1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Which disk is it?

Discussion in 'Windows XP' started by Patok, May 28, 2010.

  1. Patok

    Patok Flightless Bird

    I was looking at the Event Viewer System log, and noticed some warnings:

    Event Type: Warning
    Event Source: Disk
    Event Category: None
    Event ID: 51
    Date: 2010-05-28
    Time: 04:29:08
    User: N/A
    Computer: DELL
    Description:
    An error was detected on device \Device\Harddisk1\D during a paging
    operation.


    But I can't figure out which exactly disk it is (I have several
    mounted). Is Harddisk1 the same as Disk 1 in the Disk Management
    utility? Where can I see which disk in the \Device\ hierarchy
    corresponds to which disk in the other utilities?

    (WinXP, of course, that's why I'm asking here.)

    --
    You'd be crazy to e-mail me with the crazy. But leave the div alone.
    --
    Whoever bans a book, shall be banished. Whoever burns a book, shall burn.
     
  2. Johnw

    Johnw Flightless Bird

    Patok has brought this to us :
    > I was looking at the Event Viewer System log, and noticed some warnings:
    >
    > Event Type: Warning
    > Event Source: Disk
    > Event Category: None
    > Event ID: 51
    > Date: 2010-05-28
    > Time: 04:29:08
    > User: N/A
    > Computer: DELL
    > Description:
    > An error was detected on device \Device\Harddisk1\D during a paging
    > operation.
    >
    >
    > But I can't figure out which exactly disk it is (I have several mounted). Is
    > Harddisk1 the same as Disk 1 in the Disk Management utility? Where can I see
    > which disk in the \Device\ hierarchy corresponds to which disk in the other
    > utilities?
    >
    > (WinXP, of course, that's why I'm asking here.)
    >
    > --
    > You'd be crazy to e-mail me with the crazy. But leave the div alone.


    Harddisk1\D
    I'd say "D"

    Event ID: 51

    http://www.google.com.au/#hl=en&q=E...sDirect+ToolKit+&gs_rfai=&fp=98d6f0e0c0026df0

    http://support.microsoft.com/kb/244780



    --- news://freenews.netfront.net/ - complaints: news@netfront.net ---
     
  3. Patok

    Patok Flightless Bird

    Johnw wrote:
    > Patok has brought this to us :
    >> I was looking at the Event Viewer System log, and noticed some warnings:
    >>
    >> Event Type: Warning
    >> Event Source: Disk
    >> Event Category: None
    >> Event ID: 51
    >> Date: 2010-05-28
    >> Time: 04:29:08
    >> User: N/A
    >> Computer: DELL
    >> Description:
    >> An error was detected on device \Device\Harddisk1\D during a paging
    >> operation.
    >>
    >>
    >> But I can't figure out which exactly disk it is (I have several
    >> mounted). Is Harddisk1 the same as Disk 1 in the Disk Management
    >> utility? Where can I see which disk in the \Device\ hierarchy
    >> corresponds to which disk in the other utilities?
    >>
    >> (WinXP, of course, that's why I'm asking here.)

    >
    > Harddisk1\D
    > I'd say "D"


    No, it can't be D: - that's a DVD drive. The article you list below
    says that it is probably the drive name, truncated. My system drive's
    name (C:) begins with 'D'; in addition, in following the instructions of
    how to identify the drives, in the registry it is listed as being under
    SCSI port 1, which would correspond to drive 1, as per the conventions.
    However, this is in contradiction to the same article, which says that
    under Disk Manager, the drive number is the same - it is not - there it
    is 0. Under Disk Manager, drive 1 is an external USB drive, but it is
    not enabled to have a paging file. So most likely it /is/ drive (C:),
    but the KB article is a mess.


    > Event ID: 51
    >
    >
    > http://support.microsoft.com/kb/244780


    --
    You'd be crazy to e-mail me with the crazy. But leave the div alone.
    --
    Whoever bans a book, shall be banished. Whoever burns a book, shall burn.
     
