computer

System One

  • OS
    Windows 11 Pro
    Computer type
    PC/Desktop
    CPU
    Ryzen 9 3900X
    Motherboard
    ASUS ROG Strix X570-E Gaming
    Memory
    G-Skill RipjawsV F4-3600C18 (16GB x 2)
    Graphics Card(s)
    Gigabyte RX 5700 XT Gaming OC
    Sound Card
    Realtek ALC1220P
    Monitor(s) Displays
    ASUS VE278 (x 2)
    Screen Resolution
    1920x1080
    Hard Drives
    Samsung 850 Pro 256GB
    Samsung 970 Pro NVMe 512GB (x 2)
    ST10000VN0004 10TB (x 2)
    ST10000VN0008 10TB (x 2)
    ST4000VN000 4TB (x 2)
    PSU
    Corsair HX1000
    Case
    Corsair Carbide 400R
    Cooling
    AMD Wraith Prism (Stock)
    Keyboard
    Logitech G213
    Mouse
    Logitech G502
    Internet Speed
    100Mbps down / 40Mbps up
    Browser
    Firefox - Chrome - Edge
    Antivirus
    Windows Defender - Clamwin
@trumpy81 , Thank you. If a new GUID was issued, why is the taskbar pin able to toggle the UI after the app is running?
@trumpy81
I understand about a new GUID if/when a usb device dis/reconnects. In that instance the pinned item is pointing to a stale location. That being the case, pinned item not working, I can go to the exe open the application, once opened, the pinned item will in-fact toggle the notepad++ UI.

That is where/how I'm confused.
 

My Computer

System One

  • OS
    Windows 11\Home
@Query01
Sorry, I was hung up on your 'toggle the UI' ... lol
That is because the program is loaded into memory and the shortcut no longer needs to access the drive location etc... in order to access the program, it is already running.
 

My Computer

System One

  • OS
    Windows 11 Pro
    Computer type
    PC/Desktop
    CPU
    Ryzen 9 3900X
    Motherboard
    ASUS ROG Strix X570-E Gaming
    Memory
    G-Skill RipjawsV F4-3600C18 (16GB x 2)
    Graphics Card(s)
    Gigabyte RX 5700 XT Gaming OC
    Sound Card
    Realtek ALC1220P
    Monitor(s) Displays
    ASUS VE278 (x 2)
    Screen Resolution
    1920x1080
    Hard Drives
    Samsung 850 Pro 256GB
    Samsung 970 Pro NVMe 512GB (x 2)
    ST10000VN0004 10TB (x 2)
    ST10000VN0008 10TB (x 2)
    ST4000VN000 4TB (x 2)
    PSU
    Corsair HX1000
    Case
    Corsair Carbide 400R
    Cooling
    AMD Wraith Prism (Stock)
    Keyboard
    Logitech G213
    Mouse
    Logitech G502
    Internet Speed
    100Mbps down / 40Mbps up
    Browser
    Firefox - Chrome - Edge
    Antivirus
    Windows Defender - Clamwin
@trumpy81 , thank you. Given the app is portable, I would not figured this out on my own; in this decade.
 

My Computer

System One

  • OS
    Windows 11\Home
I'm sure you would have eventually, but yeah, it is a little counter-intuitive.

Good luck with it and if you have any other questions, fire away :-)
 

