Prev: Any recommendations for a router/hub/ap that does NetBEUI?
Next: PPPoE performance in Windows XP
From: Mike on 27 Apr 2010 11:34
I was having similar errors in my development network when perfoming automated scheduled backups that ran overnight.

Event Type: Warning
Event Source: MRxSmb
Event ID: 50
Description: {Delayed Write Failed} Windows was unable to save all the data for the file \Deveice\LanManRedirector. The data has been lost. This error may be caused by a failure of your computer hardware or network connection. Please try to save theis file elsewhere.

Event Type: Information
Event Source: Application Popup
Event ID: 26
Description: Application popup: Windows - Delayed Write Failed : Windows was unable to save all the data for the file \\ServerNmae\VolumeMountPointName\FileName. This data has been lost. This error may be caused by a failure on your computer hardware or network connection. Please try to save this file elsewhere.

Knowledge base article 890352 sounded exactly like my problem and I tried the hotfix. I tried other knowledge base articles about using drive mappings instead of UNC mappings, I tried different network cables and network switches, swapped NICS, I tried all sorts of registry entry additions and adjustments, etc. I tried about everything I could find online and nothing worked.

What ultimately fixed my problem was turning off the poriton of my Symantex firewall on the receiving server that prevents denial of service and other network related attacks. It appears that the constant flow of data into the receiving server was being seen by the firewall as an attack, and Symantex stopped allowing the data transmissions, hence the inability to continue writing data, and write failures.

Now, for me, this was all within an isolated development network which really didn't need such heavy protection in the first place, so just turning off a portion of Symantex was acceptable. This might not be the case in a production environment or where the servers have connection to the outside world (where the attackers truely are). The one oddity that we have not been able to explain is why other machines in our network which also backup to this same server were able to write their backups without error. We got it working and sort of stopped looking due to other priorities.

My network consisted of several MS Windows Server 2003 servers (web, DB, application servers, domain controller) with about a dozen development workstations all networked in. The servers all backed up to a central terabyte disk volume that was installed within the domain controller. Each server had a once weekly scheduled backup job, using the built in NT Backup utility, that wrote to the terabyte volume using UNC pathways.

Some fellow developers helped diagnose this by using pings with max packet size. The delayed responses to the central backup server, but successful pings from the individual servers to themselves using their external IPs, helped to show a general problem with large continued data flows to the central backup servers.

ping -h (to see all the options)
I think we used something like ping -n 10 -l 65500 remoteBackupServerIP
and ping -n 10 -l 65500 localServersExternalIP

I spent wasteful weeks on this issue and hope this might give an additional avenue to pursue.



William Stokes wrote:

Delayed Write Failed -- \Device\LanmanRedirector
08-May-07

Hello,

We have had problems with one application (Lotus Notes) which use files on a
network share. Basically the application crashes and after that theres this
message in the system event log:

Source: MRxSmb
EventID:50
"Windows - Delayed Write Failed
Windows was unable to save all the data for the file
\Device\LanmanRedirector
The data has been lost. This error may be caused by a failure of your
computer
hardware or network connection. Please try to save this file elsewhere."

I googled this error up and found this MS article:
http://support.microsoft.com/default.aspx?scid=kb;en-us;321733. This,
however doesn not apply to our workstations cause we already use XP SP2 in
which this error should be fixed. Also we already have the registry setting
described in the workaround.

I upgraded our network switches to 1GB devices (HP 2900 series) this spring
and these errors started to appear about the same time so I think that it's
fair to assume that this has got something to do with this? Otherwise the
network itself seems to be ok. Workstations and servers are connected at 1Gb
speed. File shares, apps and pings work ok across the network. Theres no
errors in the switch logs. Only network errors I can find are in the XP
clients system log. Network files that the problem software use are on a
Win2003R2 server. Files are personal to each user so they have full rights
to them and since these are personal files this is not a sharing violation
(=file locked by another user). I already talked to software vendor (IBM)
and their opinnion was that this is a network problem. Our hardware
(WS's/SRV's) is less than a year old so all network adapters and drivers
should be up to date.

At some workstations this error can also be seen in the system log (not so
often as the MRxSmb error):
EVENT ID 4226, TCP/IP has reached the security limit imposed on the number
of concurrent TCP connect attempts.
Could it be that in 1Gb network the restriction on 10 incomplete outbound
TCP connetions is too low??

Any idea how to troubleshoot this MRxSmb error further?

Thanks
-Will

Previous Posts In This Thread:

On Tuesday, May 08, 2007 5:06 AM
William Stokes wrote:

Delayed Write Failed -- \Device\LanmanRedirector
Hello,

We have had problems with one application (Lotus Notes) which use files on a
network share. Basically the application crashes and after that theres this
message in the system event log:

Source: MRxSmb
EventID:50
"Windows - Delayed Write Failed
Windows was unable to save all the data for the file
\Device\LanmanRedirector
The data has been lost. This error may be caused by a failure of your
computer
hardware or network connection. Please try to save this file elsewhere."

I googled this error up and found this MS article:
http://support.microsoft.com/default.aspx?scid=kb;en-us;321733. This,
however doesn not apply to our workstations cause we already use XP SP2 in
which this error should be fixed. Also we already have the registry setting
described in the workaround.

I upgraded our network switches to 1GB devices (HP 2900 series) this spring
and these errors started to appear about the same time so I think that it's
fair to assume that this has got something to do with this? Otherwise the
network itself seems to be ok. Workstations and servers are connected at 1Gb
speed. File shares, apps and pings work ok across the network. Theres no
errors in the switch logs. Only network errors I can find are in the XP
clients system log. Network files that the problem software use are on a
Win2003R2 server. Files are personal to each user so they have full rights
to them and since these are personal files this is not a sharing violation
(=file locked by another user). I already talked to software vendor (IBM)
and their opinnion was that this is a network problem. Our hardware
(WS's/SRV's) is less than a year old so all network adapters and drivers
should be up to date.

At some workstations this error can also be seen in the system log (not so
often as the MRxSmb error):
EVENT ID 4226, TCP/IP has reached the security limit imposed on the number
of concurrent TCP connect attempts.
Could it be that in 1Gb network the restriction on 10 incomplete outbound
TCP connetions is too low??

Any idea how to troubleshoot this MRxSmb error further?

Thanks
-Will


Submitted via EggHeadCafe - Software Developer Portal of Choice
Crypto Obfuscator for .NET - Product Review
http://www.eggheadcafe.com/tutorials/aspnet/bf15c41b-6510-403e-9af8-f5fd987fafb1/crypto-obfuscator-for-ne.aspx
 | 
Pages: 1
Prev: Any recommendations for a router/hub/ap that does NetBEUI?
Next: PPPoE performance in Windows XP