  4. Paul

    Paul Flightless Bird

    Patok wrote:
    > Johnw wrote:
    >> Patok has brought this to us :
    >>> I was looking at the Event Viewer System log, and noticed some warnings:
    >>>
    >>> Event Type: Warning
    >>> Event Source: Disk
    >>> Event Category: None
    >>> Event ID: 51
    >>> Date: 2010-05-28
    >>> Time: 04:29:08
    >>> User: N/A
    >>> Computer: DELL
    >>> Description:
    >>> An error was detected on device \Device\Harddisk1\D during a paging
    >>> operation.
    >>>
    >>>
    >>> But I can't figure out which exactly disk it is (I have several
    >>> mounted). Is Harddisk1 the same as Disk 1 in the Disk Management
    >>> utility? Where can I see which disk in the \Device\ hierarchy
    >>> corresponds to which disk in the other utilities?
    >>>
    >>> (WinXP, of course, that's why I'm asking here.)

    >>
    >> Harddisk1\D
    >> I'd say "D"

    >
    > No, it can't be D: - that's a DVD drive. The article you list below
    > says that it is probably the drive name, truncated. My system drive's
    > name (C:) begins with 'D'; in addition, in following the instructions of
    > how to identify the drives, in the registry it is listed as being under
    > SCSI port 1, which would correspond to drive 1, as per the conventions.
    > However, this is in contradiction to the same article, which says that
    > under Disk Manager, the drive number is the same - it is not - there it
    > is 0. Under Disk Manager, drive 1 is an external USB drive, but it is
    > not enabled to have a paging file. So most likely it /is/ drive (C:),
    > but the KB article is a mess.
    >
    >
    >> Event ID: 51
    >>
    >>
    >> http://support.microsoft.com/kb/244780

    >


    Harddisk1 is the name of the drive.

    If you want to dump all the names, use the "dd --list" command
    using this ported utility. It names all the disks in that way.

    http://www.chrysocome.net/dd

    \\?\Device\Harddisk0\Partition0
    link to \\?\Device\Harddisk0\DR0
    Fixed hard disk media. Block size = 512

    \\?\Device\Harddisk0\Partition1
    link to \\?\Device\HarddiskVolume1

    The "Partition0" refers to the whole raw disk.

    Entries like "Partition1", "Partition2", etc., are the
    individual partitions on the disk.

    The names allow disk utilities to do stuff with respect to the
    whole disk (if you need to work on the MBR), or allow you to
    work on individual partitions (if you wanted to back
    up a particular partition, sector by sector).

    That command will also return size information, which you
    can correlate with what you see in Disk Management.

    On partitions, where no size information is listed, there
    seems to be a permissions problem that prevents them from
    being listed in more detail.

    I have not been able to find a technical reference, that
    decodes the "D" or "DR0" or the like, seen on the end of
    some of the raw names. So that part of the question, is
    still a mystery. I was hoping to find a complete listing
    of what was possible there, but can't find any details.

    *******

    The disks seem to be named in the same order as in
    Disk Management, but I don't have any documents to prove
    that. That is just an observation from limited testing
    on my machine here.

    Paul
     
  5. Sprechen sie von C++

    Sprechen sie von C++ Flightless Bird

    dd is not a standard Windows command, its from Linux, get you OS strait,
    this is a Windows area

    "Paul" <nospam@needed.com> wrote in message
    news:htpimu$s4c$1@speranza.aioe.org...
    > Patok wrote:
    >> Johnw wrote:
    >>> Patok has brought this to us :
    >>>> I was looking at the Event Viewer System log, and noticed some
    >>>> warnings:
    >>>>
    >>>> Event Type: Warning
    >>>> Event Source: Disk
    >>>> Event Category: None
    >>>> Event ID: 51
    >>>> Date: 2010-05-28
    >>>> Time: 04:29:08
    >>>> User: N/A
    >>>> Computer: DELL
    >>>> Description:
    >>>> An error was detected on device \Device\Harddisk1\D during a paging
    >>>> operation.
    >>>>
    >>>>
    >>>> But I can't figure out which exactly disk it is (I have several
    >>>> mounted). Is Harddisk1 the same as Disk 1 in the Disk Management
    >>>> utility? Where can I see which disk in the \Device\ hierarchy
    >>>> corresponds to which disk in the other utilities?
    >>>>
    >>>> (WinXP, of course, that's why I'm asking here.)
    >>>
    >>> Harddisk1\D
    >>> I'd say "D"