My Computer

System One

  • OS
    Windows 11 Pro
    Computer type
    PC/Desktop
    CPU
    Ryzen 9 3900X
    Motherboard
    ASUS ROG Strix X570-E Gaming
    Memory
    G-Skill RipjawsV F4-3600C18 (16GB x 2)
    Graphics Card(s)
    Gigabyte RX 5700 XT Gaming OC
    Sound Card
    Realtek ALC1220P
    Monitor(s) Displays
    ASUS VE278 (x 2)
    Screen Resolution
    1920x1080
    Hard Drives
    Samsung 850 Pro 256GB
    Samsung 970 Pro NVMe 512GB (x 2)
    ST10000VN0004 10TB (x 2)
    ST10000VN0008 10TB (x 2)
    ST4000VN000 4TB (x 2)
    PSU
    Corsair HX1000
    Case
    Corsair Carbide 400R
    Cooling
    AMD Wraith Prism (Stock)
    Keyboard
    Logitech G213
    Mouse
    Logitech G502
    Internet Speed
    100Mbps down / 40Mbps up
    Browser
    Firefox - Chrome - Edge
    Antivirus
    Windows Defender - Clamwin
@trumpy81
Actually trying to figure out why Win-11 is cycling the random disk warnings associated with data loss is paramount. Currently, as seen in the original post, after the restore, the stream of entries mostly stopped; others slowed way down. The restore had no affect on/with any installed application.

Given all drivers, and BIOS are up-to-date, all hardware is new and has been swapped-out for another new replacement, it appears to be the OS. Stand-by for more data, I'm typing now ...
 

My Computer

System One

  • OS
    Windows 11\Home
@trumpy81
The box in question writes surveillance footage 24/7. The application authors have not released an update since 2019; I think they're on an extended fishing trip. Every time we do a fresh install of this OS, regardless if its from the OEM img, or the flashdrive created by Microsoft, once installed and completely Windows Updated. the system is not stable; app-hangs and crashes regularly.

This current install is the most stable this box has ever been, by using the 'Reset PC'\keep personal files. I refuse to allow Windows Update to ruin this stability --until I have my back-up machine returned from the OEM. Until that time comes, I'm desperately researching why this random surge of Event-Viewer\warning keep cycling on and off. More recently, what affect the successful System-Restore had to stop and/or slow the surge and why SFC /scannow is not finding anything.

I'm sure the surge will circle back and resume, but there's not pattern.
 

My Computer

System One

  • OS
    Windows 11\Home
OK kewl, right click on the Start menu and select Event Viewer.

Then go to Windows Logs > System and on the far right, click on Save All Events As... and then save the file as XXX.evtx, don't include any display info.

I am assuming that is where the drive related messages appear, if not, go to the appropriate log and then save it.

Not sure if the forum will accept .evtx files, if not, right click on the file and select Send to > Compressed (zipped) folder then attach the .zip file to your post.

I will scan through the log and see if anything stands out.
 

My Computer

System One

  • OS
    Windows 11 Pro
    Computer type
    PC/Desktop
    CPU
    Ryzen 9 3900X
    Motherboard
    ASUS ROG Strix X570-E Gaming
    Memory
    G-Skill RipjawsV F4-3600C18 (16GB x 2)
    Graphics Card(s)
    Gigabyte RX 5700 XT Gaming OC
    Sound Card
    Realtek ALC1220P
    Monitor(s) Displays
    ASUS VE278 (x 2)
    Screen Resolution
    1920x1080
    Hard Drives
    Samsung 850 Pro 256GB
    Samsung 970 Pro NVMe 512GB (x 2)
    ST10000VN0004 10TB (x 2)
    ST10000VN0008 10TB (x 2)
    ST4000VN000 4TB (x 2)
    PSU
    Corsair HX1000
    Case
    Corsair Carbide 400R
    Cooling
    AMD Wraith Prism (Stock)
    Keyboard
    Logitech G213
    Mouse
    Logitech G502
    Internet Speed
    100Mbps down / 40Mbps up
    Browser
    Firefox - Chrome - Edge
    Antivirus
    Windows Defender - Clamwin
OK kewl, right click on the Start menu and select Event Viewer.

Then go to Windows Logs > System and on the far right, click on Save All Events As... and then save the file as XXX.evtx, don't include any display info.

I will scan through the log and see if anything stands out.
@trumpy81
Administrative Events, the priority concerns are System logs, source: disk, ntfs and UASPStor. I use the following cmd to find which events are specifying 'lost' or 'unsaved' data, which are mostly source: disk.