    >>
    >> No, it can't be D: - that's a DVD drive. The article you list below
    >> says that it is probably the drive name, truncated. My system drive's
    >> name (C:) begins with 'D'; in addition, in following the instructions of
    >> how to identify the drives, in the registry it is listed as being under
    >> SCSI port 1, which would correspond to drive 1, as per the conventions.
    >> However, this is in contradiction to the same article, which says that
    >> under Disk Manager, the drive number is the same - it is not - there it
    >> is 0. Under Disk Manager, drive 1 is an external USB drive, but it is not
    >> enabled to have a paging file. So most likely it /is/ drive (C:), but the
    >> KB article is a mess.
    >>
    >>
    >>> Event ID: 51
    >>>
    >>>
    >>> http://support.microsoft.com/kb/244780

    >>

    >
    > Harddisk1 is the name of the drive.
    >
    > If you want to dump all the names, use the "dd --list" command
    > using this ported utility. It names all the disks in that way.
    >
    > http://www.chrysocome.net/dd
    >
    > \\?\Device\Harddisk0\Partition0
    > link to \\?\Device\Harddisk0\DR0
    > Fixed hard disk media. Block size = 512
    >
    > \\?\Device\Harddisk0\Partition1
    > link to \\?\Device\HarddiskVolume1
    >
    > The "Partition0" refers to the whole raw disk.
    >
    > Entries like "Partition1", "Partition2", etc., are the
    > individual partitions on the disk.
    >
    > The names allow disk utilities to do stuff with respect to the
    > whole disk (if you need to work on the MBR), or allow you to
    > work on individual partitions (if you wanted to back
    > up a particular partition, sector by sector).
    >
    > That command will also return size information, which you
    > can correlate with what you see in Disk Management.
    >
    > On partitions, where no size information is listed, there
    > seems to be a permissions problem that prevents them from
    > being listed in more detail.
    >
    > I have not been able to find a technical reference, that
    > decodes the "D" or "DR0" or the like, seen on the end of
    > some of the raw names. So that part of the question, is
    > still a mystery. I was hoping to find a complete listing
    > of what was possible there, but can't find any details.
    >
    > *******
    >
    > The disks seem to be named in the same order as in
    > Disk Management, but I don't have any documents to prove
    > that. That is just an observation from limited testing
    > on my machine here.
    >
    > Paul
     
  6. Paul

    Paul Flightless Bird

    Sprechen sie von C++ wrote:
    > dd is not a standard Windows command, its from Linux, get you OS strait,
    > this is a Windows area
    >


    It does a nice job of listing the storage devices and partitions. Try it.
    dd --list

    Paul
     
  7. John John - MVP

    John John - MVP Flightless Bird

    Patok wrote:
    > I was looking at the Event Viewer System log, and noticed some warnings:
    >
    > Event Type: Warning
    > Event Source: Disk
    > Event Category: None
    > Event ID: 51
    > Date: 2010-05-28
    > Time: 04:29:08
    > User: N/A
    > Computer: DELL
    > Description:
    > An error was detected on device \Device\Harddisk1\D during a paging
    > operation.
    >
    >
    > But I can't figure out which exactly disk it is (I have several
    > mounted). Is Harddisk1 the same as Disk 1 in the Disk Management
    > utility? Where can I see which disk in the \Device\ hierarchy
    > corresponds to which disk in the other utilities?
    >
    > (WinXP, of course, that's why I'm asking here.)


    The object namespace is truncated, try Sysinternals WinObj
    http://technet.microsoft.com/en-us/sysinternals/bb896657.aspx If you
    have USB drives you can try Uwe Seiber's ListUsbDrives
    http://www.uwe-sieber.de/drivetools_e.html

    John
     
  8. Barry Schwarz

    Barry Schwarz Flightless Bird

    On Sat, 29 May 2010 00:02:47 -0400, Paul <nospam@needed.com> wrote:

    >Sprechen sie von C++ wrote:
    >> dd is not a standard Windows command, its from Linux, get you OS strait,
    >> this is a Windows area
    >>

    >
    >It does a nice job of listing the storage devices and partitions. Try it.
    >dd --list


    Not on Windows XP it doesn't

    C:/Documents and Settings\Barry>dd --list
    'dd' is not recognized as an internal or external command,
    operable program or batch file.

    --
    Remove del for email
     
  9. Uwe Sieber

    Uwe Sieber Flightless Bird

    It's a trunkated kernel name of a disk device.

    Start the Windows Disk Management Console.
    (Start -> Run -> enter diskmgmt.msc here.
    Your Disk 1 is Harddisk1.
    http://www.uwe-sieber.de/gif/diskmgmt_disknumbers.png

    If it was a hotplug drive then consider that the
    disk numbers a not constants, they are assigned
    dynamic (the lowest available number is assigned).


    Uwe


    Patok wrote:
    > I was looking at the Event Viewer System log, and noticed some warnings:
    >
    > Event Type: Warning
    > Event Source: Disk
    > Event Category: None
    > Event ID: 51
    > Date: 2010-05-28
    > Time: 04:29:08
    > User: N/A
    > Computer: DELL
    > Description:
    > An error was detected on device \Device\Harddisk1\D during a paging
    > operation.
    >
    >
    > But I can't figure out which exactly disk it is (I have several
    > mounted). Is Harddisk1 the same as Disk 1 in the Disk Management
    > utility? Where can I see which disk in the \Device\ hierarchy
    > corresponds to which disk in the other utilities?
    >
    > (WinXP, of course, that's why I'm asking here.)
    >
     
  10. Paul

    Paul Flightless Bird

    Barry Schwarz wrote:
    > On Sat, 29 May 2010 00:02:47 -0400, Paul <nospam@needed.com> wrote:
    >
    >> Sprechen sie von C++ wrote:
    >>> dd is not a standard Windows command, its from Linux, get you OS strait,
    >>> this is a Windows area
    >>>

    >> It does a nice job of listing the storage devices and partitions. Try it.
    >> dd --list

    >
    > Not on Windows XP it doesn't
    >
    > C:/Documents and Settings\Barry>dd --list
    > 'dd' is not recognized as an internal or external command,
    > operable program or batch file.
    >


    Are you familiar with the execution path environment variable
    of your operating system ?

    Executable files cannot be found, unless they're in the path.

    As an example, here is how I run "dd" on my WinXP SP3 computer.

    1) Download the program.

    http://www.chrysocome.net/downloads/dd-0.5.zip

    2) Navigate to where you downloaded the program. I have a downloads
    folder that I use.

    C:/Downloads

    3) Double click the dd-0.5.zip file. Select the "Extract All" item
    from the File menu, to extract the files. The Wizard that popped
    up, suggested it would put the extracted files into this folder.
    The folder name suggested, is based on the original ZIP download
    file name.

    C:/Downloads\dd-0.5

    4) Now, you should have a folder of that name, with "dd.exe" in it.

    5) Go to the Start button, select Run, and type

    cmd

    into the box, and click "OK". A Command prompt window will open.
    It will look something like this.

    http://images.ask-leo.com/cmdprompt.png

    6) The current working directory, will point to some place you don't
    want. For example, mine is pointing to C:/Documents and Settings\...
    You need to change that. Type, for example

    cd \

    and that will change the current working directory to C:

    7) Now, you need to change directory, until you get to the folder
    with the dd program in it. Type two commands in the Command prompt
    window like this.

    cd downloads

    cd dd-0.5

    8) To prove you're in the right place, type

    dir

    and look at the list of file names. In my case, I'd expect to see
    the contents of the unzipped download. In this case, that is the
    three files

    Copying.txt
    dd.exe
    ddchanges.txt

    9) Now, you're ready to run the program, as the Windows execution path
    will look in the current working directory, to find the program in
    question. Now, type this in the Command Prompt window.

    dd --list

    Hope that helps,
    Paul
     
  11. Barry Schwarz

    Barry Schwarz Flightless Bird

    On Sat, 29 May 2010 15:22:00 -0400, Paul <nospam@needed.com> wrote:

    >Barry Schwarz wrote:
    >> On Sat, 29 May 2010 00:02:47 -0400, Paul <nospam@needed.com> wrote:
    >>
    >>> Sprechen sie von C++ wrote:
    >>>> dd is not a standard Windows command, its from Linux, get you OS strait,
    >>>> this is a Windows area
    >>>>
    >>> It does a nice job of listing the storage devices and partitions. Try it.
    >>> dd --list

    >>
    >> Not on Windows XP it doesn't
    >>
    >> C:/Documents and Settings\Barry>dd --list
    >> 'dd' is not recognized as an internal or external command,
    >> operable program or batch file.
    >>

    >
    >Are you familiar with the execution path environment variable
    >of your operating system ?
    >
    >Executable files cannot be found, unless they're in the path.
    >
    >As an example, here is how I run "dd" on my WinXP SP3 computer.
    >
    >1) Download the program.
    >
    > http://www.chrysocome.net/downloads/dd-0.5.zip


    All of which simply proves it is not a standard Windows command as
    originally asserted.

    --
    Remove del for email
     
  12. Paul

    Paul Flightless Bird

    Barry Schwarz wrote:
    > On Sat, 29 May 2010 15:22:00 -0400, Paul <nospam@needed.com> wrote:
    >
    >> Barry Schwarz wrote:
    >>> On Sat, 29 May 2010 00:02:47 -0400, Paul <nospam@needed.com> wrote:
    >>>
    >>>> Sprechen sie von C++ wrote:
    >>>>> dd is not a standard Windows command, its from Linux, get you OS strait,
    >>>>> this is a Windows area
    >>>>>
    >>>> It does a nice job of listing the storage devices and partitions. Try it.
    >>>> dd --list
    >>> Not on Windows XP it doesn't
    >>>
    >>> C:/Documents and Settings\Barry>dd --list
    >>> 'dd' is not recognized as an internal or external command,
    >>> operable program or batch file.
    >>>

    >> Are you familiar with the execution path environment variable
    >> of your operating system ?
    >>
    >> Executable files cannot be found, unless they're in the path.
    >>
    >> As an example, here is how I run "dd" on my WinXP SP3 computer.
    >>
    >> 1) Download the program.
    >>
    >> http://www.chrysocome.net/downloads/dd-0.5.zip

    >
    > All of which simply proves it is not a standard Windows command as
    > originally asserted.
    >


    Look carefully, at my original answer.

    "using this ported utility"

    What do you think that means ?

    Paul
     
  13. Patok

    Patok Flightless Bird

    Patok wrote:
    > I was looking at the Event Viewer System log, and noticed some warnings:
    >
    > Event Type: Warning
    > Event Source: Disk
    > Event Category: None
    > Event ID: 51
    > Date: 2010-05-28
    > Time: 04:29:08
    > User: N/A
    > Computer: DELL
    > Description:
    > An error was detected on device \Device\Harddisk1\D during a paging
    > operation.


    Alright, thanks to all that replied. The drive is (most likely)
    identified. Several of the clues pointed to one external USB drive; I
    disconnected it yesterday, and have had no warnings since. I'll
    reconnect it now, and see how it goes. Still, it is baffling, because I
    have enabled a pagefile only on the system boot drive, and nowhere else.
    I don't see why the system would be trying to page on that USB drive,
    unless they mean "paging" in the most generic terms - like maintaining
    consistency and such, instead of accessing a pagefile.
    On the other hand, it is one of these 'green' new Western Digital
    drives, that are quite slow to spin up, so it is possible that the first
    access would time out. I see that the event IDs are at more or less
    regular intervals - about every 1:30h or so.

    About the methods for identifying the drive - it turns out that the
    drive number in disk manager /is/ the same as what is displayed in
    \Device\Harddisk#. I suspected as much from the beginning, but wasn't
    sure, and it did not become clear from KnowledgeBase article 244780.
    However, dd, which Paul suggested, output the same information, so that
    doubly confirmed which one it is. Sysinternals WinObj, which John John
    suggested, displayed the name of the device beautifully - exactly as
    seen in the log - and gave totally no clue about which one it is, what
    properties it has, and where it is connected. :)


    > But I can't figure out which exactly disk it is (I have several
    > mounted). Is Harddisk1 the same as Disk 1 in the Disk Management
    > utility? Where can I see which disk in the \Device\ hierarchy
    > corresponds to which disk in the other utilities?