GET-eventlog -logname system -message *lost* | ft timegenerated, eventid, message -autosize -wrap

That said, the other warnings are very close by and will usually be within that same surge grouped by date\time.

There are instances when this surge of events cycles, an app will hang, then that hang will also affect Win-11 file explorer causing it to hang. Once this hanging starts to snowball, any app that is hung cannot be terminated by any means, to included alt+F4, the UI, Task Manager\End Task, Task Manager\ End Process Tree nor Taskkill /PID.

Not until or unless I reboot the box -or- disconnect the usb device. Again\reminder, everything is new and has been swapped-out for a new same make\model. This issue of the hanging apps snowballing does not happen every time; but often enough to knock the system offline from writing.

Respectfully
 

Attachments

  • 20231028_to_20240110.zip
    458.4 KB · Views: 2

My Computer

System One

  • OS
    Windows 11\Home
@Query01
Thanks for that.

You did not tell me you had setup RAID at all?

If you are using USB drives in the RAID array then there is the source of your instability. Remember what I said about disconnecting/reconnecting USB drives?

Disk 2 has the same disk identifiers as one or more disks connected to the system. Go to Microsoft's support website (Microsoft Support) and search for KB2983588 to resolve the issue.

The above is from your EV log and is easily explained by disconnecting/reconnecting USB drives.

My recommendation would be to copy as much data as you can to internal drives or other external USB drives, then delete the RAID configuration. Reformat the USB drives and connect them as individual drives, do NOT add them to a RAID configuration.

Once you have done that, most of your instability should be gone. You may have a program or two that will act up, but they should be relatively easy to wrangle.

If you want to use RAID etc... then invest in a proper NAS. I recommend Synology or QNAP only. There are others and you are free to use them, but I would not recommend them.
 

My Computer

System One

  • OS
    Windows 11 Pro
    Computer type
    PC/Desktop
    CPU
    Ryzen 9 3900X
    Motherboard
    ASUS ROG Strix X570-E Gaming
    Memory
    G-Skill RipjawsV F4-3600C18 (16GB x 2)
    Graphics Card(s)
    Gigabyte RX 5700 XT Gaming OC
    Sound Card
    Realtek ALC1220P
    Monitor(s) Displays
    ASUS VE278 (x 2)
    Screen Resolution
    1920x1080
    Hard Drives
    Samsung 850 Pro 256GB
    Samsung 970 Pro NVMe 512GB (x 2)
    ST10000VN0004 10TB (x 2)
    ST10000VN0008 10TB (x 2)
    ST4000VN000 4TB (x 2)
    PSU
    Corsair HX1000
    Case
    Corsair Carbide 400R
    Cooling
    AMD Wraith Prism (Stock)
    Keyboard
    Logitech G213
    Mouse
    Logitech G502
    Internet Speed
    100Mbps down / 40Mbps up
    Browser
    Firefox - Chrome - Edge
    Antivirus
    Windows Defender - Clamwin
The events displayed possible drive problems.




Please test all drives:


1) Sea Tools Long Generic test:




2) HD Tune: (free or trial)

a) Health
b) Benchmark
c) Full error scan



3) HD Sentinel: (trial)

a) Overview
b) Temperature
c) SMART



Make sure that test images / share links are posted into this thread.




Code:
The IO operation at logical block address 0x800c000 for Disk 3 (PDO name: \Device\00000142) failed due to a hardware error.

Code:
The previous system shutdown at 11:14:09 PM on ‎12/‎4/‎2023 was unexpected.

Code:
Disk 3 has the same disk identifiers as one or more disks connected to the system. Go to Microsoft's support website (http://support.microsoft.com) and search for KB2983588 to resolve the issue.

Code:
The IO operation at logical block address 0x0 for Disk 1 (PDO name: \Device\000000aa) was retried.

Code:
{Delayed Write Failed} Windows was unable to save all the data for the file . The data has been lost. This error may be caused by a failure of your computer hardware or network connection. Please try to save this file elsewhere.