    --
    You'd be crazy to e-mail me with the crazy. But leave the div alone.
    --
    Whoever bans a book, shall be banished. Whoever burns a book, shall burn.
     
  14. Patok

    Patok Flightless Bird

    More questions (Re: Which disk is it?)

    Patok wrote:
    > Patok wrote:
    >> I was looking at the Event Viewer System log, and noticed some warnings:
    >>
    >> Event Type: Warning
    >> Event Source: Disk
    >> Event Category: None
    >> Event ID: 51
    >> Date: 2010-05-28
    >> Time: 04:29:08
    >> User: N/A
    >> Computer: DELL
    >> Description:
    >> An error was detected on device \Device\Harddisk1\D during a paging
    >> operation.

    >
    > Alright, thanks to all that replied. The drive is (most likely)
    > identified. Several of the clues pointed to one external USB drive; I
    > disconnected it yesterday, and have had no warnings since. I'll
    > reconnect it now, and see how it goes. Still, it is baffling, because I
    > have enabled a pagefile only on the system boot drive, and nowhere else.
    > I don't see why the system would be trying to page on that USB drive,
    > unless they mean "paging" in the most generic terms - like maintaining
    > consistency and such, instead of accessing a pagefile.
    > On the other hand, it is one of these 'green' new Western Digital
    > drives, that are quite slow to spin up, so it is possible that the first
    > access would time out. I see that the event IDs are at more or less
    > regular intervals - about every 1:30h or so.


    Follow-up: yes, it's definitely the slow spin-up time of the drive,
    whenever a program "touches" the data of all disks. For example, this
    warning happens every time when I print something to a PDF file, and
    that drive is asleep. Apparently, Adobe scans all the neighborhood
    before asking where to save the new file, and even though it is never on
    that drive, it gets woken up regardless. But there is another instance,
    which I'd like to ferret out - it happens every day at 4:29 local time.
    Clearly some process scans the drives at that ungodly hour (and it is
    not one of the scheduled updates that I know of - they are all at
    different times). So here I'm asking for advice:

    - How do I find out which program/process activates at 4:29 ? All logs
    are clean (except for the disk timeout). Is there a utility that logs
    activity, or drive access, or such? In the meantime I'll be shutting
    down Firefox and Thunderbird for the night - it might be their updates.

    - Even if I find out who prowls at night, there still remains the issue
    that just scanning the computer timeouts the drive. That data should be
    cashed anyway, no need to wake it up. I suspect that it happens because
    NTFS wants to write down the access time. Will turning on (in the
    registry) NtfsDisableLastAccessUpdate help? Is there any real need of
    knowing the last access time, and will any system functionality suffer,
    if it's turned off?

    --
    You'd be crazy to e-mail me with the crazy. But leave the div alone.
    --
    Whoever bans a book, shall be banished. Whoever burns a book, shall burn.
     
  15. Uwe Sieber

    Uwe Sieber Flightless Bird

    Re: More questions (Re: Which disk is it?)

    The SysInternals ProcessMonitor can monitor file accesses.
    You have to activate the logging of all volumes located
    on the disk in question.
    http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx

    Uwe



    Patok wrote:
    > Patok wrote:
    >> Patok wrote:
    >>> I was looking at the Event Viewer System log, and noticed some warnings:
    >>>
    >>> Event Type: Warning
    >>> Event Source: Disk
    >>> Event Category: None
    >>> Event ID: 51
    >>> Date: 2010-05-28
    >>> Time: 04:29:08
    >>> User: N/A
    >>> Computer: DELL
    >>> Description:
    >>> An error was detected on device \Device\Harddisk1\D during a paging
    >>> operation.

    >>
    >> Alright, thanks to all that replied. The drive is (most likely)
    >> identified. Several of the clues pointed to one external USB drive; I
    >> disconnected it yesterday, and have had no warnings since. I'll
    >> reconnect it now, and see how it goes. Still, it is baffling, because
    >> I have enabled a pagefile only on the system boot drive, and nowhere
    >> else. I don't see why the system would be trying to page on that USB
    >> drive, unless they mean "paging" in the most generic terms - like
    >> maintaining consistency and such, instead of accessing a pagefile.
    >> On the other hand, it is one of these 'green' new Western Digital
    >> drives, that are quite slow to spin up, so it is possible that the
    >> first access would time out. I see that the event IDs are at more or
    >> less regular intervals - about every 1:30h or so.

    >
    > Follow-up: yes, it's definitely the slow spin-up time of the drive,
    > whenever a program "touches" the data of all disks. For example, this
    > warning happens every time when I print something to a PDF file, and
    > that drive is asleep. Apparently, Adobe scans all the neighborhood
    > before asking where to save the new file, and even though it is never on
    > that drive, it gets woken up regardless. But there is another instance,
    > which I'd like to ferret out - it happens every day at 4:29 local time.
    > Clearly some process scans the drives at that ungodly hour (and it is
    > not one of the scheduled updates that I know of - they are all at
    > different times). So here I'm asking for advice:
    >
    > - How do I find out which program/process activates at 4:29 ? All logs
    > are clean (except for the disk timeout). Is there a utility that logs
    > activity, or drive access, or such? In the meantime I'll be shutting
    > down Firefox and Thunderbird for the night - it might be their updates.
    >
    > - Even if I find out who prowls at night, there still remains the issue
    > that just scanning the computer timeouts the drive. That data should be
    > cashed anyway, no need to wake it up. I suspect that it happens because
    > NTFS wants to write down the access time. Will turning on (in the
    > registry) NtfsDisableLastAccessUpdate help? Is there any real need of
    > knowing the last access time, and will any system functionality suffer,
    > if it's turned off?
    >
     
  16. Patok

    Patok Flightless Bird

    Re: More questions (Re: Which disk is it?)

    Thanks for the suggestion, this is perfect! I don't know how I
    missed that utility - I had already installed SysInternals Process
    Explorer some months ago. I probably didn't pay enough attention to the
    other programs on their site when downloading it, or did, and thought
    I'd never need it. Anyhow, I'll set up a trap tonight, and try to catch
    something. :)


    Uwe Sieber wrote:
    >
    > The SysInternals ProcessMonitor can monitor file accesses.
    > You have to activate the logging of all volumes located
    > on the disk in question.
    > http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx
    >
    > Uwe
    >
    >
    >
    > Patok wrote:
    >> Patok wrote:
    >>> Patok wrote:
    >>>> I was looking at the Event Viewer System log, and noticed some
    >>>> warnings:
    >>>>
    >>>> Event Type: Warning
    >>>> Event Source: Disk
    >>>> Event Category: None
    >>>> Event ID: 51
    >>>> Date: 2010-05-28
    >>>> Time: 04:29:08
    >>>> User: N/A
    >>>> Computer: DELL
    >>>> Description:
    >>>> An error was detected on device \Device\Harddisk1\D during a paging
    >>>> operation.
    >>>
    >>> Alright, thanks to all that replied. The drive is (most likely)
    >>> identified. Several of the clues pointed to one external USB drive; I
    >>> disconnected it yesterday, and have had no warnings since. I'll
    >>> reconnect it now, and see how it goes. Still, it is baffling, because
    >>> I have enabled a pagefile only on the system boot drive, and nowhere
    >>> else. I don't see why the system would be trying to page on that USB
    >>> drive, unless they mean "paging" in the most generic terms - like
    >>> maintaining consistency and such, instead of accessing a pagefile.
    >>> On the other hand, it is one of these 'green' new Western Digital
    >>> drives, that are quite slow to spin up, so it is possible that the
    >>> first access would time out. I see that the event IDs are at more or
    >>> less regular intervals - about every 1:30h or so.