Code:
Delayed Write Failed} Windows was unable to save all the data for the file A:\45011\20240109\2_IPC2_NAPA_20240109144633.mp4. The data has been lost. This error may be caused by a failure of your computer hardware or network connection. Please try to save this file elsewhere.

Code:
{Delayed Write Failed} Windows was unable to save all the data for the file A:\$BitMap. The data has been lost. This error may be caused by a failure of your computer hardware or network connection. Please try to save this file elsewhere.

Code:
The previous system shutdown at 11:14:09 PM on ‎12/‎4/‎2023 was unexpected.

Code:
The IO operation at logical block address 0x0 for Disk 1 (PDO name: \Device\000000aa) was retried.

Code:
{Delayed Write Failed} Windows was unable to save all the data for the file . The data has been lost. This error may be caused by a failure of your computer hardware or network connection. Please try to save this file elsewhere.

Code:
An error was detected on device \Device\Harddisk1\DR1 during a paging operation.

Code:
The IO operation at logical block address 0x22402461 for Disk 1 (PDO name: \Device\0000007b) was retried.
 

My Computer

System One

  • OS
    Windows 10
    Computer type
    Laptop
    Manufacturer/Model
    HP
    CPU
    Intel(R) Core(TM) i7-4800MQ CPU @ 2.70GHz
    Motherboard
    Product : 190A Version : KBC Version 94.56
    Memory
    16 GB Total: Manufacturer : Samsung MemoryType : DDR3 FormFactor : SODIMM Capacity : 8GB Speed : 1600
    Graphics Card(s)
    NVIDIA Quadro K3100M; Intel(R) HD Graphics 4600
    Sound Card
    IDT High Definition Audio CODEC; PNP Device ID HDAUDIO\FUNC_01&VEN_111D&DEV_76E0
    Hard Drives
    Model Hitachi HTS727575A9E364
    Antivirus
    Microsoft Defender
    Other Info
    Mobile Workstation
The events displayed possible drive problems.




Please test all drives:
@zbook , with respect, have you read this entire thread before posting? Specifically posts #1 thru #3 <--click it.
With regards to Raid, there is no Raid. All external drives are connected in the following manner; the-box\usb-A\docking-station with dedicated pwr-supply\3.5" hdd.

...continued Respect ...
 

My Computer

System One

  • OS
    Windows 11\Home
@Query01
I saw many of these entries in your EV log:
Reset to device, \Device\RaidPort3, was issued.
I assumed this referred to a RAID array that you had setup. My apologies if that is not the case.

That message does seem to indicate that RAID is in use though, possibly by the Docking Station?

Do you have any settings/controls for that in the Docking Station?
 

My Computer

System One

  • OS
    Windows 11 Pro
    Computer type
    PC/Desktop
    CPU
    Ryzen 9 3900X
    Motherboard
    ASUS ROG Strix X570-E Gaming
    Memory
    G-Skill RipjawsV F4-3600C18 (16GB x 2)
    Graphics Card(s)
    Gigabyte RX 5700 XT Gaming OC
    Sound Card
    Realtek ALC1220P
    Monitor(s) Displays
    ASUS VE278 (x 2)
    Screen Resolution
    1920x1080
    Hard Drives
    Samsung 850 Pro 256GB
    Samsung 970 Pro NVMe 512GB (x 2)
    ST10000VN0004 10TB (x 2)
    ST10000VN0008 10TB (x 2)
    ST4000VN000 4TB (x 2)
    PSU
    Corsair HX1000
    Case
    Corsair Carbide 400R
    Cooling
    AMD Wraith Prism (Stock)
    Keyboard
    Logitech G213
    Mouse
    Logitech G502
    Internet Speed
    100Mbps down / 40Mbps up
    Browser
    Firefox - Chrome - Edge
    Antivirus
    Windows Defender - Clamwin
Back
Top Bottom