    >>
    >> Follow-up: yes, it's definitely the slow spin-up time of the
    >> drive, whenever a program "touches" the data of all disks. For
    >> example, this warning happens every time when I print something to a
    >> PDF file, and that drive is asleep. Apparently, Adobe scans all the
    >> neighborhood before asking where to save the new file, and even though
    >> it is never on that drive, it gets woken up regardless. But there is
    >> another instance, which I'd like to ferret out - it happens every day
    >> at 4:29 local time. Clearly some process scans the drives at that
    >> ungodly hour (and it is not one of the scheduled updates that I know
    >> of - they are all at different times). So here I'm asking for advice:
    >>
    >> - How do I find out which program/process activates at 4:29 ? All logs
    >> are clean (except for the disk timeout). Is there a utility that logs
    >> activity, or drive access, or such? In the meantime I'll be shutting
    >> down Firefox and Thunderbird for the night - it might be their updates.
    >>
    >> - Even if I find out who prowls at night, there still remains the
    >> issue that just scanning the computer timeouts the drive. That data
    >> should be cashed anyway, no need to wake it up. I suspect that it
    >> happens because NTFS wants to write down the access time. Will
    >> turning on (in the registry) NtfsDisableLastAccessUpdate help? Is
    >> there any real need of knowing the last access time, and will any
    >> system functionality suffer, if it's turned off?
    >>



    --
    You'd be crazy to e-mail me with the crazy. But leave the div alone.
    --
    Whoever bans a book, shall be banished. Whoever burns a book, shall burn.
     
  17. Patok

    Patok Flightless Bird

    Drive timeout (Re: More questions (Re: Which disk is it?))

    Update on the timeout issue - I was able to prevent it from
    happening, by increasing the timeout value in the registry. I have no
    idea what the default timeout value in XP is, as there was no key in the
    registry, but by adding one:

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Disk]
    "TimeOutValue"=dword:00000020

    I was able to change it.

    These new WD Caviar Green SATA drives have ready times of about 14.5
    seconds, and whatever the default timeout was, it was not enough:

    http://wdc.custhelp.com/cgi-bin/wdc...&p_cv=1.185&p_pv=2.294&p_prods=227,294#jumper

    At first I thought setting it to $10 (16) would suffice, because it is
    more than 14.5, but it was not enough; 32 did it. These drives are found
    separately, as well as inside the WD Elements external USB drives, and
    the timeout happens in both. I think the issue has not been realized
    more widely, because few people actually look at the warnings in their
    event logs. :)
    It was surprisingly difficult to find information about that key -
    it is not present by default, so searching the registry for "timeout" is
    useless.



    Patok wrote:
    > Patok wrote:
    >> Patok wrote:
    >>> I was looking at the Event Viewer System log, and noticed some warnings:
    >>>
    >>> Event Type: Warning
    >>> Event Source: Disk
    >>> Event Category: None
    >>> Event ID: 51
    >>> Date: 2010-05-28
    >>> Time: 04:29:08
    >>> User: N/A
    >>> Computer: DELL
    >>> Description:
    >>> An error was detected on device \Device\Harddisk1\D during a paging
    >>> operation.

    >>
    >> Alright, thanks to all that replied. The drive is (most likely)
    >> identified. Several of the clues pointed to one external USB drive; I
    >> disconnected it yesterday, and have had no warnings since. I'll
    >> reconnect it now, and see how it goes. Still, it is baffling, because
    >> I have enabled a pagefile only on the system boot drive, and nowhere
    >> else. I don't see why the system would be trying to page on that USB
    >> drive, unless they mean "paging" in the most generic terms - like
    >> maintaining consistency and such, instead of accessing a pagefile.
    >> On the other hand, it is one of these 'green' new Western Digital
    >> drives, that are quite slow to spin up, so it is possible that the
    >> first access would time out. I see that the event IDs are at more or
    >> less regular intervals - about every 1:30h or so.

    >
    > Follow-up: yes, it's definitely the slow spin-up time of the drive,
    > whenever a program "touches" the data of all disks. For example, this
    > warning happens every time when I print something to a PDF file, and
    > that drive is asleep. Apparently, Adobe scans all the neighborhood
    > before asking where to save the new file, and even though it is never on
    > that drive, it gets woken up regardless. But there is another instance,
    > which I'd like to ferret out - it happens every day at 4:29 local time.
    > Clearly some process scans the drives at that ungodly hour (and it is
    > not one of the scheduled updates that I know of - they are all at
    > different times). So here I'm asking for advice:


    --
    You'd be crazy to e-mail me with the crazy. But leave the div alone.
    --
    Whoever bans a book, shall be banished. Whoever burns a book, shall burn.
     

Share This Page